feat(web): add IwoooS decision writeups

apps/web/messages/en.json

@@ -1887,6 +1887,49 @@
           "next": "active runtime gates=0; action buttons=false"
         }
       }
+    },
+    "hostOwnerDecisionRecordWriteups": {
+      "title": "Host Owner Decision Record Write-Up Packets",
+      "subtitle": "When a draft review outcome is ready for write-up, IwoooS can still only display formal decision record write-up fields. It does not create records, mark completed / accepted, or open runtime gates.",
+      "packetLabel": "Write-up packet",
+      "fieldLabel": "Required field",
+      "items": {
+        "decisionSummaryWriteup": {
+          "title": "Decision summary write-up",
+          "body": "Only organizes the human owner decision, risk acceptance boundary, and no-execution statement.",
+          "field": "decision summary; write-up completed=0"
+        },
+        "approvedScopeWriteup": {
+          "title": "Approved scope write-up",
+          "body": "Only organizes hosts, networks, services, exclusions, observation intent, and expiry.",
+          "field": "scope / expiry; record created=false"
+        },
+        "scanModeLimitsWriteup": {
+          "title": "Scan mode limits write-up",
+          "body": "Only organizes limits for observe-only, future active scan, or credentialed scan modes. This is not scan approval.",
+          "field": "mode limits; scan authorized=false"
+        },
+        "credentialBoundaryWriteup": {
+          "title": "Credential boundary write-up",
+          "body": "Only organizes credential handling metadata, owner, retention boundary, and forbidden collection content.",
+          "field": "metadata-only boundary; secret collection=false"
+        },
+        "maintenanceRollbackWriteup": {
+          "title": "Maintenance and rollback write-up",
+          "body": "Only organizes maintenance window candidates, constraints, rollback owner, recovery path, and human contact.",
+          "field": "window / rollback; host update=false"
+        },
+        "validationEvidenceWriteup": {
+          "title": "Validation evidence write-up",
+          "body": "Only organizes post-check metrics, baseline, evidence pointer, and human acceptance condition.",
+          "field": "metrics / evidence; accepted=0"
+        },
+        "runtimeGatePointerWriteup": {
+          "title": "Runtime gate pointer write-up",
+          "body": "Only states that future approval still needs a separate follow-up runtime gate and cannot execute from write-up.",
+          "field": "runtime gate pointer; active gates=0"
+        }
+      }
     }
   },
   "tickets": {

apps/web/messages/zh-TW.json

@@ -1888,6 +1888,49 @@
           "next": "active runtime gates=0；action buttons=false"
         }
       }
+    },
+    "hostOwnerDecisionRecordWriteups": {
+      "title": "主機 Owner Decision Record Write-Up Packets",
+      "subtitle": "Draft review outcome 若進入 ready for write-up，IwoooS 也只能顯示正式 decision record 撰寫欄位。不建立 record、不標示 completed / accepted、不開 runtime gate。",
+      "packetLabel": "Write-up packet",
+      "fieldLabel": "必要欄位",
+      "items": {
+        "decisionSummaryWriteup": {
+          "title": "Decision summary write-up",
+          "body": "只整理 owner 要做的人工作業判斷、風險接受邊界與不執行聲明。",
+          "field": "decision summary；write-up completed=0"
+        },
+        "approvedScopeWriteup": {
+          "title": "Approved scope write-up",
+          "body": "只整理主機、網段、服務、排除範圍、觀察目的與到期時間。",
+          "field": "scope / expiry；record created=false"
+        },
+        "scanModeLimitsWriteup": {
+          "title": "Scan mode limits write-up",
+          "body": "只整理 observe-only、future active scan 或 credentialed scan 的限制條件，不代表掃描批准。",
+          "field": "mode limits；scan authorized=false"
+        },
+        "credentialBoundaryWriteup": {
+          "title": "Credential boundary write-up",
+          "body": "只整理 credential handling metadata、owner、保存邊界與不可收集內容。",
+          "field": "metadata-only boundary；secret collection=false"
+        },
+        "maintenanceRollbackWriteup": {
+          "title": "Maintenance and rollback write-up",
+          "body": "只整理維護窗口候選、限制條件、rollback owner、復原路徑與人工聯絡點。",
+          "field": "window / rollback；host update=false"
+        },
+        "validationEvidenceWriteup": {
+          "title": "Validation evidence write-up",
+          "body": "只整理 post-check metrics、baseline、evidence pointer 與人工驗收條件。",
+          "field": "metrics / evidence；accepted=0"
+        },
+        "runtimeGatePointerWriteup": {
+          "title": "Runtime gate pointer write-up",
+          "body": "只標示若未來批准，仍要另開 follow-up runtime gate，不能由 write-up 執行。",
+          "field": "runtime gate pointer；active gates=0"
+        }
+      }
     }
   },
   "tickets": {

apps/web/src/app/[locale]/iwooos/page.tsx

@@ -179,6 +179,13 @@ type HostOwnerDecisionRecordDraftReviewOutcomeLane = {
   tone: 'steady' | 'warn' | 'locked'
 }
 
