Constrain selections to active work areas

docs/CODEX_EXECUTION_LOG.md

@@ -9904,10 +9904,12 @@ V1 completion status:
 Implemented:
 - Corrected the map-first selection scope after live API evidence showed that a
   drawn bbox plus the active `area_id` returned the complete municipality
-  vector population. Drawn and manual bboxes now omit `area_id`; the explicit
-  full-work-area action keeps the exact persisted Area geometry.
-- Applied the same scope decision to current theme queries, temporal
-  comparisons, derived selection datasets and vector exports.
+  vector population. The shared selection contract now resolves `bbox ∩ Area`;
+  a bbox enclosing the complete Area keeps the exact persisted geometry and
+  only that case may use the full-Area fast path.
+- Applied the same constrained geometry to current theme queries, temporal
+  comparisons, derived selection datasets and vector exports, including
+  boundary-crossing rectangle regressions.
 - Added Area-aware persistent vector selection exports and
   `POST /api/v1/exports/map-result`. Current vector, governed raster and
   temporal exports are recomputed server-side from persisted data before an
@@ -9923,14 +9925,19 @@ Implemented:
   workbench container on navigation, bounded the desktop map layout, removed
   nested desktop scrolling from Detection Lab and added plain-language QA/F1
   interpretation.
+- Limited Detection Lab's luchtbeeld selector to ready imagery rasters;
+  terrain, flood-hazard and thematic policy rasters remain available only in
+  their correct map workflows.
 - Translated the visible Downloads workflow and moved technical identifiers to
   the existing history disclosure.
 
 Validation:
 - Focused operational-correctness, map-selection, export and V1 flow tests
   passed after the corrected selection semantics were applied.
-- The complete readiness gate passed 895 backend tests, backend compilation,
+- The final complete readiness gate passed 899 backend tests, backend compilation,
   documentation smoke, API contract audit, the single Alembic head
   `202607160001`, frontend TypeScript typecheck and the production build.
-- Live all-in-one deployment, exact bbox/full-Area API comparison and browser
-  acceptance follow from this validated repository state.
+- Commit `a29c787` passed the first live deployment, exact bbox/full-Area API
+  comparison and persistent Downloads browser handoff. The final constrained
+  boundary and luchtbeeld-filter follow-up is validated below before its
+  replacement deployment.