Add governed orthophoto release preflight

docs/API_CONTRACTS.md

@@ -466,6 +466,16 @@ revalidates the current catalog and delegates to the existing Dataset upload
 contract. No ALZ release endpoint, background task or provider URL parameter
 is added; v1/v2 campaign snapshots remain non-importable.
 
+Current-orthophoto release preflight also remains outside the HTTP request
+cycle in `scripts/orthophoto_release_preflight.py`. It composes the existing
+product-registry and source-catalog envelopes with allowlisted WMS
+`GetCapabilities`, WCS `DescribeCoverage` and bounded `Vliegdagcontour`
+`GetFeatureInfo` evidence for one 128-1,024 m EPSG:4326 selection. The result
+reports product variant, official `YYYY.NN` edition, exact raster-domain
+containment, sampled flight dates/years, local comparison state and
+`staging_permitted`. It performs no pixel request, upload, Job, Dataset write
+or legacy metadata rewrite. This operator script adds no public API contract.
+
 The endpoint accepts no arbitrary URL, feature query, area or layer. It does
 not fetch vector features, raster pixels or models, create jobs/datasets, write
 to PostGIS or trigger an import. The normal `source-freshness` endpoint remains

docs/CODEX_EXECUTION_LOG.md

@@ -9715,3 +9715,40 @@ Live validation:
 Next:
 - Evaluate ALZ as the next governed edition probe only after its official
   machine-readable release version and schema stability are verified.
+## Sprint 230 - Governed orthophoto release preflight (2026-07-17)
+
+Implemented:
+- Added `scripts/orthophoto_release_preflight.py` as a read-only gate for one
+  bounded current-orthophoto selection in the approved Kempen regional scope.
+- Bound the existing canonical product registry and source-catalog result to
+  the exact official WMS 1.3.0 capabilities hash, ISO metadata identifier and
+  `YYYY.NN` edition. Redirects, hosts, paths and response sizes fail closed.
+- Added metadata-only WCS `DescribeCoverage` validation for `Ortho`,
+  EPSG:31370, the complete raster domain, 15 cm rectified grid, three bands and
+  TIFF native format. Selection limits remain identical to acquisition:
+  128-1,024 m per projected side.
+- Added a maximum 64-point deterministic `Vliegdagcontour` grid with exact
+  GeoJSON layer/date/year validation and hashed sample evidence. WCS domain
+  containment proves raster-domain coverage; point samples remain honestly
+  labelled as flight-date evidence rather than polygon-union geometry.
+- Kept all pixel requests, filesystem staging, Jobs, Dataset/PostGIS writes,
+  migrations and browser behavior out of this sprint. Local
+  `most_recent_at_*` acquisition markers remain non-comparable and blocked.
+
+Validation so far:
+- 42 focused preflight/runtime-packaging tests passed. Coverage includes
+  release ordering, legacy provenance, hash drift, product variant, official
+  host/path, queryable/GeoJSON capability, WCS identity/resolution, missing
+  flight coverage, flight-year mismatch, selection bounds and no-write rules.
+- Target Python compilation and Ruff passed.
+- A read-only compatibility run against Tower for bbox
+  `5.110,51.180,5.117,51.185` verified official edition `2025.04`, exact Ortho
+  WCS domain containment and 20/20 flight-day samples from 2025. It performed
+  zero pixel requests and correctly returned `staging_permitted=false` because
+  local version `most_recent_at_2026-07-15` is not an official edition.
+
+Boundary:
+- This sprint supplies preflight only. It deliberately does not promote or
+  backfill existing orthophotos. A future stage/review/apply coordinator must
+  revalidate and retain the exact preflight identity before creating a new
+  immutable raster Dataset with official `YYYY.NN` source version.

docs/DATABASE_IMPLEMENTATION_PLAN.md

@@ -291,6 +291,14 @@ annual Dataset, DatasetVersion and vector_features records with
 `source_version=<year>-definitive`. Earlier annual snapshots are retained and
 provisional v1/v2 publications cannot create rows.
 
+The current-orthophoto release preflight likewise adds no lifecycle table or
+migration. It is read-only and creates neither Dataset nor Job. It compares the
+existing local `source_version` with the official `YYYY.NN` catalog edition
+and verifies WMS/WCS/flight-day evidence for one bounded selection. A later
+governed pixel apply must still create an immutable raster Dataset plus
+DatasetVersion through DatasetService and retain that exact edition/evidence;
+direct metadata backfill of legacy `most_recent_at_*` rows is prohibited.
+
 ## Geometry normalization
 
 - User-drawn polygons arrive as EPSG:4326.

docs/DATA_SOURCES.md

@@ -24,6 +24,21 @@ aanvraag. GeoIntel verzint geen historische pixelopnamedatum. Bronnen:
 - https://www.vlaanderen.be/datavindplaats/catalogus/orthofotomozaiek-middenschalig-winteropnamen-kleur-meest-recent-vlaanderen
 - https://www.vlaanderen.be/digitaal-vlaanderen/onze-diensten-en-platformen/luchtopnamen/gebruik-orthofotomozaieken
 
