docs(growth): record Yahoo production activation [skip ci]

docs/AI_INTELLIGENCE_MODULE_SOT.md

@@ -1,18 +1,21 @@
 # PChome 業績成長自動化作戰系統 — AI 競價情報模組 Single Source of Truth
 
 > **最後更新**: 2026-07-15 (台北時間)
-> **狀態**: 🟠 Partial。V10.800 已在 production 以 exact Gitea object `4670f80f98f705050784f26adf7797b54e4c409f` 運行。`pchome_comparison_coverage_v3` production readback 維持 `21/50 = 42%` 商品覆蓋與 `NT$180,667 / NT$354,062 = 51.0%` 業績覆蓋，母體 fingerprint `7b74504fcc1e1801c2ca2b42` 未漂移。Yahoo run `70857a03b2ae49bbbd6683d3781441f8` 安全 no-write；run `a950e4b209234088b88bc35b70b3bbda` 的 check-mode 找到 `3 exact + 1 unit-price` 並因 source promotion policy 混批而零寫入，正式外部平台 runtime 仍僅 `1/15`。V10.801 source candidate 已把 unit-price 自動分流到 candidate-only、exact 保留 controlled apply，完整 regression 為 `2,106 passed / 9 skipped / 0 failed`。SEC-P0-001 已完成 production closure，SEC-P0-002 維持 production hybrid canary-ready；full asset reconciliation、software supply chain、統一 controlled-apply envelope、restore drill、internal RAG canary 與 MCP/RAG runtime closure 尚未全部完成。任何局部 receipt 不得代表整體閉環完成。
-> **適用版本**: V10.800 production runtime + V10.801 source candidate；Gitea Action #1132 仍因 `ewoooc-host` runner 離線而未提供 CD 執行證據
+> **狀態**: 🟠 Partial。V10.801 已在 production 以 exact Gitea object `c091c466c203d7e26c8ed576f573e7e930df34d1` 運行。Yahoo run `7b3b140c076b43be8c79bd85448fbc49` 掃描 20 件、取得 17 筆來源候選，將 1 筆 source-disallowed unit-price 保留為 candidate-only，並讓 3 筆 total-price exact 通過 check-mode、bounded write 與 3/3 exact DB readback；來源已由 paused 原子切換為 `active + enabled + write_enabled`，rollback 不需要執行。固定母體 fingerprint `7b74504fcc1e1801c2ca2b42` 未漂移，`pchome_comparison_coverage_v3` 已由 `21/50 = 42%` 提升至 `24/50 = 48%`，業績覆蓋由 `NT$180,667 / NT$354,062 = 51.0%` 提升至 `NT$204,975 / NT$354,062 = 57.9%`，正式外部平台 runtime 由 `1/15` 提升至 `2/15`。完整 regression 為 `2,106 passed / 9 skipped / 0 failed`。SEC-P0-001 已完成 production closure，SEC-P0-002 維持 production hybrid canary-ready；full asset reconciliation、software supply chain、統一 controlled-apply envelope、restore drill、internal RAG canary 與 MCP/RAG runtime closure 尚未全部完成。任何局部 receipt 不得代表整體閉環完成。
+> **適用版本**: V10.801 production runtime；Gitea Action #1133 仍因 `ewoooc-host` runner 離線而未提供 CD 執行證據，正式 fallback deploy、runtime 與 visible receipts 已獨立保存
 
 ---
 
-## 零之負四、Yahoo Shopping 公開結構化同品 canary（V10.800 production / V10.801 source）
+## 零之負四、Yahoo Shopping 公開結構化同品 canary（V10.801 production）
 
