diff --git a/docs/LOGBOOK.md b/docs/LOGBOOK.md
index 1995b4d02..0891880dc 100644
--- a/docs/LOGBOOK.md
+++ b/docs/LOGBOOK.md
@@ -1,3 +1,25 @@
+## 2026-05-17 | 資安供應鏈進度估算與雙 Session 同步更新
+
+**背景**：統帥詢問目前整體資安網進度，並再次批准繼續。此階段不能用 runtime enforcement 開啟數量來誤報進度，因為統帥已明確要求初期不要把資安等級一次拉太高；因此本輪把進度估算寫入既有 `security_mirror_status_rollup_v1`，供 AwoooP 與 Security Supply Chain 兩個 Session 用同一份只讀資料同步。
+
+**完成**：
+- `security_mirror_status_rollup_v1` schema 新增 `progress_estimate` optional 欄位，不新增第 36 個主 contract。
+- `security-mirror-status-rollup.snapshot.json` 補上整體進度 58%、框架期 80-85%、落地期 35-40%。
+- `SECURITY-MIRROR-STATUS-ROLLUP.md` 補上進度判讀，明確說明此百分比不是 runtime authorization。
+- `SECURITY-SUPPLY-CHAIN-PROGRESS.md` 補上 2026-05-17 整體進度估算，保留低摩擦分階段策略。
+- `AWOOOP-SECURITY-SUPPLYCHAIN-INTEGRATION-HANDOFF.md` 補上 AwoooP 立即同步段落，要求另一個 Session 顯示 owner response 缺口、Gitea authenticated inventory partial、GitHub primary ready 0/7、workflow / secret inventory complete 0 與 Kali `/execute` block candidate。
+
+**仍禁止**：
+- 不把進度估算當成 approval、runtime execution、GitHub primary cutover 或 Kali scan authorization。
+- 不新增 scan、execute、repo、refs、workflow、secret、runner 或 deploy 類 action button。
+- 不把 LOW / MEDIUM observation 變成 blocking gate。
+- 不收 token value、secret value、private key、cookie、session 或未脫敏 payload。
+
+**下一步**：
+- AwoooP 主線先只讀 mirror `security_mirror_status_rollup_v1.progress_estimate` 與 S4.9-S4.13 owner response validation 缺口。
+- Security Supply Chain Session 繼續等待 / 驗收 owner responses、Gitea redacted inventory payload、workflow / secret 名稱 parity evidence 與 GitHub rollback ADR owner approval。
+- Kali 112 只維持 observe-only；safe crawl、credentialed scan、runtime ingestion、full-upgrade / reboot 仍需獨立 approval gate。
+
 ## 2026-05-17 | 資安供應鏈 S4.13：Owner Response Validation Rollup
 
