feat(smoke): monitor pchome signing execution preflight

docs/guides/pchome_ai_automation_priority_backlog.md

@@ -9,7 +9,7 @@
 以下是使用者在主線推進期間插入、且必須保留在完整工作項目裡的要求。後續不得再把這些需求漏掉或變成口頭提醒。
 
 1. 正式環境才是最新版本真相；不得用本機檔案、舊筆記、舊分支蓋過 production truth。
-2. 版本不得搞錯；目前正式環境 `/health` 版本維持 `V10.733`，除非有明確版本 bump、部署與 readback。
+2. 版本不得搞錯；目前正式環境 `/health` 版本維持 `V10.734`，除非有明確版本 bump、部署與 readback。
 3. GitHub 全面 freeze；不得使用 GitHub、`gh`、GitHub API、GitHub Actions、PR、issue、mirror 或 read-only GitHub 流程。
 4. 實作結果必須推到 Gitea `dev` 與 `main`；若改到 runtime 行為，還必須部署到正式環境並回讀。
 5. 主方向是 AI 自動化，不是人工審核；人工欄位只能當 evidence / ledger / UI truth，不得阻擋低爆炸半徑、可驗證、可回滾的 controlled apply。
@@ -41,7 +41,7 @@
 
 已完成:
 
-- 正式環境版本真相 guard：`/health` 是最高真相，目前維持 `V10.733`。
+- 正式環境版本真相 guard：`/health` 是最高真相，目前維持 `V10.734`。
 - Gitea `dev` / `main` source truth 對齊。
 - Retry exception controlled apply executor 已落地，目標表為 `pchome_product_matches`。
 - 正式 DB 已 controlled apply 4 個 selectors:
@@ -141,10 +141,17 @@
   - `/api/ai-automation/scheduled-health-summary` 已輸出 `pchome_auto_policy_signing_issuer_closeout` family
   - `/metrics` 已輸出 `momo_ai_automation_scheduled_health_family_status{family="pchome_auto_policy_signing_issuer_closeout",...}`
   - 不讀 secret、不執行 SQL、不寫 DB、不簽發 apply authorization，下一個機器動作是 signing execution preflight lane
+- PChome auto-policy signing execution preflight runtime monitoring 已完成:
+  - `/api/ai-automation/smoke` 已加入 `PChome auto-policy signing execution preflight`
+  - 以本機 contract fixture + machine evidence adapter 自動推進 operator-held secret boundary preflight path
+  - 明確標記 `signing_execution_preflight_check_count=12`、`signing_issuer_closeout_check_count=12`、`operator_held_secret_boundary_count=1`、`signing_execution_input_requirement_count=10`、`signing_execution_abort_condition_count=8`、`rollback_boundary_count=4`、`writes_database_count=0`、`signs_database_apply_authorization_count=0`、`reads_secret_count=0`、`primary_human_gate_count=0`
+  - `/api/ai-automation/scheduled-health-summary` 已輸出 `pchome_auto_policy_signing_execution_preflight` family
+  - `/metrics` 已輸出 `momo_ai_automation_scheduled_health_family_status{family="pchome_auto_policy_signing_execution_preflight",...}`
+  - 不讀 secret、不執行 SQL、不寫 DB、不簽發 apply authorization，下一個機器動作是 signing execution closeout lane
 
 進行中 / 下一步，必須照順序:
 
-1. 將 auto-policy signing issuer closeout 往 signing execution preflight lane 推進。
+1. 將 auto-policy signing execution preflight 往 signing execution closeout lane 推進。
 
 完成標準:
 
@@ -311,7 +318,7 @@
 
 進行中 / 下一步，必須照順序:
 
-1. 將 auto-policy signing issuer closeout 推進到 signing execution preflight lane。
+1. 將 auto-policy signing execution preflight 推進到 signing execution closeout lane。
 2. 對其他 safe mapping backlog lanes 套用 receipt / replay / drift verifier 模式。
 3. 為每一類 controlled apply 自動產生 rollback evidence package。
 4. 把 AI automation metrics 持續整合進既有 observability surfaces。
@@ -390,7 +397,8 @@
 | P3.9 | PChome auto-policy signing decision preflight monitoring | 已完成 | AI smoke + scheduled family + metrics family prove signing decision preflight ready, signing inputs bound, no DB write, no signing, no apply authorization | P3.10 signing decision closeout monitoring |
 | P3.10 | PChome auto-policy signing decision closeout monitoring | 已完成 | AI smoke + scheduled family + metrics family prove signing decision closeout ready, unsigned package bound, no DB write, no signing, no apply authorization | P3.11 signing issuer guard monitoring |
 | P3.11 | PChome auto-policy signing issuer guard monitoring | 已完成 | AI smoke + scheduled family + metrics family prove signing issuer guard ready, future signable boundary bound, no DB write, no signing, no apply authorization | P3.12 signing issuer closeout monitoring |
-| P3.12 | PChome auto-policy signing issuer closeout monitoring | 已完成 | AI smoke + scheduled family + metrics family prove final signable request package ready, no DB write, no signing, no apply authorization | P3.13 signing execution preflight lane |
+| P3.12 | PChome auto-policy signing issuer closeout monitoring | 已完成 | AI smoke + scheduled family + metrics family prove final signable request package ready, no DB write, no signing, no apply authorization | P3.13 signing execution preflight monitoring |
+| P3.13 | PChome auto-policy signing execution preflight monitoring | 已完成 | AI smoke + scheduled family + metrics family prove operator-held secret boundary, 10 nonsecret inputs, 8 abort conditions, 4 rollback boundaries, no secret read, no DB write, no signing | P3.14 signing execution closeout lane |
 | P4.1 | Source / deployment / runtime truth package | 已完成 | `scripts/ops/report_source_deploy_runtime_truth.py` + focused tests | 每次 Gitea push / production deploy 後執行 P4 report |
 | P2.2 | Benchmark guardrails applied to core AI surfaces | 已完成 | `/ai_intelligence` + `/observability/overview` golden-signal strips + focused tests | 後續 safe automation lanes 套同樣 first-viewport summary |