 - Yahoo 搜尋只解析公開頁面的 `script#isoredux-data`，商品頁只解析 schema.org `Product` / `Offer` JSON-LD；PChome 目標商品則由公開 JSONP product API 回讀 `Name`、`Spec`、`Price` 與 `Qty`。所有 URL 都受 HTTPS host/path allowlist、回應大小、timeout、查詢數、detail 數與 request interval 約束，不讀登入 cookie/session，也不繞過平台阻擋。
 - 正式候選必須同時通過 search/detail product ID 一致、TWD 正價、PChome current price、雙方庫存（有證據時）、PChome Spec 出現在來源標題、非「任選/多款/可選」、非括號多規格組、deterministic exact same-item matcher 與獨立 DB post-verifier。只有 exact offer 能寫 `external_offers`；其餘候選只留 receipt，不因 KPI 壓力放寬 matcher。
 - Controlled apply 強制先做零寫入 check-mode，再以同一 `trace_id/run_id/work_item_id` bounded execute；至少兩筆 exact offer 全數獨立回讀成功後，才一次啟用 `active + enabled + write_enabled`。來源尚未啟用但 post-verifier 失敗時也會 quarantine 同 run row；activation 後失敗則同時還原 source state，不刪除歷史資料。compact atomic receipt 由 scheduler 每六小時更新，API/CLI 與 UI 分開顯示正式來源、候選證據與任何 runtime evidence。
 - 最新 workstation 公開 live no-write probe 對 OBgE、Amywo、Lancome、Sebamed 取得三筆 in-stock source-guard/total-price exact 候選，Lancome 因 Yahoo 明確 `ec_has_stock=0` 被阻擋。Critic 另以 Estee 色號、Armani 色號及 Gatsby 香型做反例；唯一曾漏過的括號多規格 listing 已加 guard，Gatsby 聚焦重跑的三筆候選全數阻擋。PChome sales-report fallback 不得冒充 current public price；公開 HTTP 採真正 bounded streaming。這些都是 source validation，不是 production DB、正式 coverage 或平台 activation 證據。
-- V10.800 已由 exact archive `d660339f30727f62bf2f39eae2665fe6b832f77e6743743bc8ea85b6206dbc05` 部署，16 個 runtime hash、內外 `/health`、三應用容器、scheduler 六小時註冊與 `momo-db` identity unchanged 均已驗證。Limit-8 run `70857a03b2ae49bbbd6683d3781441f8` 為 `no_write_verified`；limit-20 run `a950e4b209234088b88bc35b70b3bbda` 在 check-mode 找到 4 個獨立 verifier 候選，其中 3 個 exact、1 個 unit-price，因 Yahoo 只允許 total-price 正式 promotion 而整批 `check_mode_failed_no_write`。V10.801 將 source-disallowed compare type 自動降為 candidate-only，formal apply 只接 exact；完整 regression 為 `2,106 passed / 9 skipped / 0 failed`。Production KPI 仍為 `21/50`、`51.0%` 與 `1/15`，不得提前宣稱 activation。
+- V10.800 先由 exact archive `d660339f30727f62bf2f39eae2665fe6b832f77e6743743bc8ea85b6206dbc05` 部署；limit-8 run `70857a03b2ae49bbbd6683d3781441f8` 為 `no_write_verified`，limit-20 run `a950e4b209234088b88bc35b70b3bbda` 找到 `3 exact + 1 unit-price`，並因 Yahoo 只允許 total-price 正式 promotion 而整批 `check_mode_failed_no_write`。V10.801 將 source-disallowed compare type 自動降為 candidate-only，formal apply 只接 exact；完整 regression 為 `2,106 passed / 9 skipped / 0 failed`。
+- V10.801 以 exact object `c091c466c203d7e26c8ed576f573e7e930df34d1`、三檔 archive SHA-256 `1f21a9c823fd76dd32c622d227eca47022ec101d0863b516e34cc1bbbe29f2c8` 套用。第一次 health 字串 matcher false-negative 觸發 host rollback；因 `config.py` 是單檔 bind mount，立即偵測 host/container inode 不一致，且在任何 canary 前以 `rsync --inplace` 重新套用，再以 host hash、container hash 與 structured JSON `/health` 三層驗證 V10.801。最終 terminal 為 `applied_verified_host_container_health`，三應用容器健康，`momo-db` identity 維持 `cd092451cb5fd555d0ffff70642e109f3b742882c418beeab631793d1e9dc55d`。
+- Production run `7b3b140c076b43be8c79bd85448fbc49` terminal 為 `verified_with_coverage_gain`：20 target、17 source candidate、3 exact、1 promotion-policy deferred、3 formal writes、3/3 exact readbacks；Yahoo registry readback 為 active/enabled/write-enabled，3 筆 offer 全為 fresh verified，artifact receipt SHA-256 為 `f9b8b71c96ba758fa59b7802234391db83d4994b7db8499d5acf3dd36510d545`。固定 cohort 由 `21 ready + 1 candidate + 28 unmatched` 變為 `24 + 1 + 25`，商品覆蓋 `42% -> 48%`、營收覆蓋 `51.0% -> 57.9%`、正式平台 `1/15 -> 2/15`。
+- Deployment、canary、DB readback、growth readback 與 desktop/mobile visible receipts 位於 `/home/ollama/momo-deploy-backups/ewoooc-20260715T051727Z-c091c46/`。1280x720 與 390x844 使用 production code/data 的隔離式唯讀渲染 smoke，分別顯示 `24/50`、`48%`、`2/15`；兩者均無水平溢位，臨時 process/tunnel 已關閉，正式登入政策未放寬。
 
