diff --git a/docs/MDTODO/observability-trace-reliability.md b/docs/MDTODO/observability-trace-reliability.md
index a668596d..5f868a1e 100644
--- a/docs/MDTODO/observability-trace-reliability.md
+++ b/docs/MDTODO/observability-trace-reliability.md
@@ -34,3 +34,7 @@
 ### R3.2 [in_progress]
 
 基于真实自动事件 `hwlab-web-probe-sentinel-nc01-bbjv2` 修复 BuildKit daemon 已启动但 readiness 重试提前耗尽的竞争，并让 PaC `history/debug-step/status` 从失败 TaskRun 日志默认有界投影 traceId、首断点、阶段、error type/code/exit 与精确下钻；不得以人工 PipelineRun、锁/租约或吞掉失败缓解，使用下一次普通 PR merge 自动事件证明业务成功且 Tempo 可按同一 traceId 查询，完成任务后将详细报告写入[任务报告](./details/observability-trace-reliability/R3.2_Task_Report.md)。
+
+### R3.3 [in_progress]
+
+基于真实自动事件 `hwlab-web-probe-sentinel-nc01-czhg5` 修复 `moby/buildkit:rootless` 启动合同：显式通过 RootlessKit 启动 buildkitd，保留 socket + worker readiness、有界 TERM/KILL/wait 与 typed 失败投影；禁止退回短连接重试、人工 PipelineRun 或第二 authority，使用下一次普通 PR merge 自动事件证明 image build、GitOps/Argo/runtime 成功且 Tempo 可按同一 traceId 查询，完成任务后将详细报告写入[任务报告](./details/observability-trace-reliability/R3.3_Task_Report.md)。
diff --git a/scripts/src/hwlab-node-web-sentinel-cicd-jobs.ts b/scripts/src/hwlab-node-web-sentinel-cicd-jobs.ts
index cb442069..04718d8c 100644
--- a/scripts/src/hwlab-node-web-sentinel-cicd-jobs.ts
+++ b/scripts/src/hwlab-node-web-sentinel-cicd-jobs.ts
@@ -761,7 +761,7 @@ export function sentinelPublishImageBuildShell(state: SentinelCicdState, jobName
     "buildkit_log=/workspace/buildkitd.log",
     "mkdir -p \"$(dirname \"$buildkit_socket\")\"",
     "rm -f \"$buildkit_socket\"",
-    "buildkitd --addr \"$buildkit_address\" ${BUILDKITD_FLAGS:-} > \"$buildkit_log\" 2>&1 &",
+    "rootlesskit buildkitd --addr \"$buildkit_address\" ${BUILDKITD_FLAGS:-} > \"$buildkit_log\" 2>&1 &",
     "buildkitd_pid=$!",
     "buildkit_ready=false",
     "buildkit_probe_attempt=0",
diff --git a/scripts/src/platform-infra-pac-failure-evidence.test.ts b/scripts/src/platform-infra-pac-failure-evidence.test.ts
index 5c2a0c01..5b9c182b 100644
--- a/scripts/src/platform-infra-pac-failure-evidence.test.ts
+++ b/scripts/src/platform-infra-pac-failure-evidence.test.ts
@@ -1,7 +1,10 @@
 import { describe, expect, test } from "bun:test";
+import { spawnSync } from "node:child_process";
 import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { createRequire } from "node:module";
+import { sentinelPublishImageBuildShell } from "./hwlab-node-web-sentinel-cicd-jobs";
+import type { SentinelCicdState } from "./hwlab-node-web-sentinel-cicd-shared";
 import { compactHistoryJson, compactStatusSummary, renderDebugStep, renderHistory, renderStatus } from "./platform-infra-pipelines-as-code";
 
 const require = createRequire(import.meta.url);
@@ -58,13 +61,30 @@ describe("PaC 失败证据合同", () => {
   });
 
   test("sentinel image build 显式等待 socket 与 worker readiness 并清理 daemon", () => {
-    const source = readFileSync(resolve(import.meta.dir, "hwlab-node-web-sentinel-cicd-jobs.ts"), "utf8");
-    expect(source).toContain("mkdir -p \\\"$(dirname \\\"$buildkit_socket\\\")\\\"");
-    expect(source).toContain("buildkitd --addr");
-    expect(source).toContain("debug workers");
-    expect(source).toContain("failure_error_type=BuildKitReadinessError");
-    expect(source).toContain("failure_error_code=BUILDKIT_NOT_READY");
-    expect(source).toContain("cleanup_buildkitd");
-    expect(source).not.toContain("buildctl-daemonless.sh build");
+    const shell = sentinelPublishImageBuildShell({
+      spec: {
+        nodeId: "NC01",
+        lane: "v03",
+        buildkit: { sidecarImage: "moby/buildkit:rootless" },
+        networkProfile: { imageBuildProxy: { http: "", https: "", all: "", noProxy: [] } },
+      },
+      image: {
+        ref: "registry.example.test/web-probe-sentinel:test",
+        monitorWeb: {
+          imageBuildPackageMode: "frozen-lockfile",
+          imageBuildNetworkMode: "host",
+          imageBuildProxySource: "test",
+        },
+      },
+    } as unknown as SentinelCicdState, "sentinel-test");
+    expect(shell).toContain("mkdir -p \"$(dirname \"$buildkit_socket\")\"");
+    expect(shell).toContain("rootlesskit buildkitd --addr");
+    expect(shell).not.toMatch(/(^|\n)buildkitd --addr/);
+    expect(shell).toContain("debug workers");
+    expect(shell).toContain("failure_error_type=BuildKitReadinessError");
+    expect(shell).toContain("failure_error_code=BUILDKIT_NOT_READY");
+    expect(shell).toContain("cleanup_buildkitd");
+    expect(shell).not.toContain("buildctl-daemonless.sh build");
+    expect(spawnSync("sh", ["-n"], { input: shell, encoding: "utf8" })).toMatchObject({ status: 0, stderr: "" });
   });
 });