feat(web): add IwoooS draft review outcomes

apps/web/messages/en.json

@@ -1844,6 +1844,49 @@
           "guard": "active runtime gates=0; action buttons=false"
         }
       }
+    },
+    "hostOwnerDecisionRecordDraftReviewOutcomes": {
+      "title": "Host Owner Decision Record Draft Review Outcome Lanes",
+      "subtitle": "After draft review checklist, cases can only enter these read-only outcome lanes. This shows next steps and does not mark review passed, create decision records, or open runtime gates.",
+      "laneLabel": "Review outcome",
+      "nextLabel": "Next step",
+      "items": {
+        "readyForDecisionRecordWriteup": {
+          "title": "Ready for decision record write-up",
+          "body": "When scope, scan mode, credential boundary, maintenance, rollback, validation, and runtime separation are readable, the case can only become a formal decision record write-up candidate.",
+          "next": "display write-up candidate; record created=false"
+        },
+        "scopeDraftIncomplete": {
+          "title": "Scope draft incomplete",
+          "body": "When the scope draft lacks host, network, service, exclusion, or observation intent, it returns to scope draft completion.",
+          "next": "collect scope statement; no record creation"
+        },
+        "scanModeAmbiguous": {
+          "title": "Scan mode ambiguous",
+          "body": "When scan mode can still be mistaken for authorization, it returns to scan mode draft and scope explanation.",
+          "next": "refine scan mode wording; scan authorized=false"
+        },
+        "credentialBoundaryIncomplete": {
+          "title": "Credential boundary incomplete",
+          "body": "When credential boundary is unclear about metadata-only handling, owner, or retention, it returns to credential draft completion.",
+          "next": "collect metadata-only boundary; secret collection=false"
+        },
+        "maintenanceConstraintsIncomplete": {
+          "title": "Maintenance constraints incomplete",
+          "body": "When maintenance window, constraints, or impact boundary are unreadable, the case cannot enter formal decision record write-up.",
+          "next": "collect constraints; host update=false"
+        },
+        "rollbackOwnerIncomplete": {
+          "title": "Rollback owner incomplete",
+          "body": "When rollback owner, recovery path, or human contact is unreadable, the case cannot enter later approval semantics.",
+          "next": "collect rollback owner; approval record=false"
+        },
+        "runtimeGateStillRequired": {
+          "title": "Runtime gate still required",
+          "body": "Any later host action must still wait for a separate runtime gate and cannot execute from draft review outcome.",
+          "next": "active runtime gates=0; action buttons=false"
+        }
+      }
     }
   },
   "tickets": {

apps/web/messages/zh-TW.json

@@ -1845,6 +1845,49 @@
           "guard": "active runtime gates=0；action buttons=false"
         }
       }
+    },
+    "hostOwnerDecisionRecordDraftReviewOutcomes": {
+      "title": "主機 Owner Decision Record Draft Review Outcome Lanes",
+      "subtitle": "Draft review checklist 後只能進入這些只讀結果分流。這裡顯示下一步，不會標記 review passed、不會建立 decision record、不會開 runtime gate。",
+      "laneLabel": "Review outcome",
+      "nextLabel": "下一步",
+      "items": {
+        "readyForDecisionRecordWriteup": {
+          "title": "Ready for decision record write-up",
+          "body": "scope、scan mode、credential boundary、maintenance、rollback、validation 與 runtime separation 都可讀時，只能進入正式 decision record 撰寫候選。",
+          "next": "顯示 write-up candidate；record created=false"
+        },
+        "scopeDraftIncomplete": {
+          "title": "Scope draft incomplete",
+          "body": "scope 草稿缺主機、網段、服務、排除範圍或觀察目的時，回到 scope 草稿補件。",
+          "next": "補 scope statement；不建立 record"
+        },
+        "scanModeAmbiguous": {
+          "title": "Scan mode ambiguous",
+          "body": "scan mode 仍可能被誤讀成授權時，回到 scan mode 草稿與 scope 說明。",
+          "next": "補 scan mode wording；scan authorized=false"
+        },
+        "credentialBoundaryIncomplete": {
+          "title": "Credential boundary incomplete",
+          "body": "credential boundary 若不清楚 metadata-only、owner 或保存邊界，必須回到 credential 草稿補件。",
+          "next": "補 metadata-only boundary；secret collection=false"
+        },
+        "maintenanceConstraintsIncomplete": {
+          "title": "Maintenance constraints incomplete",
+          "body": "維護窗口、限制條件或不可影響範圍不可讀時，不能進入正式決策紀錄撰寫。",
+          "next": "補 constraints；host update=false"
+        },
+        "rollbackOwnerIncomplete": {
+          "title": "Rollback owner incomplete",
+          "body": "rollback owner、復原路徑或人工聯絡點不可讀時，不能建立後續批准語義。",
+          "next": "補 rollback owner；approval record=false"
+        },
+        "runtimeGateStillRequired": {
+          "title": "Runtime gate still required",
+          "body": "任何後續主機動作仍要等待獨立 runtime gate，不能由 draft review outcome 執行。",
+          "next": "active runtime gates=0；action buttons=false"
+        }
+      }
     }
   },
   "tickets": {

apps/web/src/app/[locale]/iwooos/page.tsx

@@ -172,6 +172,13 @@ type HostOwnerDecisionRecordDraftReviewItem = {
   tone: 'steady' | 'warn' | 'locked'
 }
 
