From f1314e089c11448cae0348d3ebb05f9b2c784f2a Mon Sep 17 00:00:00 2001
From: Your Name <you@example.com>
Date: Thu, 4 Jun 2026 18:59:35 +0800
Subject: [PATCH] docs(security): clarify IwoooS S4.9 intake readiness [skip
 ci]

---
 docs/LOGBOOK.md                               | 30 +++++++++++++++-
 .../GITEA-GITHUB-MIGRATION-INVENTORY.md       |  4 +--
 .../GITEA-GITHUB-MIGRATION-SNAPSHOT.md        |  2 +-
 ...EA-INVENTORY-OWNER-ATTESTATION-RESPONSE.md | 35 ++++++++++++++++++-
 .../SOURCE-CONTROL-MIGRATION-MATRIX.md        |  2 +-
 ...ONTROL-OWNER-RESPONSE-VALIDATION-ROLLUP.md | 14 ++++++++
 .../SOURCE-CONTROL-PRIMARY-READINESS-GATE.md  |  2 +-
 .../security/SOURCE-CONTROL-RECONCILE-PLAN.md |  2 +-
 .../SOURCE-CONTROL-REF-DETAIL-DIFF.md         |  2 +-
 ...SOURCE-CONTROL-REF-TRUTH-CLASSIFICATION.md |  2 +-
 ...itea-github-awoooi-inventory.snapshot.json |  2 +-
 ...y-owner-attestation-response.snapshot.json |  2 +-
 ...ntrol-primary-readiness-gate.snapshot.json |  2 +-
 ...ource-control-reconcile-plan.snapshot.json |  2 +-
 ...urce-control-ref-detail-diff.snapshot.json |  2 +-
 ...rol-ref-truth-classification.snapshot.json |  2 +-
 ...026-06-04-iwooos-security-governance-p0.md | 19 ++++++++--
 17 files changed, 107 insertions(+), 19 deletions(-)

diff --git a/docs/LOGBOOK.md b/docs/LOGBOOK.md
index 935aeeafb..152e619fa 100644
--- a/docs/LOGBOOK.md
+++ b/docs/LOGBOOK.md
@@ -1,9 +1,37 @@
+## 2026-06-04｜IwoooS S4.9 Owner Response Current Intake Readiness
+
+**背景**：接續 P1-1 refs truth current queue 重產後，本段回到 IwoooS 64% 真正能前進的第一優先 gate：S4.9 Gitea owner attestation response。目標是把收件準備度整理到 AwoooP / reviewer 可直接照表收件與預檢，但不把任何準備度誤讀成 request 已送出、owner response 已收到、response 已接受或 runtime / GitHub primary 授權。
+
+**本輪完成**：
+- 先同步 `gitea/main` 到 `64490d32 docs(logbook): record WOOO design rollout smoke [skip ci]`，保留另一個 Session 的 WOOO Open Design deploy / LOGBOOK 更新。
+- 重新刷新 `awoooi` refs 只讀快照到 `64490d32c67d24ed123cbd4e2261c69e17913e38`；Gitea heads `170`、GitHub heads `2`、Gitea tags `2`、GitHub tags `0`，classification 仍為 `194` items。
+- 更新 `GITEA-INVENTORY-OWNER-ATTESTATION-RESPONSE.md`：新增 S4.9 current intake readiness、五題缺口矩陣、合格回覆最小條件與收件結果分流。
+- 更新 `SOURCE-CONTROL-OWNER-RESPONSE-VALIDATION-ROLLUP.md`：把 S4.9 current intake readiness 納入 next collection candidate 的可見說明。
+- 更新 IwoooS P0/P1 主控總帳：新增 `P0-2a S4.9 current intake readiness`，完成度 `100%`，但 S4.9 owner response gate 仍 `0%`。
+
+**完成度更新**：
+- S4.9 current intake readiness：`100%`。
+- S4.9 owner response gate：`0%`，`request_sent=false`、`received=0`、`accepted=0`、`rejected=0`。
+- IwoooS headline 仍 `64%`；framework / read-only evidence 仍 `92%`；runtime landing 仍 `40-45%`。
+
+**驗證**：
+- `python3 -m json.tool`：S4.9 owner attestation response、S4.13 owner response validation rollup、P1 source-control snapshots 皆通過。
+- `git diff --check`：通過。
+- `python3 scripts/security/source-control-owner-response-guard.py --root .`：`SOURCE_CONTROL_OWNER_RESPONSE_GUARD_OK`。
+- `python3 scripts/security/security-mirror-progress-guard.py --root .`：`SECURITY_MIRROR_PROGRESS_GUARD_OK`。
+- Production 頁面檢查：本段只改 docs / snapshot，未改前端、未部署、未宣稱新的 production 狀態；沿用 P0 `/zh-TW/iwooos` desktop / mobile live sanity 作為基準。
+
+**目前邊界**：
+- `owner_response_received_count=0`、`owner_response_accepted_count=0`、`active_runtime_gate_count=0`、`github_primary_ready_count=0`。
+- `runtime_execution_authorized=false`、`github_primary_switch_authorized=false`、`refs_sync_authorized=false`、`repo_creation_authorized=false`、`workflow_modification_authorized=false`、`action_buttons_allowed=false`、`host_update_authorized=false`、`active_scan_authorized=false`。
+- 合格 S4.9 回覆通過後也只能更新 read-only coverage / migration matrix / decision table / readiness wording；不得寫 Gitea、不得建立 GitHub repo、不得同步 refs、不得切 GitHub primary、不得開 runtime gate。
+
 ## 2026-06-04｜IwoooS P1-1 Refs Truth Current Queue 重產
 