 ---
 
@@ -31,10 +34,10 @@
 - V10.797 曾把 `42張入*4包`、`15張入*3包` 外層多包裝誤判為單包 exact total price；錯誤結果未被採信，兩筆 row 已在同一交易改為 `needs_review`，durable quarantine receipts 為 `sameitem-quarantine-9572ee88063541d3ba2c` 與 `sameitem-quarantine-4c355c9455cb49f6bded`，沒有刪除資料。V10.798 將巢狀件數正規化為 `42 x 4 = 168張`、`15 x 3 = 45張`，外層包裝只能走 unit-comparable；後續 bounded run 找到真正單包 exact MOMO 商品並通過獨立 verifier。
 - V10.799 部署後的獨立初始 readback 為 `16/50 = 32%` 商品覆蓋與 `NT$105,015 / NT$354,062 = 29.7%` 業績覆蓋。Run `58bb702057284cd382c82314b418d713` 自動掃描 8 件、取得 17 筆候選、獨立驗證並回讀 3 筆，提升至 `19/50 = 38%` 與 `46.2%`；run `cb40a5dcdaa045c69bf9611ebb13bba2` 再回讀 2 筆，提升至 `21/50 = 42%` 與 `51.0%`。兩輪皆為 `verified_with_coverage_gain`，durable per-target receipts 均 `persisted_and_verified`。
 - 第三輪 run `14d4aac64d434e34bfbd0f0edb7ef1eb` 找到 9 筆候選但 0 筆通過正式同款門檻；terminal 為 `degraded_no_safe_candidate`、post-verifier 為 `no_write_verified`，8/8 target receipts 已持久化。此輪證明自動化會在證據不足時停止正式價格寫入，不為提高 KPI 放寬 matcher。最終 partition 為 `21` 件正式可比價、`1` 件候選驗證、`28` 件未對應，固定 fingerprint 為 `7b74504fcc1e1801c2ca2b42`。
-- 儀表板第一層 KPI 使用同一 TOP50 的近 7 天業績加權覆蓋；商品筆數覆蓋保留為次要透明度。Production template 顯示「業績比價覆蓋」，目前應呈現 `51.0%`、`NT$180,667 / NT$354,062` 與 `21/50 商品`，不得退回無分母的「比價可用率」。Dashboard memory cache 為 120 秒，bounded write 後需失效或 reload，避免使用者看到回填前舊值。
+- 儀表板第一層 KPI 使用同一 TOP50 的近 7 天業績加權覆蓋；商品筆數覆蓋保留為次要透明度。Production V10.801 readback 應呈現 `57.9%`、`NT$204,975 / NT$354,062` 與 `24/50 商品`，不得退回無分母的「比價可用率」。Dashboard memory cache 為 120 秒，bounded write 後需失效或 reload，避免使用者看到回填前舊值。
 - `pchome_same_item_reconciliation_v1` 以同一 `trace_id/run_id/work_item_id` 串接來源、正規化、SOT diff、AI candidate、風險政策、check-mode、bounded execution、exact DB post-verifier 與 durable per-target receipt。只有獨立同商品與規格驗證通過者可寫 `external_offers`；候選、阻擋頁與無安全候選 run 一律 no-write。
 - 最新業績日為 `2026-07-13`。V10.795 使用 `pchome_sales_freshness_sla_v1`：台北時間每日 `20:00` 前，上一日報表仍在等待到檔視窗，`2026-07-15 01:44` 的 raw calendar lag 為 2 天、SLA lag 為 0、狀態為 `grace` 且 `decision_ready=true`；20:00 後若仍未收到 `2026-07-14` 才會依政策阻斷決策。scheduler receipt `0f24219e0bbb4740b7ad6645e7952296` 與 explicit canary receipt `6e2df008f65544fe8e557c11ff0dbb93` 均為 `completed_no_write`，durable decision 為 `no_candidate_fresh_no_write`，證明無新檔時安全不寫且不再於午夜誤停業務。live 與 persisted source readiness 均為 `1/4`；Google Drive 可用，HTTPS、IMAP、local 仍未形成冗餘，因此 Lane A 只關閉 freshness runtime，source continuity 仍是 partial。
-- Dashboard 的 mapping backlog 與 AI automation evidence 已改為結構化 grid 與 progressive disclosure；V10.799 首屏資料契約為 `業績日 2026-07-13 · 到檔 SLA 內`、`51.0%` 業績覆蓋與 `21/50` 商品。既有 V10.795 desktop/mobile layout smoke 仍通過；本輪正式站瀏覽器缺少登入 session，因此不新增未驗證的 production screenshot claim，完整全站 UI/UX 仍依 `UX-P1-001` 推進。
+- Dashboard 的 mapping backlog 與 AI automation evidence 已改為結構化 grid 與 progressive disclosure；V10.801 首屏資料契約為 `業績日 2026-07-13 · 到檔 SLA 內`、`24/50 = 48%` 商品覆蓋、`57.9%` 業績覆蓋與 `2/15` 正式平台。正式網路入口仍要求登入；本輪以 production code/data 的隔離式唯讀渲染完成 1280x720 與 390x844 smoke，兩者均無水平溢位，臨時 process/tunnel 已關閉。完整全站 UI/UX 仍依 `UX-P1-001` 推進。
 
