feat(web): add IwoooS decision writeups

docs/security/IWOOOS-POSTURE-PROJECTION.md

@@ -56,6 +56,7 @@ IwoooS 首版只讀取或對齊以下已提交 evidence：
 24. 7 個 host owner decision record draft packets，顯示 formal decision record 候選需要的草稿欄位。
 25. 7 個 host owner decision record draft review checklist items，顯示草稿欄位進入正式決策紀錄前仍需只讀核對的條件。
 26. 7 個 host owner decision record draft review outcome lanes，顯示草稿核對後的只讀結果分流。
+27. 7 個 host owner decision record write-up packets，顯示正式 decision record 撰寫欄位，但不建立 record、不標記 completed / accepted、不開 runtime gate。
 
 ## 3.1 既有前端資安頁面整合
 
@@ -385,6 +386,24 @@ S2.28 將 decision record draft review checklist 後可能出現的結果拆成
 
 這個 outcome board 不代表 draft review 已通過、decision record 已建立、owner decision 已接受、資安批准已完成或 runtime gate 已開啟。它只讓 IwoooS 把草稿核對後的下一步說清楚。
 
+## 3.20 Host Owner Decision Record Write-Up Packets
+
+S2.29 將 ready for decision record write-up 後需要整理的正式撰寫欄位拆成七個只讀 packets。這一層只回答「若未來要寫正式 decision record，需要哪些欄位」，不標記 write-up completed、不建立 decision record、不標記 accepted、不建立 approval record、不開 runtime gate。
+
+| 順序 | Write-up packet | 來源 lane | 必要欄位 |
+|------|-----------------|-----------|----------|
+| 1 | Decision summary write-up | ready for decision record write-up | human decision summary、risk acceptance boundary、no-execution statement |
+| 2 | Approved scope write-up | ready for decision record write-up | host / network / service / exclusion / observation intent / expiry |
+| 3 | Scan mode limits write-up | scan mode ambiguous | observe-only、future active scan、credentialed scan limits |
+| 4 | Credential boundary write-up | credential boundary incomplete | metadata-only credential owner、retention boundary、forbidden collection |
+| 5 | Maintenance and rollback write-up | maintenance constraints incomplete | maintenance window、constraints、rollback owner、recovery path、human contact |
+| 6 | Validation evidence write-up | runtime gate required | post-check metrics、baseline、evidence pointer、human acceptance condition |
+| 7 | Runtime gate pointer write-up | runtime gate required | separate follow-up runtime gate pointer；active gate=0 |
+
+每個 packet 都固定 `display_mode=owner_decision_record_writeup_only`、`decision_record_writeup_completed_count=0`、`decision_record_created=false`、`owner_decision_received_count=0`、`owner_decision_accepted_count=0`、`owner_approval_record_created=false`、`runtime_gate_opened=false`、`raw_payload_allowed=false`、`secret_value_collection_allowed=false`、`runtime_execution_authorized=false`、`action_buttons_allowed=false`、`not_authorization=true`。
+
+這個 write-up board 不代表 formal decision record 已完成、decision record 已建立、owner decision 已接受、資安批准已完成或 runtime gate 已開啟。它只讓 IwoooS 把正式撰寫欄位先說清楚，並保留後續人工批准與 runtime gate 的分離。
+
 ## 4. 仍禁止
 
 IwoooS 不得提供下列輸出：
@@ -410,7 +429,8 @@ IwoooS 不得提供下列輸出：
 19. 從 owner decision record draft 建立 host owner decision record、標記 record created，或從 draft 開 runtime gate。
 20. 把 owner decision record draft review 當成 approval、標記 draft review passed、從 draft review 建立 decision record，或從 draft review 開 runtime gate。
 21. 把 owner decision record draft review outcome 當成 approval、標記 draft review outcome passed、從 draft review outcome 建立 decision record，或從 draft review outcome 開 runtime gate。
-22. 把 58% progress、contract count、mirror readiness 或前端可見狀態當成授權。
+22. 從 owner decision record write-up 建立 decision record、標記 write-up completed、標記 decision record accepted，或從 write-up 開 runtime gate。
+23. 把 58% progress、contract count、mirror readiness 或前端可見狀態當成授權。
 
 ## 5. 驗證