 **背景**：上一段 P1 source-control readiness 只讀重盤已確認舊 S4.11 `141` refs review items 落後於 2026-06-04 current refs；本段接續重產 refs detail diff、refs truth classification 與 reconcile plan，並同步修正 primary readiness gate / owner response / migration matrix 的現行判讀。仍維持低摩擦與只讀證據，不切 GitHub primary、不建立 repo、不同步 refs、不修改 workflow、不收 secret value。
 
 **本輪完成**：
-- 以最新 `gitea/main=0df3f1c3` 為只讀文件基準，重跑 `awoooi` Gitea / GitHub refs inventory：Gitea heads `170`、GitHub heads `2`、Gitea tags `2`、GitHub tags `0`，Gitea `main=0df3f1c3524304b44831cc521888b12de124ff11`、GitHub `main=202071f7a8724d5e8c29de441c3f380575a0ea94`，仍為 `blocked`。
+- 以最新 `gitea/main=64490d32` 為只讀文件基準，重跑 `awoooi` Gitea / GitHub refs inventory：Gitea heads `170`、GitHub heads `2`、Gitea tags `2`、GitHub tags `0`，Gitea `main=64490d32c67d24ed123cbd4e2261c69e17913e38`、GitHub `main=202071f7a8724d5e8c29de441c3f380575a0ea94`，仍為 `blocked`。
 - 重產 `source-control-ref-detail-diff.snapshot.json`：3 個 mapped repos 仍 `blocked`；`awoooi` Gitea-only heads `168`、main SHA mismatch `1`、Gitea-only tags `2`。
 - 重產 `source-control-ref-truth-classification.snapshot.json`：current queue 為 `194` items，其中 `manual_truth_required=4`、`deprecated_candidate=142`、`release_tag_review=3`、`github_only_review=20`。
 - 重產 `source-control-reconcile-plan.snapshot.json`：3 個 mapped repos 仍是 `draft_blocked`，Gitea authenticated inventory / owner response / parity / rollback ADR 未完成前不得執行。
diff --git a/docs/security/GITEA-GITHUB-MIGRATION-INVENTORY.md b/docs/security/GITEA-GITHUB-MIGRATION-INVENTORY.md
index e563a46f3..d0d3d269f 100644
--- a/docs/security/GITEA-GITHUB-MIGRATION-INVENTORY.md
+++ b/docs/security/GITEA-GITHUB-MIGRATION-INVENTORY.md
@@ -158,7 +158,7 @@ GitHub target repo-by-repo approval package 已建立於 `docs/security/GITHUB-T
 | 欄位 | Gitea | GitHub | 狀態 |
 |------|-------|--------|------|
 | Repo | `wooo/awoooi` | `owenhytsai/awoooi` | 已有對應 |
-| `main` | `0df3f1c3524304b44831cc521888b12de124ff11` | `202071f7a8724d5e8c29de441c3f380575a0ea94` | 不一致，阻塞主控切換 |
+| `main` | `64490d32c67d24ed123cbd4e2261c69e17913e38` | `202071f7a8724d5e8c29de441c3f380575a0ea94` | 不一致，阻塞主控切換 |
 | `release/v1.0` | `d15fb7d9f4bac86873d5c16b9c17c527b8f38bef` | `d15fb7d9f4bac86873d5c16b9c17c527b8f38bef` | 一致 |
 | `dev` | Gitea-only，仍待 owner 判定 | 無 | GitHub 缺分支 |
 | `drift/adopt-*` | 多條 | 無 | GitHub 缺分支 |
@@ -223,7 +223,7 @@ GitHub target repo-by-repo approval package 已建立於 `docs/security/GITHUB-T
   "branch_count_github": 2,
   "tag_count_gitea": 2,
   "tag_count_github": 0,
-  "latest_sha_gitea": "0df3f1c3524304b44831cc521888b12de124ff11",
+  "latest_sha_gitea": "64490d32c67d24ed123cbd4e2261c69e17913e38",
   "latest_sha_github": "202071f7a8724d5e8c29de441c3f380575a0ea94",
   "workflows_mapped": false,
   "webhooks_mapped": false,
diff --git a/docs/security/GITEA-GITHUB-MIGRATION-SNAPSHOT.md b/docs/security/GITEA-GITHUB-MIGRATION-SNAPSHOT.md
index 2ded310b0..1cb5b92dd 100644
--- a/docs/security/GITEA-GITHUB-MIGRATION-SNAPSHOT.md
+++ b/docs/security/GITEA-GITHUB-MIGRATION-SNAPSHOT.md
@@ -13,7 +13,7 @@
 | GitHub 分支數 | `2` |
 | Gitea tags | `2` |
 | GitHub tags | `0` |
-| Gitea main | `0df3f1c3524304b44831cc521888b12de124ff11` |
+| Gitea main | `64490d32c67d24ed123cbd4e2261c69e17913e38` |
 | GitHub main | `202071f7a8724d5e8c29de441c3f380575a0ea94` |
 | 阻塞原因 | branches 尚未完全對齊；tags 尚未完全對齊；main SHA 不一致 |
 
