Add demo cleanup dry-run smoke

docs/CODEX_EXECUTION_LOG.md

@@ -2294,3 +2294,28 @@ Limitations:
 
 Next recommended pass:
 - Add a small live maintenance smoke that runs cleanup in dry-run mode through the deployed all-in-one container.
+
+## Sprint 58 demo cleanup dry-run smoke (2026-06-18)
+
+Changed:
+- Added `scripts/verify_demo_cleanup_dry_run.sh` as a live maintenance smoke for the demo export cleanup path.
+- The smoke auto-detects a running compose backend or all-in-one `geointel` container, with explicit `CLEANUP_MODE=local|compose|container` overrides.
+- The smoke runs cleanup without `--apply`, then verifies `dry_run=true`, `deleted_export_count=0`, `deleted_files=[]`, expected filter settings and candidate dry-run fields.
+- Added the smoke syntax check to `scripts/run_readiness_check.sh`.
+- Added regression coverage that the readiness gate checks the smoke and that the smoke contract remains non-mutating.
+- Updated `scripts/README.md`, `docs/STORAGE_ARCHITECTURE.md`, `backend/README.md`, `docs/TODO.md` and `CHANGELOG.md`.
+
+Tested:
+- `bash -n scripts/verify_demo_cleanup_dry_run.sh`
+- `python -m py_compile scripts/cleanup_demo_artifacts.py backend/scripts/cleanup_demo_artifacts.py`
+- `cd backend && python -m pytest tests/test_readiness_gate.py tests/test_sprint24_cleanup_demo_artifacts.py -q` (`18 passed`)
+- `bash scripts/run_readiness_check.sh` (`219 passed`)
+
+Open:
+- Commit, deploy Tower, then run the live smoke against Tower's all-in-one container.
+
+Limitations:
+- The readiness gate checks this live smoke's syntax only. The actual cleanup dry-run still requires a running backend/PostGIS runtime.
+
+Next recommended pass:
+- Add browser screenshot artifact automation for visual regression handoff.

docs/STORAGE_ARCHITECTURE.md

@@ -117,6 +117,18 @@ tiles, rasters or masks. `--max-delete` defaults to 25 and blocks oversized
 apply runs until the operator increases the cap after reviewing dry-run output.
 Repeat `--export-type` to restrict cleanup to selected artifact kinds.
 
+Live runtime validation for this maintenance path is available as a dry-run
+smoke:
+
+```bash
+bash scripts/verify_demo_cleanup_dry_run.sh
+CLEANUP_MODE=container CLEANUP_CONTAINER=geointel bash scripts/verify_demo_cleanup_dry_run.sh
+```
+
+The smoke never passes `--apply`. It fails if the cleanup summary is not a
+dry-run, if any export/file deletion is reported, or if the dry-run candidate
+fields are missing.
+
 ## Model storage
 
 Model artifacts live under:

docs/TODO.md

@@ -327,4 +327,5 @@ This file now starts with the current implementation status. Older preparation/b
 - [x] Improve live visual shell width, scroll behavior and Map workspace layout at 1280px.
 - [x] Add export history filtering controls for long-running demo environments.
 - [x] Add a safe export retention/cleanup command for demo environments.
-- [ ] Add a live dry-run maintenance smoke for demo export cleanup.
+- [x] Add a live dry-run maintenance smoke for demo export cleanup.
+- [ ] Add browser screenshot artifact automation for visual regression handoff.