Complete release upgrade and operator controls

backend/tests/test_rc5_release_deployment.py

@@ -78,9 +78,24 @@ def test_readiness_checks_all_release_shell_entrypoints() -> None:
     for path in (
         "scripts/deploy_tower.sh",
         "scripts/verify_release_fresh_install.sh",
+        "scripts/verify_release_upgrade_smoke.sh",
         "deploy/unraid/all-in-one-start.sh",
         "deploy/unraid/run-dockerman-container.sh",
         "deploy/unraid/deploy-release.sh",
         "deploy/unraid/rollback-dockerman-container.sh",
     ):
         assert f"bash -n {path}" in readiness
+
+
+def test_upgrade_smoke_restores_and_upgrades_only_an_isolated_database() -> None:
+    script = (ROOT / "scripts" / "verify_release_upgrade_smoke.sh").read_text(encoding="utf-8")
+
+    assert "--confirm-isolated-upgrade" in script
+    assert "restore_release_backup_smoke.sh" in script
+    assert "--keep-database" in script
+    assert "geointel_restore_verify_" in script
+    assert 'make_url(os.environ["DATABASE_URL"])' in script
+    assert ".set(database=os.environ[\"TARGET_DB\"])" in script
+    assert "python -m alembic upgrade head" in script
+    assert "production_database_untouched" in script
+    assert 'dropdb --if-exists -U "$db_user" "$TARGET_DB"' in script

backend/tests/test_sprint31_unraid_template.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import re
 from pathlib import Path
 
 
@@ -54,6 +55,26 @@ def test_unraid_env_template_matches_single_container_compose_variables() -> Non
     assert '"${GEOINTEL_FRONTEND_PORT:-1202}:80"' in compose
 
 
+def test_unraid_template_exposes_every_operator_owned_runtime_setting() -> None:
+    run_script = (ROOT / "deploy" / "unraid" / "run-dockerman-container.sh").read_text(encoding="utf-8")
+    template = (ROOT / "deploy" / "unraid" / "geointel-unraid-template.xml").read_text(encoding="utf-8")
+
+    runtime_variables = set(
+        re.findall(r'^([A-Z][A-Z0-9_]+)="\$\{\1:-', run_script, flags=re.MULTILINE)
+    )
+    template_variables = set(re.findall(r'Target="([A-Z][A-Z0-9_]+)"', template))
+    bridged_or_internal = {
+        "GEOINTEL_FRONTEND_PORT",
+        "GEOINTEL_IMAGE",
+        "GEOINTEL_MODELS_PATH",
+        "GEOINTEL_POSTGIS_DATA_PATH",
+        "GEOINTEL_STORAGE_PATH",
+    }
+
+    assert runtime_variables - template_variables == bridged_or_internal
+    assert 'Target="/app/models"' in template
+
+
 def test_unraid_readme_explains_port_changes_and_safe_cleanup() -> None:
     readme = (ROOT / "deploy" / "unraid" / "README.md").read_text(encoding="utf-8")