fix(iwooos): clarify wazuh runtime closure

apps/web/messages/en.json

@@ -13965,13 +13965,13 @@
       }
     },
     "securityToolClosure": {
-      "eyebrow": "Tool closure readback",
-      "title": "Security source readiness and production closure are measured separately",
+      "eyebrow": "Security closure overview",
+      "title": "Overall security tool closure",
       "subtitle": "Source evidence for Wazuh, SBOM, runtime detection, DAST, and AI apply only creates an executable candidate. Production execution, independent verification, and learning writeback are required for closure.",
       "statusLabel": "Security governance state",
-      "statusDetail": "{ready}/{required} source signals are readable; production closure is calculated separately from same-run execution and verification receipts.",
+      "statusDetail": "Sources {ready}/{required}; closed tool tracks {closed}/{tracks}.",
       "statusDetailFallback": "Waiting for tool-closure and controlled-candidate readback.",
-      "queueLabel": "Next executable P0",
+      "queueLabel": "Next open P0",
       "detailsTitle": "Tool-track next steps and hard boundaries",
       "boundaryTitle": "Hard boundaries",
       "source": {
@@ -13994,7 +13994,7 @@
         "source": "Source",
         "packet": "Packet",
         "handoff": "Handoff",
-        "runtime": "Runtime",
+        "runtime": "Manager posture",
         "ready": "ready",
         "waiting": "waiting",
         "failed": "check failed",
@@ -14019,21 +14019,23 @@
         "bootstrap": "Showing latest deployed readback",
         "failed": "Tool closure readback is not deployed or failed to load",
         "open": "Source evidence is readable; runtime closure is still open",
-        "ready": "Source evidence is readable; production closure advances only from runtime receipts"
+        "ready": "Source evidence is readable; production closure advances only from runtime receipts",
+        "postureClosed": "Manager posture is closed; live event / response is the next gap"
       },
       "metrics": {
-        "closure": "Runtime closure",
+        "closure": "All-tool closure",
         "source": "Source ready",
         "tracks": "Closed tracks",
         "wazuh": "Wazuh verifier",
         "alerts": "Alert receipt",
-        "runtime": "Wazuh same-run"
+        "runtime": "Manager posture"
       },
       "states": {
         "runtime_closed": "production closed",
         "source_ready_runtime_open": "source ready, runtime open",
         "partial_source_readiness_runtime_open": "source incomplete, runtime open",
-        "source_missing_runtime_open": "source missing, runtime open"
+        "source_missing_runtime_open": "source missing, runtime open",
+        "manager_posture_closed_event_response_open": "posture closed, event / response open"
       },
       "tracks": {
         "wazuh_detection_response": {
@@ -14071,7 +14073,7 @@
       },
       "queue": {
         "P0-03": {
-          "title": "Wazuh detection closure",
+          "title": "Wazuh live event / response",
           "next": "The source verifier is readable; next add live events, forensics, a case, controlled response, and an independent post-verifier."
         },
         "P0-07": {