 ## 零之負一、資訊安全與治理自動化基準（2026-07-10）
 

docs/guides/ai_automation_mainline_work_items.md

@@ -1,6 +1,6 @@
 # AI Automation Mainline Work Items
 
-> Updated: 2026-07-15 13:12 Asia/Taipei
+> Updated: 2026-07-15 13:40 Asia/Taipei
 > Governance: `global_product_governance_v2` + ADR-038
 > Current P0: `GROWTH-P0-001 comparison coverage truth + autonomous refresh`
 
@@ -17,7 +17,7 @@
 | Order | ID | Status | Work item | Exit evidence / next machine action |
 |---:|---|---|---|---|
 | 1 | `SEC-P0-001` | Completed | Deny-by-default route access control | `governance/evidence/SEC-P0-001-20260711T122758Z.json` plus the current runtime receipt prove anonymous matrix 8/8 denied, public `/metrics` 404, exact internal target up, EwoooC product markers present, Prometheus identity preserved and `momo-db` unchanged. |
-| 2 | `GROWTH-P0-001` | In progress (`runtime_partial`) | Comparison coverage truth + autonomous refresh | V10.800 is live at Gitea object `4670f80f98f705050784f26adf7797b54e4c409f`. Production run `70857a03b2ae49bbbd6683d3781441f8` scanned the first 8 unresolved items and closed `no_write_verified`; run `a950e4b209234088b88bc35b70b3bbda` scanned 20, found `3 exact + 1 unit-price` independently verified candidates, but check-mode correctly blocked the mixed promotion batch with zero formal writes. Production truth therefore remains `21 ready + 1 candidate validation + 28 unmatched`, `42%` count, `51.0%` revenue and `1/15` formal platforms. V10.801 source candidate routes source-disallowed unit-price matches to candidate-only receipts while exact matches continue to controlled apply; full regression is `2,106 passed / 9 skipped / 0 failed`. Next: deploy V10.801 and rerun the same bounded limit-20 canary before updating any KPI. |
+| 2 | `GROWTH-P0-001` | In progress (`runtime_partial`) | Comparison coverage truth + autonomous refresh | V10.801 is live at exact Gitea object `c091c466c203d7e26c8ed576f573e7e930df34d1`. Production run `7b3b140c076b43be8c79bd85448fbc49` scanned 20, retained one source-disallowed unit-price as candidate-only, wrote three total-price exact offers after check-mode and read all 3/3 back by exact identity. Yahoo is now `active + enabled + write_enabled`; fixed cohort `7b74504fcc1e1801c2ca2b42` remains unchanged while production moves to `24 ready + 1 candidate validation + 25 unmatched`, `48%` count, `57.9%` revenue and `2/15` formal platforms. Next: continue the next revenue-weighted batch without relaxing identity/variant/unit gates, and add the next approved structured marketplace adapter. |
 | 3 | `SEC-P0-002` | In progress (`canary_ready`) | Database identity + least-privilege RBAC | V10.789 is live and `governance/auth_identity_runtime_receipt.json` verifies required tables, two active admins, durable lockout, session revocation, trusted proxy policy and no-secret mutation audit readiness. Runtime is intentionally hybrid because zero database-admin success receipts have been captured; `auto` retires shared authority after two durable successes without a manual review gate. Next: capture database-admin login receipts and verify automatic database-only cutover. |
 | 4 | `SEC-P0-003` | In progress | Webhook trust and replay protection | Telegram secret-token verification code exists; production secret activation remains unproven. Exit: secret provisioned outside source, required mode enabled, invalid-secret 401 and authorized callback canary pass. |
