From d8366abaf1573025972f8ef9650455a41ea7a3e7 Mon Sep 17 00:00:00 2001
From: Your Name <you@example.com>
Date: Thu, 2 Jul 2026 11:02:35 +0800
Subject: [PATCH] fix(cd): persist controlled profile before b5 gate

---
 .gitea/workflows/cd.yaml                       |  6 ++++++
 docs/LOGBOOK.md                                | 18 ++++++++++++++++++
 .../test_cd_controlled_runtime_profile.py      |  7 +++++++
 3 files changed, 31 insertions(+)

diff --git a/.gitea/workflows/cd.yaml b/.gitea/workflows/cd.yaml
index 48d0bf72..bf840617 100644
--- a/.gitea/workflows/cd.yaml
+++ b/.gitea/workflows/cd.yaml
@@ -684,6 +684,7 @@ jobs:
             echo "AWOOOI_CD_TEST_PROFILE=full" >> "$GITHUB_ENV"
             echo "✅ full API test profile selected"
           fi
+          printf '%s\n' "$AWOOOI_CD_TEST_PROFILE" > .awoooi-cd-test-profile
 
           cat > /tmp/awoooi-api-tests.sh <<'CI_SCRIPT'
           VENV=/opt/api-venv
@@ -954,6 +955,11 @@ jobs:
       #   修法: 把 pg-test-b5 加入 act task 的 network,用 container name 連線
       - name: Integration Tests (B5 — 真實 DB)
         run: |
+          if [ -z "${AWOOOI_CD_TEST_PROFILE:-}" ] && [ -f .awoooi-cd-test-profile ]; then
+            AWOOOI_CD_TEST_PROFILE="$(tr -d '\r\n' < .awoooi-cd-test-profile)"
+            export AWOOOI_CD_TEST_PROFILE
+          fi
+          echo "B5 effective test profile=${AWOOOI_CD_TEST_PROFILE:-full}"
           if [ "${AWOOOI_CD_TEST_PROFILE:-full}" = "controlled-runtime" ]; then
             echo "✅ controlled-runtime profile: B5 DB integration unchanged; skipping B5 for this narrow release lane"
             exit 0
diff --git a/docs/LOGBOOK.md b/docs/LOGBOOK.md
index 8ca5bef0..5bf01d02 100644
--- a/docs/LOGBOOK.md
+++ b/docs/LOGBOOK.md
@@ -1,3 +1,21 @@
+## 2026-07-02 — 11:01 Gitea CD B5 profile 跨 step 漂移修正
+
+**照主線修正的問題**：
+- Gitea CD `#4355` latest main `67c22f0a` 失敗於 tests job：API tests 前段已選到 `controlled-runtime`，並完成 `3665 passed, 23 skipped`；但後續 B5 step 沒有讀到跨 step 的 `AWOOOI_CD_TEST_PROFILE`，重新落回 full，最後打到 `BLOCKER b5_docker_socket_unavailable`。
+- 這不是 110 CPU / runner label / host pressure blocker；`#4355` log 顯示 `no host web/build/smoke pressure detected`、無 no-matching runner，而是 Gitea/act `GITHUB_ENV` 在該 step 沒可靠帶過去。
+- `.gitea/workflows/cd.yaml` 現在於 profile selector 同步寫入 `.awoooi-cd-test-profile`；B5 step 先從此檔讀回 effective profile，再判斷是否跳過 B5，避免 controlled-runtime 窄發布因 env 漂移誤跑 Docker socket path。
+- `ops/runner/test_cd_controlled_runtime_profile.py` 鎖定 persisted profile 必須在 B5 gate 前讀取，且 B5 skip 必須在 Docker socket mount 前發生。
+
+**驗證**：
+- `python3.11 -c "import yaml; yaml.safe_load(open('.gitea/workflows/cd.yaml')); print('cd YAML OK')"`：通過。
+- `python3.11 -m pytest ops/runner/test_cd_controlled_runtime_profile.py -q`：`43 passed`。
+- `python3.11 ops/runner/guard-gitea-runner-pressure.py --root .`：`GITEA_RUNNER_PRESSURE_GUARD_OK workflow_files=12 scheduled_workflows=4 auto_branch_events_on_110=0 generic_runner_labels=0`。
+- `git diff --check`：通過。
+
+**邊界**：未使用 GitHub / `gh` / GitHub API；未讀 secret / token / `.env` / raw sessions / SQLite / auth；未重啟主機，未 restart Docker / Nginx / K3s / DB / firewall，未 workflow_dispatch，未恢復 generic runner。
+
+**下一步**：commit / push Gitea `main`，讀回新 CD；預期 tests job 顯示 `B5 effective test profile=controlled-runtime` 並跳過 B5，之後才進 build / deploy / post-deploy readback。
+
 ## 2026-07-02 — 10:52 110 startup SSH control path metadata 自動修復
 
 **照主線修正的問題**：
diff --git a/ops/runner/test_cd_controlled_runtime_profile.py b/ops/runner/test_cd_controlled_runtime_profile.py
index 136be8c3..7688eedc 100644
--- a/ops/runner/test_cd_controlled_runtime_profile.py
+++ b/ops/runner/test_cd_controlled_runtime_profile.py
@@ -829,11 +829,18 @@ def test_controlled_runtime_skips_b5_before_docker_socket_use() -> None:
     text = _workflow_text()
     b5_start = text.index("- name: Integration Tests (B5")
     docker_socket = text.index("-v /var/run/docker.sock:/var/run/docker.sock", b5_start)
+    persisted_profile_write = text.index('> .awoooi-cd-test-profile')
+    persisted_profile_read = text.index(
+        'tr -d \'\\r\\n\' < .awoooi-cd-test-profile',
+        b5_start,
+    )
     controlled_gate = text.index(
         'if [ "${AWOOOI_CD_TEST_PROFILE:-full}" = "controlled-runtime" ]; then',
         b5_start,
     )
     exit_zero = text.index("exit 0", controlled_gate)
+    assert persisted_profile_write < b5_start
+    assert b5_start < persisted_profile_read < controlled_gate
     assert controlled_gate < exit_zero < docker_socket