apps/web/messages/zh-TW.json

@@ -13965,13 +13965,13 @@
       }
     },
     "securityToolClosure": {
-      "eyebrow": "工具閉環 readback",
-      "title": "安全來源就緒與正式環境閉環分開計算",
+      "eyebrow": "資安閉環總覽",
+      "title": "整體資安工具閉環",
       "subtitle": "Wazuh、SBOM、runtime detection、DAST 與 AI apply 的來源證據只代表可執行候選；必須有正式環境執行、獨立驗證與學習回寫才算閉環。",
       "statusLabel": "安全治理狀態",
-      "statusDetail": "已讀回 {ready}/{required} 個來源訊號；正式環境閉環另以同一 run 的執行與驗證收據計算。",
+      "statusDetail": "來源 {ready}/{required}；已閉環工具軌 {closed}/{tracks}。",
       "statusDetailFallback": "等待工具閉環 readback 與受控候選狀態。",
-      "queueLabel": "下一個可執行 P0",
+      "queueLabel": "下一個未閉環 P0",
       "detailsTitle": "工具軌下一步與硬邊界",
       "boundaryTitle": "硬邊界",
       "source": {
@@ -13994,7 +13994,7 @@
         "source": "來源",
         "packet": "Packet",
         "handoff": "Handoff",
-        "runtime": "Runtime",
+        "runtime": "Manager posture",
         "ready": "ready",
         "waiting": "waiting",
         "failed": "check failed",
@@ -14019,21 +14019,23 @@
         "bootstrap": "顯示最近部署驗收值",
         "failed": "工具閉環 readback 尚未部署或讀取失敗",
         "open": "來源證據可讀，runtime 閉環仍未完成",
-        "ready": "來源證據可讀，正式環境閉環仍依 runtime 收據推進"
+        "ready": "來源證據可讀，正式環境閉環仍依 runtime 收據推進",
+        "postureClosed": "Manager posture 已閉環；live event / response 仍是下一缺口"
       },
       "metrics": {
-        "closure": "Runtime 閉環",
+        "closure": "全工具閉環",
         "source": "來源就緒",
         "tracks": "已閉環軌",
         "wazuh": "Wazuh verifier",
         "alerts": "Alert receipt",
-        "runtime": "Wazuh same-run"
+        "runtime": "Manager posture"
       },
       "states": {
         "runtime_closed": "正式環境已閉環",
         "source_ready_runtime_open": "來源就緒，runtime 未閉環",
         "partial_source_readiness_runtime_open": "來源未齊，runtime 未閉環",
-        "source_missing_runtime_open": "缺來源，runtime 未閉環"
+        "source_missing_runtime_open": "缺來源，runtime 未閉環",
+        "manager_posture_closed_event_response_open": "posture 已閉環，event / response 未閉環"
       },
       "tracks": {
         "wazuh_detection_response": {
@@ -14071,7 +14073,7 @@
       },
       "queue": {
         "P0-03": {
-          "title": "Wazuh 偵測閉環",
+          "title": "Wazuh live event / response",
           "next": "來源 verifier 已可讀；下一步補 live event、鑑識、case、受控回應與獨立 post-verifier。"
         },
         "P0-07": {

apps/web/src/app/[locale]/iwooos/page.tsx

@@ -16673,28 +16673,8 @@ function IwoooSSecurityToolClosureBoard() {
   }, [])
 
