Add regional flood hazard provisioning

docs/CODEX_EXECUTION_LOG.md

@@ -8940,3 +8940,40 @@ Boundaries and next step:
   governed municipality partitions and measured VMM scenario rasters before
   attempting a full-resolution regional DHMV expansion; no water volume or
   inland bathymetry may be inferred from flood depth.
+
+## Sprint 211 - Regional VMM flood-hazard provisioning support (2026-07-16)
+
+Implemented:
+- Added `scripts/provision_regional_flood_hazards.py`, an explicit operator
+  that resolves the approved geographic scope, validates the fixed twelve-item
+  VMM flood-hazard registry and acquires scenarios per persisted municipality
+  Area through the existing canonical API endpoints.
+- Kept all raster persistence inside the existing `FloodHazardAcquisitionService`
+  and Dataset/DatasetVersion/Job flow. The operator performs no direct WCS
+  requests, no direct PostGIS writes and no browser/startup provider fetching.
+- Added `--dry-run`, `--members`, `--products`, `--force` and
+  `--stop-on-error` controls so Mol, selected municipalities or the complete
+  28-member scope can be run safely and resumed.
+- Added packaging/readiness support so the operator is compiled and available
+  in the all-in-one Unraid image.
+- Documented that regional flood coverage remains municipality-partitioned
+  because one monolithic Kempen raster would exceed practical WCS/pixel limits.
+
+Validation:
+- Focused tests cover product/member resolution, dry-run planning, canonical
+  acquisition/selection calls and release packaging.
+
+Known limitations:
+- This pass adds the operational regional provisioner and validation contract.
+  A complete live run of all 336 municipality/scenario acquisitions is long
+  operator work and should be launched deliberately on Tower after reviewing
+  the dry-run matrix.
+- VMM flood depth remains modelled local maximum scenario depth. GeoIntel still
+  must not expose permanent waterbody volume, current water level or
+  bathymetry from this source.
+
+Next:
+- Run the regional VMM operator first for Mol/Geel with `pluviaal_current_t100`
+  on Tower, then expand to the full twelve-scenario municipality matrix if the
+  provider remains stable. After that, prioritize regional DHMV DTM/DSM with
+  the same partitioned operator discipline.

docs/DATA_SOURCES.md

@@ -383,6 +383,34 @@ De officiële audit vond geen publieke, gebiedsdekkende inland-bathymetrie voor
 Mol. Kust- en Noordzeeproducten vallen buiten de ruimtelijke scope. Waterinfo
 stations blijven puntmetingen en GRB-watergeometrie blijft tweedimensionaal.
 
+## Regionale VMM overstromingsscenario's
+
+`scripts/provision_regional_flood_hazards.py` breidt de beheerde
+VMM-overstromingsflow uit naar de goedgekeurde `kempen-transport-region`
+scope. De operator gebruikt de 28 persistente gemeente-Areas die door
+`provision_geographic_scope.py` zijn aangemaakt en roept per gemeente en per
+scenario uitsluitend de bestaande canonical API aan:
+
+- `POST /api/v1/projects/{project_id}/datasets/flood-hazard/acquire`
+- `POST /api/v1/projects/{project_id}/datasets/{dataset_id}/raster/flood-hazard/select`
+
+Deze gemeentepartities zijn bewust. Een volledig regionaal raster in een
+aanvraag zou de publieke WCS- en pixelgrenzen onnodig belasten. In de UI wordt
+een VMM-dataset alleen als overstromingslaag getoond voor het actieve
+werkgebied waaraan die dataset gekoppeld is. Zo blijft Mol bij Mol, Geel bij
+Geel, enzovoort.
+
+De regionale operator ondersteunt `--dry-run`, `--members` en `--products`.
+Een volledige scope met alle twaalf scenario's plant 336 gecontroleerde
+acquisities. Herhaalruns gebruiken bestaande checksummed Datasets via de
+backend-cache zolang de requestidentiteit niet verandert.
+
+Ook regionaal blijft de semantiek onveranderd: VMM-waterdiepte is een
+gemodelleerde maximale lokale diepte per kans- en klimaatscenario. GeoIntel kan
+oppervlakte, gemiddelde/P90/maximale diepte en de diepte-oppervlakte-integraal
+berekenen. Dat is geen gelijktijdig waterbergingsvolume, geen actuele
+waterstand en geen bathymetrie.
+
 ## Gebouwenregister
 
 The governed operator `scripts/provision_buildings_addresses_register.py`

docs/STORAGE_ARCHITECTURE.md

@@ -118,6 +118,15 @@ metadata records the 1 m native product, 5 m default analysis grid, EPSG:31370,
 derived browser views and are never authoritative. No raster binary is stored
 in PostgreSQL and no DHMV file is treated as water depth or volume.
 
+VMM flood-hazard scenario outputs follow the same raster Dataset policy. The
+bounded acquisition service stores one normalized, compressed, Area-clipped
+GeoTIFF per scenario/request identity. `provision_regional_flood_hazards.py`
+does not create a parallel storage layout: every municipality/scenario result
+is an ordinary Dataset and DatasetVersion with WCS request hashes, tile request
+URLs, response/coverage/normalized checksums, EPSG:31370 bounds, scenario
+metadata and explicit unsupported-volume flags. Repeat runs reuse matching
+ready Datasets through the acquisition service cache.
+
 BWK/Natura 2000 evidence lives under
 `storage/operator-evidence/bwk-natura2000-2025/mol/`. The `raw/` directory
 contains immutable WFS pages; the adjacent manifest records their URLs,

docs/TODO.md

@@ -26,6 +26,7 @@
 - [x] Add bounded historical orthophoto acquisition for official 1971-2025 products with a map overlay and no current-GRB QA on old imagery.
 - [x] Add BWK/Natura 2000 through an explicit provider/operator contract.
 - [x] Expand BWK/Natura 2000 state 2025 from Mol to all 28 approved Kempen municipalities with partitioned source evidence.
+- [x] Add a regional VMM flood-hazard operator that provisions official scenario rasters per municipality Area through the canonical API.
 - [x] Add annual agricultural-use parcels through an explicit provider/operator contract.
 - [x] Extend the official 1778/1873/1969 historical buildings, water and roads series from Mol to the approved regional scope with partitioned source audits.
 - [x] Connect a drawn rectangle to bounded official orthophoto acquisition, local configured-YOLO detection and persisted GRB QA.
@@ -72,6 +73,7 @@ pass live Mol validation before regional expansion.
 - [x] Integrate the separate public VMM fluvial/pluvial flood-hazard depth scenarios without presenting them as bathymetry or current water state.
 - [x] Persist scenario identity, source centimetres, normalized metres, WCS checksums, exact Area clipping and positive-depth coverage.
 - [x] Expose mapped inundation area, depth statistics and a clearly named maximum-depth area integral with a prohibition on calling it concurrent volume.
+- [x] Extend the VMM scenario workflow to the approved regional scope using 28 municipality partitions instead of one unsafe monolithic raster.
 - [ ] Define waterbody linkage, surface elevation, bottom elevation and uncertainty propagation before adding any volume metric.
 - [ ] Validate coverage gaps and prohibit extrapolation outside measured/profiled waterbodies.
 - [ ] Add independent GIS review and golden-volume fixtures before exposing the result to users or Ollama.