Add fail-closed Belgian training loop

docs/BELGIUM_BUILDING_TRAINING_LOOP.md

@@ -0,0 +1,79 @@
+# Belgian building detector: closed training loop
+
+## Meaning of complete
+
+`100% trained` means that every frozen release gate below passes. It does not
+mean a fabricated 100% precision, recall or mAP score. A model that memorises a
+small test set is not complete.
+
+The loop is:
+
+1. provision new, spatially independent AOIs from governed official services;
+2. freeze imagery, labels, metadata and checksums into a new corpus version;
+3. reject invalid, duplicate and sub-resolution labels and run spatial-leakage
+   checks;
+4. train only on the train split with CUDA on the Tower NVIDIA GPU;
+5. use validation for early stopping and calibration only for threshold choice;
+6. evaluate the fixed threshold once on regional test and background-test data;
+7. attribute false positives and false negatives to a region, AOI and context;
+8. add new training-only examples for the observed failure modes and repeat;
+9. stop only when every objective gate passes; request human review afterward.
+
+Protected calibration, test and background-test AOIs never become training
+data. A new iteration adds independent training AOIs instead.
+
+## Frozen release gates
+
+| Area | Gate |
+| --- | --- |
+| Runtime | CUDA required; NVIDIA device visible; no CPU fallback |
+| Corpus | Immutable manifest and artifacts with SHA-256 evidence |
+| Geographic composition | Each land region has at least 10 train, 2 val, 3 calibration, 3 test and 2 background-test AOIs |
+| Contexts | Dense urban, suburban, rural, industrial and difficult negative contexts represented |
+| Leakage | No intersecting AOIs across protected split roles |
+| Label integrity | No malformed rows; sub-resolution labels explicitly rejected |
+| Temporal truth | Unknown per-pixel dates remain unknown; acquisition dates may not masquerade as observation dates |
+| Threshold selection | Calibration set only; maximise the worst regional F1 before aggregate F1 |
+| Test aggregate | F1 at least 0.55 at the frozen footprint/detection match IoU 0.25 contract |
+| Regional test | Every region: F1 at least 0.45, precision at least 0.50 and recall at least 0.40 |
+| Pure background | Zero detections on every pure-empty tile at the selected threshold |
+| Production | Exact candidate checksum and fail-closed promotion report required |
+| Final review | Human accepts every queued AOI contact sheet after all automated gates pass |
+
+These are minimum release gates, not performance targets. Raising a confidence
+threshold until detections disappear cannot pass because regional recall is a
+simultaneous gate.
+
+## Current gap inventory
+
+The v3 corpus closes basic composition and leakage gaps with 60 independent
+AOIs and 10,262 accepted building labels. It adds coastal, ribbon-development,
+farmland, park, forest and additional urban contexts. Its remaining known gaps
+are:
+
+- all rolling regional mosaics have an unknown exact per-pixel observation
+  date; this is recorded honestly and must be resolved through dated provider
+  products or change-aware label review, never inferred from download time;
+- GRB/PICC/UrbIS describe ground footprints, whereas visible roofs can remain
+  displaced. The existing detector QA contract therefore uses IoU 0.25; the
+  threshold is frozen and cannot be relaxed per candidate;
+- the first loop candidate generalises poorly in Flanders and Wallonia,
+  especially Mechelen, Sint-Niklaas, Leuven, Mons and dense PICC areas;
+- sparse hard contexts pass the empty-image test more easily than dense urban
+  recall, so both gates must remain independent;
+- building boxes are a valid first detector contract, but footprint-perfect
+  geometry ultimately requires a separately validated segmentation model.
+
+The active production model remains unchanged while any gate fails.
+
+## Reproducible evidence
+
+- corpus assembler: `scripts/assemble_belgium_building_corpus.py`;
+- corpus auditor: `scripts/audit_belgium_building_corpus.py`;
+- tile exporter/auditor/contact sheets: the `operator_yolo` scripts;
+- per-AOI evaluator: `scripts/evaluate_belgium_building_candidate.py`;
+- calibration-only selection and release gates:
+  `scripts/assess_belgium_building_training_iteration.py`.
+
+Every failed assessment returns `continue_training_loop`. Only a report with
+`training_complete` may proceed to final human review and guarded activation.

docs/CODEX_EXECUTION_LOG.md

@@ -11531,3 +11531,26 @@ Next gate:
   production gate, so it was not promoted. The active model remains unchanged.
   The deterministic audit status is `needs_human_review`: an AI-assisted visual
   inspection cannot be represented as the required human approval.
+
+## 2026-07-27 - Closed national training loop and corpus v3
+
+- Defined a fail-closed completion contract: calibration selects a threshold by
+  worst-region F1, while independent regional test and pure-empty background
+  sets decide completion. Passing requires aggregate F1 0.55, every region F1
+  0.45/precision 0.50/recall 0.40 and zero pure-empty detections.
+- Added deterministic per-AOI IoU matching and iteration assessment scripts.
+  Protected AOIs remain excluded from training and a failed assessment emits
+  `continue_training_loop` rather than a success-shaped result.
+- Expanded the governed portfolio from 42 to 60 AOIs: per region 10 train, two
+  validation, three calibration, three test and two background-test samples.
+  Frozen corpus `building-be-v3-20260727-r1` contains 10,262 accepted labels;
+  manifest SHA-256 is
+  `299212d1b3881330a6e3e936836d279435ab80c156a012121fe566ad0f3eae22`.
+- Corpus composition and spatial leakage pass. All 60 mosaics retain explicit
+  unknown per-pixel observation time; no download timestamp is used as a false
+  alignment claim.
+- The first 97-epoch loop candidate improved validation mAP50 to `0.250` and
+  mAP50-95 to `0.0835`, but the strict regional assessment failed, particularly
+  for Flanders and Wallonia, and recorded one pure-empty false positive at the
+  calibration-selected threshold. Training therefore continued on v3; no model
+  was promoted and human review remains intentionally deferred.

docs/TODO.md

@@ -950,3 +950,7 @@ This file now starts with the current implementation status. Older preparation/b
 - [x] Expand each region/context/split until the national minimum-composition gate passes (42 independent 256 m AOIs at 25 cm, including pure-background and hard-negative contexts).
 - [x] Run explicit spatial leakage and independent calibration/test evaluation.
 - [ ] Promote only if every regional and pure-background gate passes.
+- [x] Freeze the objective train/evaluate/error-analysis loop and regional exit gates.
+- [x] Expand the second corpus wave to 60 independent AOIs and 10,262 accepted labels.
+- [ ] Resolve the v3 Flanders and Wallonia generalisation failures through additional training-only evidence and retraining.
+- [ ] Replace unknown rolling-mosaic observation time with governed dated imagery where the regional provider exposes it; otherwise retain the explicit temporal limitation.