   const summary = data?.summary ?? SECURITY_TOOL_CLOSURE_BOOTSTRAP_SUMMARY
-  const runtimeClosureOpen = summary.tool_runtime_closure_percent < 100
-  const statusKey = readbackFresh
-    ? runtimeClosureOpen ? 'open' : 'ready'
-    : failed ? 'bootstrap' : loading ? 'syncing' : 'bootstrap'
-  const statusTone: 'steady' | 'warn' = runtimeClosureOpen ? 'warn' : 'steady'
-  const tracks = data?.tool_tracks?.length ? data.tool_tracks : SECURITY_TOOL_CLOSURE_BOOTSTRAP_TRACKS
-  const queue = data?.next_executable_queue?.length ? data.next_executable_queue : SECURITY_TOOL_CLOSURE_BOOTSTRAP_QUEUE
-  const boundaryMarkers = data?.boundary_markers?.length ? data.boundary_markers : SECURITY_TOOL_CLOSURE_BOOTSTRAP_BOUNDARY_MARKERS
-  const primaryQueue = queue[0]
-  const primarySameRunRequired =
-    primaryQueue.same_run_required_stage_count ?? summary.wazuh_incident_response_same_run_required_stage_count ?? 0
-  const primarySameRunReady =
-    primaryQueue.same_run_source_stage_ready_count ?? summary.wazuh_incident_response_same_run_stage_ready_count ?? 0
-  const primaryHandoffReady =
-    primaryQueue.controlled_executor_handoff_preview_ready_count ??
-    summary.wazuh_controlled_executor_handoff_preview_ready_count ??
-    0
   const runtimeSummary = runtimeData?.summary
   const runtimeClosed = runtimeSummary?.runtime_closed_count ?? summary.wazuh_incident_response_runtime_closed_count ?? 0
-  const dispatchEnabled = runtimeSummary?.executor_policy_enabled_count ?? summary.wazuh_controlled_executor_dispatch_enabled_count ?? 0
-  const dispatchCandidate = runtimeSummary?.dispatch_candidate_count ?? 0
-  const checkModeFailed = runtimeSummary?.check_mode_failed_count ?? 0
   const runtimePresent = runtimeSummary?.same_run_present_stage_count ?? runtimeClosed
   const runtimeRequired = runtimeSummary?.same_run_required_stage_count ?? 1
   const runtimeCompletion = runtimeSummary?.same_run_completion_percent ?? 0
@@ -16702,6 +16682,30 @@ function IwoooSSecurityToolClosureBoard() {
     runtimeSummary?.runtime_execution_performed_count ??
     summary.runtime_execution_performed_count ??
     0
+  const runtimeClosureOpen = summary.tool_runtime_closure_percent < 100
+  const wazuhPostureClosed = runtimeClosed > 0
+  const statusKey = readbackFresh
+    ? wazuhPostureClosed ? 'postureClosed' : runtimeClosureOpen ? 'open' : 'ready'
+    : failed ? 'bootstrap' : loading ? 'syncing' : 'bootstrap'
+  const statusTone: 'steady' | 'warn' = wazuhPostureClosed || !runtimeClosureOpen ? 'steady' : 'warn'
+  const tracks = data?.tool_tracks?.length ? data.tool_tracks : SECURITY_TOOL_CLOSURE_BOOTSTRAP_TRACKS
+  const queue = data?.next_executable_queue?.length ? data.next_executable_queue : SECURITY_TOOL_CLOSURE_BOOTSTRAP_QUEUE
+  const boundaryMarkers = data?.boundary_markers?.length ? data.boundary_markers : SECURITY_TOOL_CLOSURE_BOOTSTRAP_BOUNDARY_MARKERS
+  const primaryQueue = queue[0]
+  const primaryUsesLiveWazuhRuntime = primaryQueue.track_id === 'wazuh_detection_response' && runtimeSummary != null
+  const primarySameRunRequired = primaryUsesLiveWazuhRuntime
+    ? runtimeRequired
+    : primaryQueue.same_run_required_stage_count ?? summary.wazuh_incident_response_same_run_required_stage_count ?? 0
+  const primarySameRunReady = primaryUsesLiveWazuhRuntime
+    ? runtimePresent
+    : primaryQueue.same_run_source_stage_ready_count ?? summary.wazuh_incident_response_same_run_stage_ready_count ?? 0
+  const primaryHandoffReady =
+    primaryQueue.controlled_executor_handoff_preview_ready_count ??
+    summary.wazuh_controlled_executor_handoff_preview_ready_count ??
+    0
+  const dispatchEnabled = runtimeSummary?.executor_policy_enabled_count ?? summary.wazuh_controlled_executor_dispatch_enabled_count ?? 0
+  const dispatchCandidate = runtimeSummary?.dispatch_candidate_count ?? 0
+  const checkModeFailed = runtimeSummary?.check_mode_failed_count ?? 0
   const runtimeFailureKey = runtimeData?.check_failure_class === 'ansible_target_unreachable'
     ? 'targetUnreachable'
     : runtimeData?.check_failure_class === 'ansible_check_mode_timeout'
@@ -16858,6 +16862,8 @@ function IwoooSSecurityToolClosureBoard() {
               {t('statusDetail', {
                 ready: summary.total_ready_signal_count,
                 required: summary.total_required_signal_count,
+                closed: summary.closed_tool_track_count,
+                tracks: summary.tool_track_count,
               })}
             </div>
             <div style={{ display: 'flex', alignItems: 'center', gap: 6, color: '#526058', fontSize: 10.5, fontWeight: 800 }}>
@@ -17059,6 +17065,9 @@ function IwoooSSecurityToolClosureBoard() {
           {tracks.map(track => {
             const tone = securityToolClosureTone(track)
             const width = `${Math.min(Math.max(track.source_readiness_percent, 0), 100)}%`
+            const runtimeStateKey = track.track_id === 'wazuh_detection_response' && wazuhPostureClosed
+              ? 'manager_posture_closed_event_response_open'
+              : track.runtime_closure_state
             return (
               <div
                 key={track.track_id}
@@ -17088,7 +17097,7 @@ function IwoooSSecurityToolClosureBoard() {
                   </div>
                   <div style={{ display: 'flex', justifyContent: 'space-between', gap: 8, color: '#66706a', fontSize: 10, fontWeight: 800 }}>
                     <span>{track.ready_signal_count}/{track.required_signal_count}</span>
-                    <span>{t(`states.${track.runtime_closure_state}` as never)}</span>
+                    <span>{t(`states.${runtimeStateKey}` as never)}</span>
                   </div>
                 </div>
                 <div style={{ display: 'flex', justifyContent: 'space-between', gap: 7, alignItems: 'center' }}>