+type HostOwnerDecisionRecordDraftReviewOutcomeLane = {
+  key: string
+  lane: string
+  icon: typeof ShieldCheck
+  tone: 'steady' | 'warn' | 'locked'
+}
+
 const postureMetrics: PostureMetric[] = [
   { key: 'overall', value: '58%', tone: 'warn' },
   { key: 'framework', value: '80-85%', tone: 'steady' },
@@ -403,6 +410,16 @@ const hostOwnerDecisionRecordDraftReviewItems: HostOwnerDecisionRecordDraftRevie
   { key: 'runtimeGateStillClosed', check: 'RV7', icon: ShieldCheck, tone: 'locked' },
 ]
 
+const hostOwnerDecisionRecordDraftReviewOutcomeLanes: HostOwnerDecisionRecordDraftReviewOutcomeLane[] = [
+  { key: 'readyForDecisionRecordWriteup', lane: 'DV1', icon: CheckCircle2, tone: 'steady' },
+  { key: 'scopeDraftIncomplete', lane: 'DV2', icon: Radar, tone: 'warn' },
+  { key: 'scanModeAmbiguous', lane: 'DV3', icon: Activity, tone: 'locked' },
+  { key: 'credentialBoundaryIncomplete', lane: 'DV4', icon: Lock, tone: 'locked' },
+  { key: 'maintenanceConstraintsIncomplete', lane: 'DV5', icon: Clock3, tone: 'warn' },
+  { key: 'rollbackOwnerIncomplete', lane: 'DV6', icon: FileWarning, tone: 'warn' },
+  { key: 'runtimeGateStillRequired', lane: 'DV7', icon: ShieldCheck, tone: 'locked' },
+]
+
 const evidenceItems = [
   'iwooos-posture-projection.snapshot.json',
   'security-rollout-policy.snapshot.json',
@@ -1041,6 +1058,38 @@ function HostOwnerDecisionRecordDraftReviewCard({ item }: { item: HostOwnerDecis
   )
 }
 
+function HostOwnerDecisionRecordDraftReviewOutcomeCard({
+  item,
+}: {
+  item: HostOwnerDecisionRecordDraftReviewOutcomeLane
+}) {
+  const t = useTranslations('iwooos.hostOwnerDecisionRecordDraftReviewOutcomes')
+  const Icon = item.icon
+  return (
+    <div style={{ ...band, minHeight: 190, padding: 16 }}>
+      <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'space-between', gap: 12 }}>
+        <div style={{ display: 'flex', alignItems: 'center', gap: 9 }}>
+          <Icon size={18} color={toneColors[item.tone]} />
+          <span style={{ fontSize: 11, color: '#87867f' }}>{t('laneLabel')}</span>
+        </div>
+        <span style={{ fontSize: 11, color: '#9b978b' }}>{item.lane}</span>
+      </div>
+      <h2 style={{ fontSize: 14, margin: '12px 0 6px', color: '#141413' }}>
+        {t(`items.${item.key}.title` as never)}
+      </h2>
+      <p style={{ fontSize: 12, lineHeight: 1.55, color: '#6f6d66', margin: 0 }}>
+        {t(`items.${item.key}.body` as never)}
+      </p>
+      <div style={{ marginTop: 10, display: 'grid', gap: 5 }}>
+        <div style={{ fontSize: 11, color: '#87867f' }}>{t('nextLabel')}</div>
+        <div style={{ fontSize: 11, color: toneColors[item.tone], lineHeight: 1.45 }}>
+          {t(`items.${item.key}.next` as never)}
+        </div>
+      </div>
+    </div>
+  )
+}
+
 export default function IwoooSPage({ params }: { params: { locale: string } }) {
   const t = useTranslations('iwooos')
 
@@ -1393,6 +1442,26 @@ export default function IwoooSPage({ params }: { params: { locale: string } }) {
           </div>
         </section>
 
+        <section style={{ marginBottom: 14 }}>
+          <div style={{ marginBottom: 14 }}>
+            <h2 style={{ fontSize: 16, margin: 0 }}>{t('hostOwnerDecisionRecordDraftReviewOutcomes.title')}</h2>
+            <p style={{ fontSize: 12, color: '#6f6d66', margin: '6px 0 0', lineHeight: 1.55 }}>
+              {t('hostOwnerDecisionRecordDraftReviewOutcomes.subtitle')}
+            </p>
+          </div>
+          <div
+            style={{
+              display: 'grid',
+              gridTemplateColumns: 'repeat(auto-fit, minmax(210px, 1fr))',
+              gap: 12,
+            }}
+          >
+            {hostOwnerDecisionRecordDraftReviewOutcomeLanes.map(item => (
+              <HostOwnerDecisionRecordDraftReviewOutcomeCard key={item.key} item={item} />
+            ))}
+          </div>
+        </section>
+
         <section
           style={{
             display: 'grid',