 | 5 | `SUPPLY-P0-001` | In progress | Gitea-only secure software supply chain | Gitea-native checkout, secret-safe `.dockerignore`, commit-bound source receipt and governance gate are active. Exit: exact dependency lock, internal SAST/SCA/secret scan, SBOM, image digest/provenance, vulnerability SLA and production digest readback. |
@@ -26,7 +26,7 @@
 | 8 | `RAG-P0-001` | Not started | Internal RAG candidate canary | V10.770 stops at candidate preview. Exit: bounded pgvector candidate canary, signature/readback/feedback receipt, no price write and no premature `ai_insights` promotion. Next: `run_internal_rag_candidate_canary`. |
 | 9 | `MCP-P0-001` | In progress (`federation_source_ready`) | MCP/RAG production runtime closure | V10.796 source adds a strict public aggregate receipt for canonical `ewoooc` and `momo-pro-system` identities without opening authenticated internal APIs or exposing endpoint/tool payload data. Exit still requires V10.796 production `/health`, two fresh AWOOOI durable receipts with fingerprint recompute, live MCP servers/router/RAG, approved caller/tool boundary and production query canary. Current source readiness must not be reported as runtime closure. |
 | 10 | `SEC-P0-004` | Not started | Security operations lifecycle and metrics | Add durable security incident state and publish MTTA, MTTR, recurrence, false positive, human intervention, verifier pass, rollback and freshness. Exit: detect-to-learn production receipt. |
-| 11 | `REL-P0-001` | In progress | Formal deploy and visible proof discipline | Gitea main is `4670f80f98f705050784f26adf7797b54e4c409f`; Action #1132 is waiting because no matching `ewoooc-host` runner is online and therefore provides no CD execution evidence. A bounded exact-Git-object fallback deployed V10.800 from archive SHA-256 `d660339f30727f62bf2f39eae2665fe6b832f77e6743743bc8ea85b6206dbc05`; check/apply/hash/preflight/canary receipts are under `/home/ollama/momo-deploy-backups/ewoooc-20260715T045049Z-4670f80/`. Production internal/external `/health` is healthy at V10.800, all 16 runtime hashes match the exact object, three application containers are healthy, and `momo-db` remained unchanged at `cd092451cb5fd555d0ffff70642e109f3b742882c418beeab631793d1e9dc55d`. Next: deploy the tested V10.801 promotion-policy fix through the same bounded path, then complete authenticated desktop/mobile visible smoke; runner recovery remains a release-governance gap. |
+| 11 | `REL-P0-001` | In progress (`runtime_verified_cd_degraded`) | Formal deploy and visible proof discipline | Gitea main is `c091c466c203d7e26c8ed576f573e7e930df34d1`; Action #1133 is waiting because no matching `ewoooc-host` runner is online and therefore provides no CD execution evidence. A bounded exact-object fallback deployed V10.801 from archive SHA-256 `1f21a9c823fd76dd32c622d227eca47022ec101d0863b516e34cc1bbbe29f2c8`; host/container hashes, structured health, canary, DB/growth readback and visible receipts are under `/home/ollama/momo-deploy-backups/ewoooc-20260715T051727Z-c091c46/`. Internal/external `/health` is healthy at V10.801, three application containers are healthy, and `momo-db` remains unchanged at `cd092451cb5fd555d0ffff70642e109f3b742882c418beeab631793d1e9dc55d`. Desktop 1280x720 and mobile 390x844 production-code/data render smoke both show `24/50` without horizontal overflow; formal network login remains enforced. Runner recovery remains a release-governance gap and is not replaced by fallback evidence. |
 
