Harden golden QA readiness gate

docs/CODEX_EXECUTION_LOG.md

@@ -1531,3 +1531,35 @@ Expected Unraid behavior:
 - A deploy from the repo should no longer leave the final app as a plain Compose-owned container.
 - The final image/container should avoid Compose metadata labels that can confuse Unraid's Docker page.
 - The running `geointel` container should expose `net.unraid.docker.managed=dockerman`, web UI metadata and icon metadata immediately after deploy.
+
+## Sprint 33 QA/QC benchmark readiness hardening (2026-06-17)
+
+Changed:
+- Added `scripts/verify_golden_qa_benchmark.sh` as a shell wrapper for the deterministic QA/QC golden benchmark.
+- Made `scripts/run_readiness_check.sh` run `scripts/run_golden_qa_benchmark.py --json` so QA/QC metric drift fails the main release gate.
+- Added a readiness syntax check for the golden benchmark wrapper.
+- Hardened `scripts/validate_fixtures.py` so `fixtures/golden` GeoJSON files and expected fixture paths are validated alongside the general GeoJSON fixtures.
+- Added backend regression tests that keep the golden benchmark wired into readiness.
+- Updated script/backend docs, TODO and changelog.
+
+Tested:
+- `python scripts/validate_fixtures.py`
+- `python scripts/run_golden_qa_benchmark.py --json`
+- `bash -n scripts/verify_golden_qa_benchmark.sh`
+- `bash scripts/verify_golden_qa_benchmark.sh`
+- `python -m compileall backend/app`
+- `cd backend && python -m pytest -W error::DeprecationWarning`
+- `cd frontend && npm run typecheck`
+- `cd frontend && npm run build`
+- `bash scripts/run_readiness_check.sh`
+- `cd backend && python -m alembic heads && python -m alembic upgrade head --sql`
+- `bash -n scripts/live_migration_smoke.sh`
+
+Open:
+- None for this pass.
+
+Limitations:
+- The benchmark intentionally uses explicit local fixtures only. It does not fetch live GRB/OSM data and does not run AI inference.
+
+Next recommended pass:
+- Continue with broader QA/QC golden demo coverage or frontend export preview decomposition.