Document all-in-one Tower verification

docs/CODEX_EXECUTION_LOG.md

@@ -1476,3 +1476,31 @@ Limitations:
 
 Next recommended pass:
 - Rebuild Docker on the Tower host and run `bash scripts/verify_demo_export_workflow.sh http://192.168.10.150:1202`.
+
+## Sprint 32 Unraid all-in-one runtime verification (2026-06-17)
+
+Changed:
+- Converted the Unraid/Tower runtime to a single editable `geointel` Docker container via `docker-compose.unraid.yml`.
+- Built the all-in-one image from `postgres:16-bookworm` with PostgreSQL 16/PostGIS packages, the FastAPI backend, nginx and the React frontend.
+- Removed the default nginx site from the image so `/api/v1/*` is proxied to the embedded backend instead of returning nginx 404s.
+- Hardened live migration smoke and browser runtime verification with startup retries.
+- Browser runtime verification now checks the frontend, `/api/v1/projects` canonical JSON envelope and `/geointel-icon.svg`.
+
+Tested:
+- `python -m pytest backend\tests\test_sprint31_unraid_template.py`
+- `bash -n deploy/unraid/all-in-one-start.sh`
+- `bash -n scripts/live_migration_smoke.sh`
+- `bash -n scripts/verify_browser_runtime.sh`
+- `powershell -NoProfile -ExecutionPolicy Bypass -File scripts\deploy_tower.ps1`
+- `docker compose -f docker-compose.unraid.yml ps` on Tower
+- `bash scripts/verify_browser_runtime.sh http://192.168.10.150:1202`
+
+Verified runtime:
+- Tower runs one GeoIntel app container: `geointel`.
+- Published browser port is `0.0.0.0:1202->80/tcp`.
+- Container health is `healthy`.
+- Live migration smoke passed with PostGIS available and one Alembic head.
+- Frontend, API proxy and icon are reachable at `http://192.168.10.150:1202`.
+
+Open:
+- Existing reused PostgreSQL volume logs a collation version mismatch because the old database was created on Debian glibc 2.31 and the all-in-one runtime uses glibc 2.36. Runtime and migrations pass; a future maintenance pass can rebuild/refresh collation metadata if needed.