 ### GROWTH-P0-001 Fixed Execution Lanes
 
@@ -35,8 +35,8 @@ These lanes are one ordered current P0, not optional side work. They must advanc
 | Lane | Status | Production baseline | Next machine action |
 |---|---|---|---|
 | A. Sales freshness | In progress (`sla_runtime_closed_source_redundancy_partial`) | Latest sales date `2026-07-13`; before the `2026-07-15 20:00` cutoff, raw lag is `2` but SLA lag is `0`, state is `grace` and decisions remain released. Scheduler receipt `0f24219e0bbb4740b7ad6645e7952296` and explicit canary receipt `6e2df008f65544fe8e557c11ff0dbb93` both persisted `completed_no_write`; durable decision is `no_candidate_fresh_no_write`. Live and persisted readiness now agree at Google Drive `1/4`; HTTPS, IMAP and local remain disabled. | Continue automatic report-arrival reconciliation. At/after 20:00 require `2026-07-14` or automatically block decision use, emit the bounded upstream action and verify the next arrival receipt; keep source redundancy partial until another approved source is live. |
-| B. Verified same-item evidence | In progress | TOP50 fixed cohort: `21` verified, `1` candidate/source validation, `28` unmatched. Count coverage is `42%`; revenue-weighted coverage is `NT$180,667 / NT$354,062 = 51.0%`. V10.797 outer-pack false exact candidates were quarantined without deletion; V10.798 normalizes nested quantity, and V10.799 prevents mapping status from changing cohort membership. Runs `58bb702057284cd382c82314b418d713` and `cb40a5dcdaa045c69bf9611ebb13bba2` wrote/read back five verified offers; run `14d4aac64d434e34bfbd0f0edb7ef1eb` closed no-write after zero safe candidates. | Wait for fresh source evidence before retrying the same unresolved subset, broaden approved structured platform adapters, preserve deterministic identity/unit/variant gates, and publish both count and revenue coverage deltas with the same scope fingerprint per run. |
-| C. Platform runtime coverage | In progress (`runtime_canary_no_write`) | V10.800 is live, scheduler registration is verified and two production runs persisted durable receipts. Limit 8 closed no-write; limit 20 found `3 exact + 1 unit-price`, and check-mode stopped the mixed batch before DB write. Formal runtime remains `1/15`; PixelRAG remains evidence-only. | Deploy V10.801 source-profile promotion partition, rerun limit 20, write/read back exact only, retain unit-price as candidate-only, then require at least two exact readbacks before atomically enabling `active + enabled + write_enabled`. |
+| B. Verified same-item evidence | In progress | TOP50 fixed cohort: `24` verified, `1` candidate/source validation, `25` unmatched. Count coverage is `48%`; revenue-weighted coverage is `NT$204,975 / NT$354,062 = 57.9%`. V10.797 outer-pack false exact candidates were quarantined without deletion; V10.798 normalizes nested quantity, V10.799 fixes cohort membership, and V10.801 run `7b3b140c076b43be8c79bd85448fbc49` added three independently verified Yahoo offers without changing fingerprint `7b74504fcc1e1801c2ca2b42`. | Continue the next revenue-weighted unresolved batch only when source evidence is fresh, preserve deterministic identity/unit/variant gates, and publish count/revenue deltas against the same fingerprint per run. |
+| C. Platform runtime coverage | In progress (`runtime_canary_activated`) | V10.801 is live; Yahoo run `7b3b140c076b43be8c79bd85448fbc49` separated one unit-price candidate, wrote/read back three exact offers and atomically enabled the source after exceeding the two-offer threshold. Formal runtime is now `2/15`; PixelRAG remains evidence-only. | Repeat bounded refresh on schedule, monitor expiry/recurrence/rollback signals, then implement the next approved structured source contract for Shopee, Coupang, ETMall, Friday or Rakuten without treating blocked pages as product data. |
 