+type HostOwnerDecisionRecordWriteupPacket = {
+  key: string
+  packet: string
+  icon: typeof ShieldCheck
+  tone: 'steady' | 'warn' | 'locked'
+}
+
 const postureMetrics: PostureMetric[] = [
   { key: 'overall', value: '58%', tone: 'warn' },
   { key: 'framework', value: '80-85%', tone: 'steady' },
@@ -420,6 +427,16 @@ const hostOwnerDecisionRecordDraftReviewOutcomeLanes: HostOwnerDecisionRecordDra
   { key: 'runtimeGateStillRequired', lane: 'DV7', icon: ShieldCheck, tone: 'locked' },
 ]
 
+const hostOwnerDecisionRecordWriteupPackets: HostOwnerDecisionRecordWriteupPacket[] = [
+  { key: 'decisionSummaryWriteup', packet: 'WU1', icon: ClipboardCheck, tone: 'warn' },
+  { key: 'approvedScopeWriteup', packet: 'WU2', icon: Radar, tone: 'warn' },
+  { key: 'scanModeLimitsWriteup', packet: 'WU3', icon: Activity, tone: 'locked' },
+  { key: 'credentialBoundaryWriteup', packet: 'WU4', icon: Lock, tone: 'locked' },
+  { key: 'maintenanceRollbackWriteup', packet: 'WU5', icon: Clock3, tone: 'warn' },
+  { key: 'validationEvidenceWriteup', packet: 'WU6', icon: CheckCircle2, tone: 'warn' },
+  { key: 'runtimeGatePointerWriteup', packet: 'WU7', icon: ShieldCheck, tone: 'locked' },
+]
+
 const evidenceItems = [
   'iwooos-posture-projection.snapshot.json',
   'security-rollout-policy.snapshot.json',
@@ -1090,6 +1107,34 @@ function HostOwnerDecisionRecordDraftReviewOutcomeCard({
   )
 }
 
+function HostOwnerDecisionRecordWriteupCard({ item }: { item: HostOwnerDecisionRecordWriteupPacket }) {
+  const t = useTranslations('iwooos.hostOwnerDecisionRecordWriteups')
+  const Icon = item.icon
+  return (
+    <div style={{ ...band, minHeight: 190, padding: 16 }}>
+      <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'space-between', gap: 12 }}>
+        <div style={{ display: 'flex', alignItems: 'center', gap: 9 }}>
+          <Icon size={18} color={toneColors[item.tone]} />
+          <span style={{ fontSize: 11, color: '#87867f' }}>{t('packetLabel')}</span>
+        </div>
+        <span style={{ fontSize: 11, color: '#9b978b' }}>{item.packet}</span>
+      </div>
+      <h2 style={{ fontSize: 14, margin: '12px 0 6px', color: '#141413' }}>
+        {t(`items.${item.key}.title` as never)}
+      </h2>
+      <p style={{ fontSize: 12, lineHeight: 1.55, color: '#6f6d66', margin: 0 }}>
+        {t(`items.${item.key}.body` as never)}
+      </p>
+      <div style={{ marginTop: 10, display: 'grid', gap: 5 }}>
+        <div style={{ fontSize: 11, color: '#87867f' }}>{t('fieldLabel')}</div>
+        <div style={{ fontSize: 11, color: toneColors[item.tone], lineHeight: 1.45 }}>
+          {t(`items.${item.key}.field` as never)}
+        </div>
+      </div>
+    </div>
+  )
+}
+
 export default function IwoooSPage({ params }: { params: { locale: string } }) {
   const t = useTranslations('iwooos')
 
@@ -1462,6 +1507,26 @@ export default function IwoooSPage({ params }: { params: { locale: string } }) {
           </div>
         </section>
 
+        <section style={{ marginBottom: 14 }}>
+          <div style={{ marginBottom: 14 }}>
+            <h2 style={{ fontSize: 16, margin: 0 }}>{t('hostOwnerDecisionRecordWriteups.title')}</h2>
+            <p style={{ fontSize: 12, color: '#6f6d66', margin: '6px 0 0', lineHeight: 1.55 }}>
+              {t('hostOwnerDecisionRecordWriteups.subtitle')}
+            </p>
+          </div>
+          <div
+            style={{
+              display: 'grid',
+              gridTemplateColumns: 'repeat(auto-fit, minmax(210px, 1fr))',
+              gap: 12,
+            }}
+          >
+            {hostOwnerDecisionRecordWriteupPackets.map(item => (
+              <HostOwnerDecisionRecordWriteupCard key={item.key} item={item} />
+            ))}
+          </div>
+        </section>
+
         <section
           style={{
             display: 'grid',