fix(recovery): seal runner failclosed disablers [skip ci]

ops/runner/README.md

@@ -406,26 +406,37 @@ Gitea service 名稱。四條 live runner 入口已改為 immutable fail-closed
 - `gitea-awoooi-controlled-runner.service`
 - `gitea-act-runner-awoooi-open.service`
 
-`awoooi-cd-lane.service` 是專用 controlled lane，不屬於 legacy runner mask 清單；
-只有在 `/run/awoooi-cd-lane-enabled` 或 `AWOOOI_START_CONTROLLED_CD_LANE=1`
-存在、`capacity=1`、label 僅限 `awoooi-ubuntu` / `awoooi-host`、沒有
-`ubuntu-latest` / StockPlatform / headless / Playwright 類泛用重型 label，且
-systemd CPU / memory / tasks 限流、root restore-source left `0` 與
-post-apply verifier 可讀回 `CD_LANE_CONTROLLED ok=1` 時，才可受控恢復。
-未滿足條件時 cd-lane 應回到 static `/bin/false` unit 與 shell stub。
+`awoooi-cd-lane.service` 與 `awoooi-cd-lane-drain.service` 目前同屬 110 壓力事故保護面。
+未完成 runner 搬遷或非 110 硬限流前，不得用 sentinel、`START_CONTROLLED_CD_LANE`、
+quarantine restore source 或 `systemd-run` 讓它們恢復 active。
 
-未完成 runner 搬遷、限流、smoke 排程前，不得解除 legacy mask、恢復泛用 runner label，
-或把 host pressure gate 預設改成 warn-only。
+2026-06-28 fail-closed enforcer update：source of truth 為：
 
-2026-06-28 controlled update：舊的 manual-only / freeze guard 已改為分流判讀。
-legacy runner 仍維持 masked / fail-closed；專用 `awoooi-cd-lane.service` 與
-`awoooi-cd-lane-drain.service` 只要通過 capacity、label、binary、process 與
-systemd limit、root restore-source left `0`、post-apply verifier，可作為
-AWOOOI 專用受控部署 lane。
+- `scripts/reboot-recovery/enforce-110-runner-failclosed.sh`
+- `ops/runner/awoooi-runner-failclosed-enforcer.service`
+- `ops/runner/awoooi-runner-failclosed-enforcer.timer`
+- `ops/runner/awoooi-runner-failclosed-authority.service`
+- `ops/runner/awoooi-runner-failclosed-authority.timer`
 
-若 verifier 失敗，rollback 回 inactive / masked / fail-closed stub；若 verifier
-通過，不得再用 generic runner fail-closed 規則殺掉 controlled lane，也不得把
-`cd.yaml` / `code-review.yaml` 長期停在 `workflow_dispatch` only。
+live 110 必須安裝 canonical `/usr/local/lib/awoooi/enforce-110-runner-failclosed.sh`，
+`/usr/local/bin/awoooi-enforce-runner-failclosed-110.sh` 只作相容 wrapper。必須啟用
+`awoooi-runner-failclosed-enforcer.timer` 與 `awoooi-runner-failclosed-authority.timer`。
+cold-start、post-start 與 P3 verifier 必須讀回兩個 timer 都 `active` / `enabled`、
+兩個 service 都 `Result=success`、runner / lane units
+全部 masked / inactive、process `0`、active job container `0`、root restore-source left `0`。
+若外部 opener 暫時把 unit 恢復成 `ConditionPathExists=/run/awoooi-runner-migrated-or-hard-limited`
+的 fail-closed stub，verifier 可視為 sealed fallback；enforcer 下一輪仍需收斂回 masked / inactive。
+
+`/tmp/enforce-110-runner-failclosed.sh`、`/tmp/awoooi-enforce-runner-failclosed-110.sh*`、舊 cd-lane unit template、startup runner-open
+drop-in、systemd unit backup、`awoooi-runner-failclosed-opened-*`、
+`awoooi-runner-failclosed-*-opened-*`、`awoooi-runner-failclosed-quarantine-*`、`failclosed-final-mask-*` disabler artifact、
+root live artifact 與 lane registration 檔名都屬 restore source，
+必須由 enforcer 封存或改成 fail-closed stub；不得保留舊 `.codex` enforcer source 讓 drain lane
+復活。
+
+未完成 runner 搬遷、硬限流、smoke 排程前，不得解除 mask、恢復泛用 runner label、
+恢復 cd-lane / drain ELF，或把 host pressure gate 預設改成 warn-only；`cd.yaml` /
+`code-review.yaml` push trigger 維持 manual-only。
 
 ---
 版本: v2.0 | 更新: 2026-03-29 | 作者: Claude Code

ops/runner/awoooi-runner-failclosed-authority.service

@@ -0,0 +1,10 @@
+[Unit]
+Description=AWOOOI 110 runner/CD lane fail-closed authority
+Documentation=file:/usr/local/lib/awoooi/enforce-110-runner-failclosed.sh
+Wants=network-online.target
+After=network-online.target docker.service
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/lib/awoooi/enforce-110-runner-failclosed.sh --apply
+TimeoutStartSec=180

ops/runner/awoooi-runner-failclosed-authority.timer

@@ -0,0 +1,12 @@
+[Unit]
+Description=Run AWOOOI 110 runner/CD lane fail-closed authority
+
+[Timer]
+OnBootSec=20s
+OnUnitInactiveSec=20s
+AccuracySec=5s
+Persistent=true
+Unit=awoooi-runner-failclosed-authority.service
+
+[Install]
+WantedBy=timers.target

ops/runner/awoooi-runner-failclosed-enforcer.service

@@ -0,0 +1,10 @@
+[Unit]
+Description=AWOOOI 110 runner/CD lane fail-closed enforcer
+Documentation=file:/usr/local/lib/awoooi/enforce-110-runner-failclosed.sh
+Wants=network-online.target
+After=network-online.target docker.service
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/lib/awoooi/enforce-110-runner-failclosed.sh --apply
+TimeoutStartSec=180

ops/runner/awoooi-runner-failclosed-enforcer.timer

@@ -0,0 +1,12 @@
+[Unit]
+Description=Run AWOOOI 110 runner/CD lane fail-closed enforcer
+
+[Timer]
+OnBootSec=30s
+OnUnitInactiveSec=120s
+AccuracySec=15s
+Persistent=true
+Unit=awoooi-runner-failclosed-enforcer.service
+
+[Install]
+WantedBy=timers.target