Complete release upgrade and operator controls

backend/tests/test_sprint31_unraid_template.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import re
 from pathlib import Path
 
 
@@ -54,6 +55,26 @@ def test_unraid_env_template_matches_single_container_compose_variables() -> Non
     assert '"${GEOINTEL_FRONTEND_PORT:-1202}:80"' in compose
 
 
+def test_unraid_template_exposes_every_operator_owned_runtime_setting() -> None:
+    run_script = (ROOT / "deploy" / "unraid" / "run-dockerman-container.sh").read_text(encoding="utf-8")
+    template = (ROOT / "deploy" / "unraid" / "geointel-unraid-template.xml").read_text(encoding="utf-8")
+
+    runtime_variables = set(
+        re.findall(r'^([A-Z][A-Z0-9_]+)="\$\{\1:-', run_script, flags=re.MULTILINE)
+    )
+    template_variables = set(re.findall(r'Target="([A-Z][A-Z0-9_]+)"', template))
+    bridged_or_internal = {
+        "GEOINTEL_FRONTEND_PORT",
+        "GEOINTEL_IMAGE",
+        "GEOINTEL_MODELS_PATH",
+        "GEOINTEL_POSTGIS_DATA_PATH",
+        "GEOINTEL_STORAGE_PATH",
+    }
+
+    assert runtime_variables - template_variables == bridged_or_internal
+    assert 'Target="/app/models"' in template
+
+
 def test_unraid_readme_explains_port_changes_and_safe_cleanup() -> None:
     readme = (ROOT / "deploy" / "unraid" / "README.md").read_text(encoding="utf-8")