fix(iwooos): repair wazuh host trust and retry

apps/web/messages/en.json

@@ -13997,9 +13997,17 @@
         "runtime": "Runtime",
         "ready": "ready",
         "waiting": "waiting",
+        "failed": "check failed",
         "closed": "closed",
         "blocked": "blocked"
       },
+      "runtimeFailure": {
+        "title": "Wazuh execution chain",
+        "targetUnreachable": "Target trust failed; waiting for this release's bounded retry",
+        "timeout": "Check mode timed out; waiting for this release's bounded retry",
+        "checkFailed": "Check mode failed; waiting for this release's bounded retry",
+        "unclassified": "Check failure isolated; waiting for safe classification and bounded retry"
+      },
       "guards": {
         "runtimeActions": "bounded execution receipt",
         "criticalSecrets": "sensitive value read",

apps/web/messages/zh-TW.json

@@ -13997,9 +13997,17 @@
         "runtime": "Runtime",
         "ready": "ready",
         "waiting": "waiting",
+        "failed": "check failed",
         "closed": "closed",
         "blocked": "blocked"
       },
+      "runtimeFailure": {
+        "title": "Wazuh 執行鏈",
+        "targetUnreachable": "目標連線信任未通過，等待本版受控重試",
+        "timeout": "check-mode 逾時，等待本版受控重試",
+        "checkFailed": "check-mode 未通過，等待本版受控重試",
+        "unclassified": "check-mode 失敗已隔離，等待安全分類與受控重試"
+      },
       "guards": {
         "runtimeActions": "受控執行收據",
         "criticalSecrets": "敏感值讀取",

apps/web/src/app/[locale]/iwooos/page.tsx

@@ -16694,6 +16694,7 @@ function IwoooSSecurityToolClosureBoard() {
   const runtimeClosed = runtimeSummary?.runtime_closed_count ?? summary.wazuh_incident_response_runtime_closed_count ?? 0
   const dispatchEnabled = runtimeSummary?.executor_policy_enabled_count ?? summary.wazuh_controlled_executor_dispatch_enabled_count ?? 0
   const dispatchCandidate = runtimeSummary?.dispatch_candidate_count ?? 0
+  const checkModeFailed = runtimeSummary?.check_mode_failed_count ?? 0
   const runtimePresent = runtimeSummary?.same_run_present_stage_count ?? runtimeClosed
   const runtimeRequired = runtimeSummary?.same_run_required_stage_count ?? 1
   const runtimeCompletion = runtimeSummary?.same_run_completion_percent ?? 0
@@ -16701,6 +16702,15 @@ function IwoooSSecurityToolClosureBoard() {
     runtimeSummary?.runtime_execution_performed_count ??
     summary.runtime_execution_performed_count ??
     0
+  const runtimeFailureKey = runtimeData?.check_failure_class === 'ansible_target_unreachable'
+    ? 'targetUnreachable'
+    : runtimeData?.check_failure_class === 'ansible_check_mode_timeout'
+      ? 'timeout'
+      : runtimeData?.check_failure_class?.startsWith('ansible_check_mode_returncode_')
+        ? 'checkFailed'
+        : runtimeData?.check_failure_class
+          ? 'unclassified'
+          : null
   const runwayItems = [
     {
       key: 'source',
@@ -16725,10 +16735,10 @@ function IwoooSSecurityToolClosureBoard() {
     },
     {
       key: 'runtime',
-      icon: ShieldCheck,
+      icon: checkModeFailed > 0 ? ShieldAlert : ShieldCheck,
       value: `${runtimePresent}/${runtimeRequired}`,
-      tone: runtimeClosed > 0 ? 'steady' as const : runtimePresent > 0 ? 'warn' as const : 'locked' as const,
-      state: runtimeClosed > 0 ? 'closed' : dispatchEnabled > 0 ? 'waiting' : 'blocked',
+      tone: runtimeClosed > 0 ? 'steady' as const : runtimePresent > 0 || checkModeFailed > 0 ? 'warn' as const : 'locked' as const,
+      state: runtimeClosed > 0 ? 'closed' : checkModeFailed > 0 ? 'failed' : dispatchEnabled > 0 ? 'waiting' : 'blocked',
     },
   ]
   const metrics: IwoooSSecurityToolClosureMetric[] = [
@@ -16918,6 +16928,32 @@ function IwoooSSecurityToolClosureBoard() {
           </div>
         </div>
 
+        {runtimeFailureKey ? (
+          <div
+            data-testid="iwooos-wazuh-runtime-failure"
+            role="status"
+            style={{
+              border: '0.5px solid #d8a96f',
+              borderRadius: 8,
+              background: '#fff8ef',
+              color: '#7c4618',
+              padding: '9px 11px',
+              display: 'flex',
+              alignItems: 'center',
+              gap: 9,
+              minWidth: 0,
+            }}
+          >
+            <ShieldAlert size={16} aria-hidden="true" />
+            <strong style={{ fontSize: 10.5, fontWeight: 950, flex: '0 0 auto' }}>
+              {t('runtimeFailure.title')}
+            </strong>
+            <span style={{ fontSize: 10.5, fontWeight: 800, ...textWrap }}>
+              {t(`runtimeFailure.${runtimeFailureKey}` as never)}
+            </span>
+          </div>
+        ) : null}
+
         <div
           data-testid="iwooos-security-tool-closure-runway"
           style={{

apps/web/src/lib/api-client.ts

@@ -899,6 +899,7 @@ export interface IwoooSWazuhControlledExecutorRuntimeReadbackResponse {
     executor_policy_enabled_count: number
     dispatch_candidate_count: number
     check_mode_passed_count: number
+    check_mode_failed_count: number
     runtime_execution_performed_count: number
     bounded_posture_execution_passed_count: number
     independent_post_verifier_passed_count: number
@@ -924,6 +925,7 @@ export interface IwoooSWazuhControlledExecutorRuntimeReadbackResponse {
     present: boolean
   }>
   missing_stage_ids: string[]
+  check_failure_class: string | null
   next_safe_action: string
   active_blockers: string[]
   latest_receipt_at: string | null