diff --git a/.gitea/workflows/cd.yaml b/.gitea/workflows/cd.yaml
index 698fe387..8ed9413c 100644
--- a/.gitea/workflows/cd.yaml
+++ b/.gitea/workflows/cd.yaml
@@ -2449,12 +2449,15 @@ jobs:
           export PLAYWRIGHT_BROWSERS_PATH=/opt/playwright-browsers
           PLAYWRIGHT_VER=$(node -e "console.log(require('./package.json').devDependencies['@playwright/test'] || '')" 2>/dev/null || echo "unknown")
           PLAYWRIGHT_HASH_FILE=/opt/playwright-browsers/.version_hash
-          if [ "$(cat $PLAYWRIGHT_HASH_FILE 2>/dev/null)" != "$PLAYWRIGHT_VER" ]; then
-            echo "📦 Playwright 版本變更 ($PLAYWRIGHT_VER)，重裝 Chromium..."
+          BROWSER_PATH=$(node -e "const { chromium } = require('@playwright/test'); console.log(chromium.executablePath())")
+          if [ "$(cat $PLAYWRIGHT_HASH_FILE 2>/dev/null)" != "$PLAYWRIGHT_VER" ] || [ ! -x "$BROWSER_PATH" ]; then
+            echo "📦 Playwright browser cache missing/stale ($PLAYWRIGHT_VER): $BROWSER_PATH"
             pnpm exec playwright install chromium --with-deps 2>&1 | tail -20
+            BROWSER_PATH=$(node -e "const { chromium } = require('@playwright/test'); console.log(chromium.executablePath())")
+            test -x "$BROWSER_PATH" || { echo "❌ Playwright browser executable missing after install: $BROWSER_PATH"; exit 1; }
             echo "$PLAYWRIGHT_VER" > $PLAYWRIGHT_HASH_FILE
           else
-            echo "⚡ 使用快取 Playwright Chromium ($PLAYWRIGHT_VER)"
+            echo "⚡ 使用快取 Playwright Chromium ($PLAYWRIGHT_VER): $BROWSER_PATH"
           fi
           # Browser cache 命中時也要確認 OS shared libs 存在；否則 smoke 會只測到
           # chromium launch failure（例如 libnspr4.so missing）。
diff --git a/docs/LOGBOOK.md b/docs/LOGBOOK.md
index 0edba75d..e9c5d954 100644
--- a/docs/LOGBOOK.md
+++ b/docs/LOGBOOK.md
@@ -1,3 +1,15 @@
+## 2026-07-01 — 17:36 Gitea CD Playwright browser cache executable guard
+
+**照主線修正的問題**：
+- CD `#4273` 已確認 isolated smoke workspace 生效，log 讀回 `/source:ro`、`/tmp/awoooi-smoke-workspace`、`/github-output`，且不再有 `/workspace/node_modules` 的 `EACCES`；但 browser smoke 仍回 `SMOKE_RESULT=⚠️`。
+- 新失敗點是 Playwright browser cache volume 留有 `.version_hash`，workflow 因 hash 命中跳過 Chromium 安裝，但實際 `chromium_headless_shell-1208/chrome-headless-shell` 不存在，`global.setup.ts` 在 `chromium.launch()` 失敗。
+- `.gitea/workflows/cd.yaml` 的 Playwright cache guard 改為讀 `chromium.executablePath()`，同時檢查版本 hash 與 executable `test -x`；只要 hash 不符或 executable 不存在，就重跑 `pnpm exec playwright install chromium --with-deps`，安裝後再次 `test -x` 驗證。
+- `ops/runner/test_cd_controlled_runtime_profile.py` 新增 guard，鎖住 browser cache 必須用 executable readback，不得再只信 `.version_hash`。
+
+**邊界**：未讀 secret / token / `.env` / raw sessions / SQLite / auth；未使用 GitHub / `gh` / GitHub API；未重啟主機 / Docker / Nginx / K3s / DB / firewall；未 force push。
+
+**下一步**：跑本地 workflow guard 後推 Gitea main，等待下一個 CD 重新產生 post-deploy smoke `pass` 證據；若 smoke 還是黃，繼續只收斂最新失敗段落。
+
 ## 2026-07-01 — 17:29 Gitea CD post-deploy smoke workspace 權限修正
 
 **照主線修正的問題**：
diff --git a/ops/runner/test_cd_controlled_runtime_profile.py b/ops/runner/test_cd_controlled_runtime_profile.py
index 0fb619f4..ec036c0d 100644
--- a/ops/runner/test_cd_controlled_runtime_profile.py
+++ b/ops/runner/test_cd_controlled_runtime_profile.py
@@ -136,6 +136,10 @@ def test_post_deploy_smoke_uses_workspace_playwright_dependency() -> None:
     assert "pnpm exec playwright install chromium --with-deps" in block
     assert "pnpm exec playwright install-deps chromium" in block
     assert "pnpm exec playwright test tests/e2e/smoke.spec.ts --reporter=line" in block
+    assert "chromium.executablePath()" in block
+    assert '[ ! -x "$BROWSER_PATH" ]' in block
+    assert 'test -x "$BROWSER_PATH"' in block
+    assert "Playwright browser cache missing/stale" in block
     assert "SMOKE_WORKDIR=/tmp/awoooi-smoke-workspace" in block
     assert "-v \"$PWD:/source:ro\"" in block
     assert "-v \"$SMOKE_OUTPUT:/github-output\"" in block