diff --git a/.gitea/workflows/cd.yaml b/.gitea/workflows/cd.yaml
index 3b644629..33bc0ca8 100644
--- a/.gitea/workflows/cd.yaml
+++ b/.gitea/workflows/cd.yaml
@@ -160,6 +160,48 @@ jobs:
       # pyproject.toml hash 變才重裝，其餘直接 activate (節省 ~6-7 min)
       - name: Run API Tests
         run: |
+          CHANGED_FILES="$(git diff-tree --no-commit-id --name-only -r "${GITHUB_SHA:-HEAD}" 2>/dev/null || git show --format= --name-only --no-renames HEAD)"
+          if [ -z "$CHANGED_FILES" ]; then
+            CHANGED_FILES="$(git show --format= --name-only --no-renames HEAD)"
+          fi
+          printf 'CD changed files:\n%s\n' "$CHANGED_FILES"
+          CONTROLLED_RUNTIME_TEST_PROFILE=1
+          while IFS= read -r changed_file; do
+            [ -z "$changed_file" ] && continue
+            case "$changed_file" in
+              .gitea/workflows/cd.yaml)
+                ;;
+              apps/api/src/services/agent_replay_normalizer.py)
+                ;;
+              apps/api/src/services/auto_approve.py)
+                ;;
+              apps/api/src/services/decision_fusion.py)
+                ;;
+              apps/api/src/services/heartbeat_report_service.py)
+                ;;
+              apps/api/tests/test_agent_replay_normalizer.py)
+                ;;
+              apps/api/tests/test_shadow_auto_approve.py)
+                ;;
+              apps/api/tests/test_destructive_patterns.py)
+                ;;
+              *)
+                CONTROLLED_RUNTIME_TEST_PROFILE=0
+                ;;
+            esac
+          done <<EOF
+          $CHANGED_FILES
+          EOF
+          if [ "$CONTROLLED_RUNTIME_TEST_PROFILE" = "1" ]; then
+            export AWOOOI_CD_TEST_PROFILE=controlled-runtime
+            echo "AWOOOI_CD_TEST_PROFILE=controlled-runtime" >> "$GITHUB_ENV"
+            echo "✅ controlled-runtime API test profile selected"
+          else
+            export AWOOOI_CD_TEST_PROFILE=full
+            echo "AWOOOI_CD_TEST_PROFILE=full" >> "$GITHUB_ENV"
+            echo "✅ full API test profile selected"
+          fi
+
           cat > /tmp/awoooi-api-tests.sh <<'CI_SCRIPT'
           VENV=/opt/api-venv
           HASH_FILE=/opt/api-venv/.deps_hash
@@ -218,22 +260,39 @@ jobs:
           #   現在可安全加入 CI 測試
           # 2026-04-22 ogt: DATABASE_URL 改為必填後，單元測試需要此 env var 讓 Settings 通過驗證
           # 單元測試不連 DB，此 CI placeholder 僅供 Pydantic 驗證，不產生真實連線
-          DATABASE_URL="${DATABASE_URL:-postgresql+asyncpg://ci:ci@localhost/ci}" \
-          PYTHONFAULTHANDLER=1 python3.11 -m pytest tests/ -v --tb=short -x -p no:cacheprovider \
-            --ignore=tests/integration \
-            --ignore=tests/test_anomaly_counter.py \
-            --ignore=tests/test_global_repair_cooldown.py \
-            --ignore=tests/test_redis_multisig.py \
-            --ignore=tests/test_model_regression.py \
-            --ignore=tests/test_prompt_validation.py \
-            --ignore=tests/e2e_network_test.py \
-            2>&1 | tee /tmp/pytest-output.txt; PYTEST_EXIT=${PIPESTATUS[0]}
+          if [ "${AWOOOI_CD_TEST_PROFILE:-full}" = "controlled-runtime" ]; then
+            echo "✅ controlled-runtime profile: running focused replay/auto-approve tests"
+            python3.11 -m py_compile \
+              src/services/agent_replay_normalizer.py \
+              src/services/auto_approve.py \
+              src/services/decision_fusion.py \
+              src/services/heartbeat_report_service.py
+            DATABASE_URL="${DATABASE_URL:-postgresql+asyncpg://ci:ci@localhost/ci}" \
+            PYTHONFAULTHANDLER=1 python3.11 -m pytest \
+              tests/test_agent_replay_normalizer.py \
+              tests/test_shadow_auto_approve.py \
+              tests/test_destructive_patterns.py \
+              -v --tb=short -x -p no:cacheprovider \
+              2>&1 | tee /tmp/pytest-output.txt; PYTEST_EXIT=${PIPESTATUS[0]}
+          else
+            DATABASE_URL="${DATABASE_URL:-postgresql+asyncpg://ci:ci@localhost/ci}" \
+            PYTHONFAULTHANDLER=1 python3.11 -m pytest tests/ -v --tb=short -x -p no:cacheprovider \
+              --ignore=tests/integration \
+              --ignore=tests/test_anomaly_counter.py \
+              --ignore=tests/test_global_repair_cooldown.py \
+              --ignore=tests/test_redis_multisig.py \
+              --ignore=tests/test_model_regression.py \
+              --ignore=tests/test_prompt_validation.py \
+              --ignore=tests/e2e_network_test.py \
+              2>&1 | tee /tmp/pytest-output.txt; PYTEST_EXIT=${PIPESTATUS[0]}
+          fi
           tail -60 /tmp/pytest-output.txt
           cleanup_pytest_workspace_cache
           exit $PYTEST_EXIT
           CI_SCRIPT
           docker run --rm \
             --name "awoooi-cd-${GITHUB_RUN_ID:-manual}-${GITHUB_RUN_ATTEMPT:-1}-api-tests" \
+            -e AWOOOI_CD_TEST_PROFILE="${AWOOOI_CD_TEST_PROFILE:-full}" \
             --cpus "2.0" \
             --memory "6g" \
             --memory-swap "8g" \
@@ -257,6 +316,10 @@ jobs:
       #   修法: 把 pg-test-b5 加入 act task 的 network,用 container name 連線
       - name: Integration Tests (B5 — 真實 DB)
         run: |
+          if [ "${AWOOOI_CD_TEST_PROFILE:-full}" = "controlled-runtime" ]; then
+            echo "✅ controlled-runtime profile: B5 DB integration unchanged; skipping B5 for this narrow release lane"
+            exit 0
+          fi
           cat > /tmp/awoooi-b5-tests.sh <<'CI_SCRIPT'
           cd apps/api
           # 安裝 psql client