 **背景**：S4.9 / S4.10 / S4.11 / S4.12 已分別建立 Gitea、GitHub target、refs truth、workflow / secret name 的 owner response 收件包，但 AwoooP 若要判讀整體缺口，仍需分散讀四包。為了維持低摩擦，本輪不新增第 36 個主 contract、不新增 approval item、不啟用 runtime gate、不新增 action button、不把任何 response 當成 approval；只新增四包 owner response 的只讀驗收彙整。
diff --git a/docs/schemas/security_mirror_status_rollup_v1.schema.json b/docs/schemas/security_mirror_status_rollup_v1.schema.json
index 3f7ae58f0..022fcd82b 100644
--- a/docs/schemas/security_mirror_status_rollup_v1.schema.json
+++ b/docs/schemas/security_mirror_status_rollup_v1.schema.json
@@ -276,6 +276,62 @@
       },
       "additionalProperties": false
     },
+    "progress_estimate": {
+      "type": "object",
+      "description": "跨 Session 進度估算，用於 AwoooP 顯示框架期與落地期的差異；此欄位不代表 runtime approval。",
+      "required": [
+        "overall_percent",
+        "framework_percent_min",
+        "framework_percent_max",
+        "runtime_landing_percent_min",
+        "runtime_landing_percent_max",
+        "basis",
+        "interpretation",
+        "not_authorization"
+      ],
+      "properties": {
+        "overall_percent": {
+          "type": "integer",
+          "minimum": 0,
+          "maximum": 100
+        },
+        "framework_percent_min": {
+          "type": "integer",
+          "minimum": 0,
+          "maximum": 100
+        },
+        "framework_percent_max": {
+          "type": "integer",
+          "minimum": 0,
+          "maximum": 100
+        },
+        "runtime_landing_percent_min": {
+          "type": "integer",
+          "minimum": 0,
+          "maximum": 100
+        },
+        "runtime_landing_percent_max": {
+          "type": "integer",
+          "minimum": 0,
+          "maximum": 100
+        },
+        "basis": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "minItems": 1
+        },
+        "interpretation": {
+          "type": "string"
+        },
+        "not_authorization": {
+          "type": "boolean",
+          "const": true
+        }
+      },
+      "additionalProperties": false
+    },
     "phase_status": {
       "type": "array",
       "minItems": 1,
diff --git a/docs/security/AWOOOP-SECURITY-SUPPLYCHAIN-INTEGRATION-HANDOFF.md b/docs/security/AWOOOP-SECURITY-SUPPLYCHAIN-INTEGRATION-HANDOFF.md
index 57f0bc2a0..3429ce93e 100644
--- a/docs/security/AWOOOP-SECURITY-SUPPLYCHAIN-INTEGRATION-HANDOFF.md
+++ b/docs/security/AWOOOP-SECURITY-SUPPLYCHAIN-INTEGRATION-HANDOFF.md
@@ -24,6 +24,18 @@
 
 統帥補充原則：初期不要把資安等級一次拉太高。AwoooP 初期應先支援 mirror / observe / warn / approval candidate，而不是把所有 findings、repo 狀態或流程差異都變成阻擋條件。
 
+### 0.1 2026-05-17 進度同步
+
+目前跨 Session 共用進度採用 `security_mirror_status_rollup_v1.progress_estimate`：
+
+| 面向 | 目前進度 | AwoooP 判讀 |
+|------|----------|-------------|
+| 整體資安網 | 58% | 框架健康、尚未進入 runtime enforcement |
+| 框架 / 治理 / 文件 / schema / read-only evidence | 80-85% | 可優先建立 read-only mirror 與 Audit evidence |
+| runtime ingestion / owner response / GitHub primary / production landing | 35-40% | 只能顯示缺口與 approval candidate，不得新增執行按鈕 |
+
+AwoooP 目前應同步顯示 S4.9-S4.13 owner response 缺口、Gitea authenticated inventory partial 狀態、GitHub primary ready 0/7、workflow / secret inventory complete 0，以及 Kali `/execute` block candidate。這些狀態只供治理與人工審查，不代表 scan、repo 建立、refs sync、workflow 修改、secret 搬移、runner 啟用或 GitHub primary cutover 已獲授權。
+
 ## 1. Session 分工
 
 ### AwoooP 主線 Session
diff --git a/docs/security/SECURITY-MIRROR-STATUS-ROLLUP.md b/docs/security/SECURITY-MIRROR-STATUS-ROLLUP.md
index d93d5ee4c..6b73aa3f3 100644
--- a/docs/security/SECURITY-MIRROR-STATUS-ROLLUP.md
+++ b/docs/security/SECURITY-MIRROR-STATUS-ROLLUP.md
@@ -19,6 +19,7 @@
 
 | 類型 | 狀態 |
 |------|------|
+| 整體進度估算 | 約 58%；框架 / 治理 / 文件 / schema / read-only evidence 約 80-85%，runtime ingestion / owner response / GitHub primary / AwoooP production landing 約 35-40% |
 | Contract manifest | 35 個 contracts |
 | Mirror readiness | 32 ready、2 partial、1 contract-only、0 blocked |
 | Approval queue | 8 items：7 pending approval、1 block candidate |
@@ -35,6 +36,15 @@
 | Runtime actions | `false` |
 | Payload ingestion | `false` |
 
