Add governed GRB refresh workflow

docs/CODEX_EXECUTION_LOG.md

@@ -9339,3 +9339,36 @@ Next:
 - Extend the same probe pattern only where another official source publishes a
   stable machine-readable edition. Do not infer release versions from service
   protocol versions, ETags or HTTP modification dates.
+
+## Sprint 223 - Governed regional GRB refresh (2026-07-16)
+
+Implemented:
+- Added a canonical read-only refresh plan that maps the official dated GRB
+  edition onto the immutable regional buildings, roads, water and parcel
+  temporal series.
+- Added explicit per-layer current/update/review states, existing Dataset,
+  feature/storage impact and non-destructive action guidance.
+- Added `manage_grb_refresh.py` with separate plan, fetch-only stage and
+  checksum-confirmed apply phases. Stage validates all retained artifacts and
+  municipality partitions; apply revalidates the exact staged plan before
+  calling the existing regional DatasetService-based operators.
+- Added a compact Status surface after the explicit official catalog check.
+
+Boundaries:
+- No migration, scheduler, arbitrary provider URL, browser-triggered heavy
+  import, direct vector-feature write or automatic Dataset replacement was
+  introduced.
+- Existing GRB snapshots remain immutable historical observations. Exact
+  remote deltas are reported only after full staging, never guessed from
+  capabilities metadata.
+
+Validation so far:
+- Backend compile and frontend typecheck passed.
+- Source-catalog plus governed-refresh focused suite passed: 20 tests.
+- Full `scripts/run_readiness_check.sh` passed: 779 backend tests, 110
+  documented route contracts, one Alembic head, frontend typecheck/build and
+  all packaged smoke checks.
+
+Next:
+- Run the full release gate, deploy to Tower, execute a live read-only plan and
+  then stage/apply only the exact confirmed official edition.