fix(agent): separate registry-ready deploy marker blocker

docs/LOGBOOK.md

@@ -1,3 +1,27 @@
+## 2026-07-01 — 16:32 AI Loop registry-ready / deploy-marker blocker separation
+
+**照主線修正的問題**：
+- 最新 live readback 顯示 `https://registry.wooo.work/v2/` 已回 `401`，代表 public registry route 不再是 502 主 blocker；但 Gitea CD `#4258` 仍 `Failure`，Harbor 110 repair `#4255` 仍 `Failure`，分類為 `harbor_110_remote_ssh_publickey_auth_stalled`。
+- `ai-agent-log-intelligence-runtime-sample-readback` 已更新 P0 runtime sample：`registry_v2_status=401`、`registry_v2_ready=true`、`current_cd_run_id=4258`、`current_cd_run_status=Failure`、`harbor_110_repair_run_id=4255`、`harbor_110_repair_run_status=Failure`、`deploy_marker_readback_required=true`。
+- `ai_agent_log_controlled_writeback_plan_readback` / `executor_readback` 新增 deployment closure 欄位：registry ready classifier、current CD status / commit、Harbor repair status、deploy marker readback required、CD failure after registry ready。
+- `awoooi_priority_work_order_readback` 現在把 AI Loop current blocker evidence 分成「registry 已 ready」與「110 SSH / CD deploy marker 未閉合」，`next_execution_order` 明確要求不要重新打開 Harbor 502 作為主線；下一步是 110 SSH/session control-path readback、CD failure closure、deploy marker / production image / priority API verifier。
+- Queue normalizer contract 新增 `current_cd_deploy_marker_closure`、`registry_v2_ready_state`、`harbor_110_repair_failure_after_registry_ready`，讓 KM / RAG / MCP / PlayBook / AI Agent writeback 能學到「401 ready 不是 502 blocker」。
+
+**驗證**：
+- `DATABASE_URL=postgresql+asyncpg://test:test@localhost:5432/test PYTHONPATH=apps/api python3.11 -m pytest apps/api/tests/test_ai_agent_log_controlled_writeback_plan_readback_api.py apps/api/tests/test_ai_agent_log_controlled_writeback_executor_readback_api.py apps/api/tests/test_awoooi_priority_work_order_readback_api.py apps/api/tests/test_ai_agent_autonomous_runtime_control.py -q`：`25 passed`。
+- `python3.11 -m ruff check ...`：通過。
+- `python3.11 -m py_compile ...`：通過。
+- `python3.11 -m json.tool docs/operations/ai-agent-log-intelligence-runtime-sample-readback.snapshot.json`、`git diff --check`：通過。
+- `python3.11 ops/runner/guard-gitea-runner-pressure.py --root .`：`GITEA_RUNNER_PRESSURE_GUARD_OK workflow_files=12 scheduled_workflows=4 auto_branch_events_on_110=0 generic_runner_labels=0`。
+- `pnpm -C apps/web typecheck`：通過；本機 `node_modules` 原缺 TypeScript binary，已用 `pnpm install --frozen-lockfile --prefer-offline` 修復，lockfile 未變。
+- i18n mirror check：`en_keys=14748`、`zh_keys=14748`、`missing_in_zh=0`、`missing_in_en=0`。
+- Playwright desktop / mobile smoke 未完成：本機 Chromium runtime 不存在，下載 `playwright install chromium` 時磁碟只剩約 `236MiB`，失敗於 `ENOSPC: no space left on device`；Playwright cache 未留下大檔。
+
+**邊界**：未讀 secret / token / `.env` / raw sessions / SQLite / auth；未使用 GitHub / `gh` / GitHub API；未 workflow_dispatch；未重啟主機 / Docker / Nginx / K3s / DB / firewall；本輪只改 API readback、metadata snapshot、測試與 LOGBOOK。
+
+**下一步**：
+- commit / push 後重新讀 Gitea queue、production deploy marker、Approvals / Runs / Work Items / Alerts，確認頁面不再把 Harbor 502 或人工處理當預設終局；若 production 尚未部署本 patch，繼續追 CD/deploy-marker readback，不宣稱 runtime closure。
+
 ## 2026-07-01 — 16:05 Gitea CD / ArgoCD post-reboot recovery
 
 **照主線修復的問題**：

docs/operations/ai-agent-log-intelligence-runtime-sample-readback.snapshot.json

@@ -81,13 +81,16 @@
       "tool": "read_public_gitea_queue_and_remote_control_classifier",
       "redaction_state": "metadata_only_no_raw_payload",
       "observed_events": [
-        "harbor_registry_public_route_unavailable",
+        "harbor_registry_public_route_ready_http_401",
         "harbor_110_remote_control_channel_unavailable",
         "harbor_110_remote_ssh_reachable",
         "harbor_110_remote_ssh_publickey_auth_stalled",
         "harbor_110_remote_ssh_publickey_offer_timeout",
+        "harbor_110_remote_ssh_server_accepts_key_then_session_timeout",
         "harbor_110_remote_ssh_auth_permission_denied_false",
         "harbor_110_repair_jobs_payload_stale_or_cross_workflow",
+        "current_cd_failure_after_registry_ready",
+        "deploy_marker_readback_required_after_registry_ready",
         "bounded_ssh_timeout_seen",
         "controlled_profile_no_matching_runner_cleared",
         "node_load_not_high",
@@ -99,6 +102,13 @@
         "commit_sha",
         "runner_label",
         "registry_v2_status",
+        "registry_v2_ready",
+        "deployment_closure_state",
+        "current_cd_run_id",
+        "current_cd_run_status",
+        "current_cd_commit_sha",
+        "harbor_110_repair_run_id",
+        "harbor_110_repair_run_status",
         "ssh_auth_classification",
         "remote_control_channel",
         "remote_ssh_publickey_auth_stalled",
@@ -124,12 +134,20 @@
         "remote_ssh_reachable": true,
         "remote_ssh_publickey_auth_stalled": true,
         "remote_ssh_publickey_offer_timeout": true,
-        "remote_ssh_server_accepts_key_then_session_timeout": false,
+        "remote_ssh_server_accepts_key_then_session_timeout": true,
         "remote_ssh_auth_permission_denied": false,
+        "current_cd_run_id": "4258",
+        "current_cd_run_status": "Failure",
+        "current_cd_commit_sha": "06819ea96c058e7987811e853242390eaced7f91",
+        "harbor_110_repair_run_id": "4255",
+        "harbor_110_repair_run_status": "Failure",
         "harbor_110_repair_failure_classifier": "harbor_110_remote_ssh_publickey_auth_stalled",
         "harbor_110_repair_jobs_payload_stale_or_cross_workflow": true,
         "node_load_classifier": "load_not_high",
-        "registry_v2_status": 502,
+        "registry_v2_status": 401,
+        "registry_v2_ready": true,
+        "deployment_closure_state": "blocked_latest_visible_cd_failure_after_registry_ready",
+        "deploy_marker_readback_required": true,
         "controlled_recovery_package": "recover-110-control-path-and-harbor-local.sh --check",
         "post_apply_verifier": "check-awoooi-110-controlled-cd-lane-readiness.sh",
         "controlled_local_console_execution_plan": [
@@ -182,7 +200,7 @@
           "docker_system_prune",
           "workflow_dispatch_from_this_endpoint"
         ],
-        "safe_next_step": "run_110_local_console_control_path_recovery_then_rerun_harbor_queue_and_registry_readback"
+        "safe_next_step": "run_110_ssh_session_control_path_recovery_then_verify_cd_and_deploy_marker_readback"
       },
       "raw_log_payload_persisted": false
     }