+## 1.1 進度判讀
+
+目前進度不是以「強制防護開了多少」計算，而是以統帥指定的低摩擦路線拆成兩層：
+
+1. 框架期約 80-85%：35 個主要 contract 已有 32 個 ready、2 個 partial、1 個 contract-only、0 blocked，表示治理骨架、只讀 evidence、人工批准語義與 AwoooP mirror-only 接口已接近完整。
+2. 落地期約 35-40%：owner responses 仍為 0、active runtime gate 為 0、payload ingestion 為 false、GitHub primary ready 為 0、AwoooP production ingestion 尚未啟用。
+
+因此跨 Session 採用 **58%** 作為目前整體進度。這代表「框架健康、尚未過度收緊」，不是 runtime enforcement 或 primary cutover 授權。
+
 ## 2. AwoooP 可做
 
 1. 顯示 S0 到 S4 的階段狀態。
diff --git a/docs/security/SECURITY-SUPPLY-CHAIN-PROGRESS.md b/docs/security/SECURITY-SUPPLY-CHAIN-PROGRESS.md
index 39716bf06..5c3d66224 100644
--- a/docs/security/SECURITY-SUPPLY-CHAIN-PROGRESS.md
+++ b/docs/security/SECURITY-SUPPLY-CHAIN-PROGRESS.md
@@ -9,6 +9,16 @@
 
 ## 0. 本階段完成後整體進度
 
+### 0.1 2026-05-17 整體進度估算
+
+| 進度面向 | 估算 | 判讀 |
+|----------|------|------|
+| 整體資安網 | 58% | 框架與只讀治理已成形，仍等待 owner response、redacted payload、runtime gate 與 GitHub primary readiness |
+| 框架 / 治理 / 文件 / schema / read-only evidence | 80-85% | 35 個主要 contract 中 32 ready、2 partial、1 contract-only、0 blocked |
+| 真正落地執行 / runtime ingestion / GitHub primary / AwoooP production landing | 35-40% | owner response 仍 0、active runtime gate 仍 0、payload ingestion=false、github_primary_ready_count=0 |
+
+這個進度估算用於雙 Session 同步與階段判讀，不是 approval、runtime execution、GitHub primary cutover 或 Kali scan authorization。現階段仍維持統帥要求的低摩擦策略：先建完整框架與 evidence，之後再分階段收斂。
+
 | 階段 | 狀態 | 目前結果 | 下一個 gate |
 |------|------|----------|-------------|
 | S0 文件與契約同步 | 完成 | Kali / Codex / GitHub / Gitea / AwoooP 邊界已文件化，核心 schema 草案已建立 | AwoooP 只讀 mirror 消費 |
diff --git a/docs/security/security-mirror-status-rollup.snapshot.json b/docs/security/security-mirror-status-rollup.snapshot.json
index fc3e042ab..d7a8fc6b5 100644
--- a/docs/security/security-mirror-status-rollup.snapshot.json
+++ b/docs/security/security-mirror-status-rollup.snapshot.json
@@ -101,6 +101,20 @@
     "runtime_actions_executed": false,
     "payloads_ingested": false
   },
+  "progress_estimate": {
+    "overall_percent": 58,
+    "framework_percent_min": 80,
+    "framework_percent_max": 85,
+    "runtime_landing_percent_min": 35,
+    "runtime_landing_percent_max": 40,
+    "basis": [
+      "35 個主要 contract 中 32 個 ready、2 個 partial、1 個 contract-only、0 個 blocked。",
+      "S0/S2/S3/S4 多數治理、鏡像、人工批准與 source-control readiness 契約已完成草案。",
+      "owner responses、redacted payload ingestion、active runtime gate、GitHub primary readiness 與 AwoooP production ingestion 仍未完成或尚未批准。"
+    ],
+    "interpretation": "目前處於健康的框架期後段；骨架接近完成，但仍刻意維持低摩擦，不把 read-only evidence 誤升級成 runtime enforcement。",
+    "not_authorization": true
+  },
   "phase_status": [
     {
       "phase_id": "S0_contracts_and_boundaries",