Clarify demo cleanup dry-run output

backend/scripts/cleanup_demo_artifacts.py

@@ -69,6 +69,7 @@ def cleanup_demo_exports(project_name: str, keep_latest: int, apply: bool) -> di
         "matched_export_count": 0,
         "selected_export_count": 0,
         "deleted_export_count": 0,
+        "candidate_files": [],
         "deleted_files": [],
         "missing_files": [],
         "skipped_outside_storage": [],
@@ -109,7 +110,9 @@ def cleanup_demo_exports(project_name: str, keep_latest: int, apply: bool) -> di
                     if apply:
                         path.unlink()
                         summary["pruned_dirs"].extend(prune_empty_parents(path, storage_root))
-                    summary["deleted_files"].append(str(path))
+                        summary["deleted_files"].append(str(path))
+                    else:
+                        summary["candidate_files"].append(str(path))
                 else:
                     summary["missing_files"].append({"export_id": str(export.id), "storage_path": str(path)})
 

backend/tests/test_sprint24_cleanup_demo_artifacts.py

@@ -73,3 +73,11 @@ def test_cleanup_script_defaults_to_explicit_demo_project() -> None:
     assert args.project_name == cleanup.DEMO_PROJECT_NAME
     assert args.keep_latest == 3
     assert args.apply is False
+
+
+def test_cleanup_script_reports_dry_run_candidates_separately() -> None:
+    script = Path(__file__).resolve().parents[2] / "backend" / "scripts" / "cleanup_demo_artifacts.py"
+    content = script.read_text(encoding="utf-8")
+
+    assert '"candidate_files": []' in content
+    assert 'summary["candidate_files"].append(str(path))' in content

docs/CODEX_EXECUTION_LOG.md

@@ -4,18 +4,20 @@ Changed:
 - Added `scripts/cleanup_demo_artifacts.py` for dry-run-first cleanup of old offline demo export artifacts.
 - Added `backend/scripts/cleanup_demo_artifacts.py` so the same cleanup can run inside the backend Docker container.
 - Cleanup is constrained to an exact demo project name by default, keeps the newest exports per project and refuses file deletion outside `STORAGE_ROOT`.
-- Added regression tests for cleanup selection, path safety and readiness gate coverage.
+- Added regression tests for cleanup selection, path safety, dry-run candidate reporting and readiness gate coverage.
 - Added Python compile validation for the cleanup script to `scripts/run_readiness_check.sh`.
 - Documented cleanup usage in `scripts/README.md`, `docs/STORAGE_ARCHITECTURE.md`, `backend/README.md`, `docs/TODO.md` and `CHANGELOG.md`.
 
 Validation:
 - `python -m py_compile scripts/cleanup_demo_artifacts.py` passed.
 - `python -m pytest backend/tests/test_sprint24_cleanup_demo_artifacts.py backend/tests/test_readiness_gate.py` passed: 10 tests.
-- `bash scripts/run_readiness_check.sh` passed twice after adding the backend container entrypoint: 151 backend tests, frontend typecheck/build, Alembic head check and script syntax checks.
+- `bash scripts/run_readiness_check.sh` passed twice after adding the backend container entrypoint: 152 backend tests, frontend typecheck/build, Alembic head check and script syntax checks.
 - `python -m compileall backend/app` passed.
 - `cd backend && python -m alembic upgrade head --sql` passed.
 - `bash -n scripts/live_migration_smoke.sh` and `bash -n scripts/verify_demo_export_workflow.sh` passed.
 - Local `docker compose config` could not run because the Windows Docker CLI is not installed in this Codex environment.
+- Tower deploy/live migration/browser runtime passed after commit `6bf0610`.
+- Live backend-container cleanup dry-run exposed and then fixed confusing dry-run labeling so candidates are reported as `candidate_files`, not `deleted_files`.
 
 Notes:
 - No API contracts, migrations, product features, provider fetching, AI inference or source dataset cleanup behavior changed.