feat(web): add IwoooS writeup review

docs/security/IWOOOS-POSTURE-PROJECTION.md

@@ -57,6 +57,7 @@ IwoooS 首版只讀取或對齊以下已提交 evidence：
 25. 7 個 host owner decision record draft review checklist items，顯示草稿欄位進入正式決策紀錄前仍需只讀核對的條件。
 26. 7 個 host owner decision record draft review outcome lanes，顯示草稿核對後的只讀結果分流。
 27. 7 個 host owner decision record write-up packets，顯示正式 decision record 撰寫欄位，但不建立 record、不標記 completed / accepted、不開 runtime gate。
+28. 7 個 host owner decision record write-up review checklist items，顯示正式撰寫欄位進入決策紀錄前仍需只讀核對的條件。
 
 ## 3.1 既有前端資安頁面整合
 
@@ -404,6 +405,24 @@ S2.29 將 ready for decision record write-up 後需要整理的正式撰寫欄
 
 這個 write-up board 不代表 formal decision record 已完成、decision record 已建立、owner decision 已接受、資安批准已完成或 runtime gate 已開啟。它只讓 IwoooS 把正式撰寫欄位先說清楚，並保留後續人工批准與 runtime gate 的分離。
 
+## 3.21 Host Owner Decision Record Write-Up Review Checklist
+
+S2.30 將 write-up packets 後的核對條件拆成七個只讀 checklist items。這一層只回答「正式撰寫欄位是否可讀、可追、仍未升級成批准語義」，不標記 review passed、不標記 write-up completed、不建立 decision record、不標記 accepted、不建立 approval record、不開 runtime gate。
+
+| 順序 | Write-up review | 來源 packet | 核對條件 |
+|------|-----------------|-------------|----------|
+| 1 | Decision summary readable | decision summary write-up | decision summary、risk acceptance、no-execution statement readable |
+| 2 | Scope and expiry complete | approved scope write-up | scope、exclusion、observation intent、expiry complete |
+| 3 | Scan mode limits explicit | scan mode limits write-up | scan mode limits explicit and not authorization |
+| 4 | Credential boundary metadata only | credential boundary write-up | metadata-only boundary and no secret collection |
+| 5 | Maintenance and rollback linked | maintenance / rollback write-up | maintenance window、constraints、rollback、human contact linked |
+| 6 | Validation evidence linked | validation evidence write-up | metrics、baseline、evidence、acceptance condition linked |
+| 7 | Runtime gate still separate | runtime gate pointer write-up | runtime gate pointer separate and closed |
+
+每個 review check 都固定 `display_mode=owner_decision_record_writeup_review_checklist_only`、`decision_record_writeup_review_passed_count=0`、`decision_record_writeup_completed_count=0`、`decision_record_created=false`、`owner_decision_received_count=0`、`owner_decision_accepted_count=0`、`owner_approval_record_created=false`、`runtime_gate_opened=false`、`raw_payload_allowed=false`、`secret_value_collection_allowed=false`、`runtime_execution_authorized=false`、`action_buttons_allowed=false`、`not_authorization=true`。
+
+這個 checklist 不代表 write-up review 已通過、formal decision record 已完成、decision record 已建立、owner decision 已接受或 runtime gate 已開啟。它只讓 IwoooS 把正式 decision record 進入後續人審前的核對條件說清楚。
+
 ## 4. 仍禁止
 
 IwoooS 不得提供下列輸出：
@@ -430,7 +449,8 @@ IwoooS 不得提供下列輸出：
 20. 把 owner decision record draft review 當成 approval、標記 draft review passed、從 draft review 建立 decision record，或從 draft review 開 runtime gate。
 21. 把 owner decision record draft review outcome 當成 approval、標記 draft review outcome passed、從 draft review outcome 建立 decision record，或從 draft review outcome 開 runtime gate。
 22. 從 owner decision record write-up 建立 decision record、標記 write-up completed、標記 decision record accepted，或從 write-up 開 runtime gate。
-23. 把 58% progress、contract count、mirror readiness 或前端可見狀態當成授權。
+23. 把 owner decision record write-up review 當成 approval、標記 write-up review passed / completed、從 write-up review 建立 decision record，或從 write-up review 開 runtime gate。
+24. 把 58% progress、contract count、mirror readiness 或前端可見狀態當成授權。
 
 ## 5. 驗證