+Voor een toekomstige rolling-releasebeslissing gebruikt
+`scripts/orthophoto_release_preflight.py` uitsluitend metadata. Het bindt de
+lokale `most_recent`-productvariant aan de officiële ISO-editie en exacte WMS-
+capabilitieshash, controleert het EPSG:31370/15 cm/driebanden-rasterdomein via
+WCS `DescribeCoverage` en bemonstert de querybare `Vliegdagcontour` op een
+deterministisch raster met maximaal 128 m afstand. Er worden geen `GetMap`-,
+`GetCoverage`- of uploadrequests uitgevoerd.
+
+De WCS-domeincontrole bewijst dat de volledige begrensde selectie binnen het
+officiële rasterdomein valt. De WMS publiceert geen vliegdagpolygonen als WFS;
+het vluchtjaar blijft daarom expliciet puntbewijs en geen verzonnen polygon-
+union. Een selectie met ontbrekende contourpunten, meerdere/afwijkende
+vluchtjaren, gewijzigde service-identiteit of een niet-vergelijkbare lokale
+`most_recent_at_*` marker is niet stagebaar.
+
 Dit document verzamelt concrete databronnen voor GeoIntel Kempen.
 
 ## Cross-domain official area profile
@@ -174,7 +189,7 @@ gebeurd.
 | GRB gebouwen/wegen/water/percelen | operationele, expliciete plan-stage-apply refresh met onveranderlijke snapshots | alleen een nieuw officieel gedateerd cataloguseditie na operatorbevestiging ophalen |
 | Statbel bevolking | jaarlijkse, expliciete edities in één tijdreeks; officiële DCAT-releaseprobe | een nieuwe publicatie alleen na schema-, sectorgeometrie- en totalencontrole toevoegen |
 | ALZ landbouwgebruikspercelen | definitieve jaarlijkse edities 2008-2025; expliciete publicatieprobe en plan-stage-review-apply promotie; metricvergelijking zonder objectlineage | alleen een nieuwere definitieve v3-editie na gestagede schema-/codelijst-/scopecontrole en benoemde review toevoegen |
-| orthofoto | vaste lokale opname per expliciete analysezone; catalogusprobe is alleen een signaal | vluchtjaar, productvariant en dekking vergelijken voordat nieuwe pixels worden opgehaald |
+| orthofoto | vaste lokale opname per expliciete analysezone; read-only releasepreflight voor variant, officiële editie, exact WCS-domein en begrensd vluchtjaarbewijs | eerst officiële lokale editieprovenance vastleggen; daarna pas een afzonderlijke menselijke pixel-stage/apply-flow bouwen |
 | landgebruik, thematische rasters, DHMV en VMM-scenario's | vaste product-/scenario-edities, geen rolling snapshot | alleen een nieuwe gedocumenteerde producteditie als afzonderlijke Dataset verwerven |
 | bodemkaart en historische kaarten | historische referentie-editie | niet als verouderde actuele bron labelen; alleen vervangen bij een officiële inhoudelijke heruitgave |
 | BWK/Natura 2000 en gebouwen-/adressenregister | expliciete actuele snapshot met eigen methodologische betekenis | eerst een stabiele officiële editieprobe en bron-specifieke reconciliatiecontrole toevoegen |

docs/DATA_SPECIFICATION.md

@@ -274,6 +274,13 @@ layer, observation label, `observed_at`, optional `valid_from`/`valid_to`,
 temporal granularity, request/spatial hash, attribution and a limitation that
 states whether the product is annual, multi-year or merely most recent.
 
+A future rolling `most_recent` import must also retain the exact official
+`YYYY.NN` edition and the preflight identities for WMS capabilities, WCS
+coverage description, selected EPSG:31370 domain and sampled flight year. A
+legacy `most_recent_at_<date>` value is acquisition timing, not an official
+edition, and cannot be promoted or compared as if it were one. The read-only
+preflight creates no Dataset and does not retroactively rewrite that evidence.
+
 ### Hydrological station observations
 
 Waterinfo observations are persisted as EPSG:4326 Point features, one station

docs/STORAGE_ARCHITECTURE.md

@@ -147,6 +147,14 @@ product/layer, request/spatial hash, temporal validity and limitations are held
 in source/provenance metadata. Browser PNG rendering is derived on request and
 does not replace the stored GeoTIFF.
 
+The orthophoto release preflight writes no source file, raster or database row.
+Its JSON stdout may be retained by an operator as review evidence, but it is
+not itself staging authorization. The report binds official WMS and WCS XML
+hashes, the exact selected domain and hashed flight-day sample evidence. A
+future pixel stage must persist and revalidate that identity separately before
+DatasetService is called; existing `most_recent_at_*` raster metadata is not
+silently rewritten.
+
 DHMV II DTM/DSM outputs are also normal raster Dataset files. The provider WCS
 returns multipart coverage data; GeoIntel retains response and extracted
 coverage SHA256 values in provenance, then stores one normalized, compressed,

docs/TODO.md

@@ -690,5 +690,8 @@ This file now starts with the current implementation status. Older preparation/b
 - [x] Document refresh readiness across the complete official-source portfolio.
 - [x] Verify and add the governed ALZ catalog probe against the official
   campaign-snapshot and definitive-archive publication contract.
-- [ ] Keep orthophoto refresh manual until product variant, flight year and
-  complete selected-area coverage can be compared deterministically.
+- [x] Add a read-only orthophoto preflight for product variant, official
+  edition, exact WCS selected-area domain and deterministic flight-year points.
+- [ ] Keep orthophoto pixel refresh manual and blocked until a separate
+  plan-stage-review-apply flow can retain the passed preflight identity and
+  create a new immutable Dataset with official `YYYY.NN` source version.