 ## P1
 
@@ -47,10 +47,10 @@ These lanes are one ordered current P0, not optional side work. They must advanc
 | 14 | `APPSEC-P1-001` | In progress | CSP and DOM/XSS hardening | Security headers are present and CSP is report-only. Collect violations, remove high-risk `innerHTML`/inline sinks, then enforce CSP by canary. |
 | 15 | `APPSEC-P1-002` | Not started | Unsafe shared-cache serialization removal | Replace writable pickle caches in dashboard/daily-sales/EDM/sales with constrained JSON or signed schema. |
 | 16 | `ARCH-P1-001` | In progress | Split oversized policy/executor/verifier modules | Current top debts include 44k-line PChome mapping and 14k-line smoke service. Split by bounded family and independent tests. |
-| 17 | `UX-P1-001` | In progress | Professional full-site UI/UX | V10.800 production template leads with `業績比價覆蓋`, backed by 51.0% revenue coverage and 21/50 product transparency instead of the old unqualified 10% card. External platform evidence now separates formal and candidate counts with compact chips and hidden detail text. Existing V10.795 desktop/mobile overflow smoke remains valid for layout; this release still needs a fresh authenticated production screenshot before visible closure is claimed. Continue the same first-viewport, progressive-disclosure, accessibility and state coverage across every remaining primary page. |
+| 17 | `UX-P1-001` | In progress | Professional full-site UI/UX | V10.801 first viewport now shows `24/50 = 48%`, `活躍商品 32/1,853`, and formal platform `2/15` instead of the old unqualified 10% card. A production-code/data isolated read-only render smoke passed at 1280x720 and 390x844 with no horizontal overflow; the temporary process/tunnel was closed and production network login stayed enforced. Continue the same first-viewport, progressive-disclosure, accessibility and loading/error/degraded-state coverage across every remaining primary page. |
 | 18 | `PIXELRAG-P1-001` | Not started | Ollama-first multimodal embedding benchmark | Verify approved visual embedding on GCP-A -> GCP-B -> 111 and design pgvector-compatible visual metadata; FAISS remains disallowed without ADR. |
-| 19 | `MARKET-P1-001` | In progress | Marketplace source contracts | Yahoo Shopping V10.800 is live with public-boundary allowlists, bounded streaming/rate, provenance, current product-detail readback, stock/spec/variant guards and controlled canary. Production activation remains pending because mixed exact/unit promotion was safely blocked; V10.801 adds source-specific promotion partition. Shopee, Coupang, ETMall, Friday and Rakuten still require equivalent structured contracts, and blocked pages remain non-product data. |
-| 20 | `QA-P1-001` | In progress | Deterministic test and CI governance | V10.801 workstation source baseline is `2,106 passed / 9 skipped / 0 failed`; focused promotion-policy/Yahoo/source-readiness/same-item scope is `63 passed`. V10.800 production exact-object hashes, health, scheduler registration, two no-write receipts and fixed cohort fingerprint are verified. Action #1132 remains waiting without runner execution, so CI parity is not claimed. Next: deploy V10.801 and require exact DB readback plus source activation receipt. |
+| 19 | `MARKET-P1-001` | In progress | Marketplace source contracts | Yahoo Shopping V10.801 is active in production with public-boundary allowlists, bounded streaming/rate, provenance, current product-detail readback, stock/spec/variant guards, source-specific promotion partition and exact canary activation. Three fresh verified offers drive formal decisions; the deferred unit-price candidate does not. Shopee, Coupang, ETMall, Friday and Rakuten still require equivalent structured contracts, and blocked pages remain non-product data. |
+| 20 | `QA-P1-001` | In progress | Deterministic test and CI governance | V10.801 workstation source baseline is `2,106 passed / 9 skipped / 0 failed`; focused promotion-policy/Yahoo/source-readiness/same-item scope is `63 passed`. Production host/container hashes, internal/external health, scheduler registration, 3/3 exact DB readback, source activation, fixed cohort and desktop/mobile visible smoke are verified. Action #1133 remains waiting without runner execution, so CI/CD parity is not claimed; exact fallback receipts remain separate evidence. |
 
 ## P2