diff --git a/docs/security/GITEA-INVENTORY-OWNER-ATTESTATION-RESPONSE.md b/docs/security/GITEA-INVENTORY-OWNER-ATTESTATION-RESPONSE.md
index c9dc4c59a..5feb672c8 100644
--- a/docs/security/GITEA-INVENTORY-OWNER-ATTESTATION-RESPONSE.md
+++ b/docs/security/GITEA-INVENTORY-OWNER-ATTESTATION-RESPONSE.md
@@ -2,7 +2,7 @@
 
 | 項目 | 內容 |
 |------|------|
-| 日期 | 2026-05-17 |
+| 日期 | 2026-06-04 |
 | 狀態 | 草案，等待 owner response |
 | 資料契約 | `docs/schemas/gitea_inventory_owner_attestation_response_v1.schema.json` |
 | 快照 | `docs/security/gitea-inventory-owner-attestation-response.snapshot.json` |
@@ -45,6 +45,39 @@ S4.7 已定義要問什麼，S4.8 已把它接到 AwoooP approval lane；S4.9 
 | 授權切換 GitHub primary | `false` |
 | 允許 action button | `false` |
 
+## 1.1 2026-06-04 Current Intake Readiness
+
+本段把 S4.9 從「已經有收件契約」再推進成「目前可直接照表收件與預檢」的狀態。這只代表收件準備度完成，不代表 request 已送出、owner 已回覆、response 已接受或任何執行授權。
+
+| 指標 | 目前值 | 邊界 |
+|------|--------|------|
+| S4.9 收件準備度 | `100%` | 五個 templates、必填欄位、收件檢查、預檢、拒收規則與 outcome lanes 已可用 |
+| S4.9 owner response gate | `0%` | `received_response_count=0`、`accepted_response_count=0`、`rejected_response_count=0` |
+| 下一個收件焦點 | `S4.9 Gitea owner attestation response` | S4.10 / S4.11 / S4.12 仍排隊，不可提前視為 accepted |
+| 可收資料 | owner role / team、decision、decision reason、affected scope、redacted evidence refs、followup owner | 只收脫敏 metadata 或 repo 內文件參照 |
+| 不可收資料 | token、secret、private key、cookie、session、DB dump、git object、repo archive、private URL credential、執行 payload | 疑似敏感值先 quarantine，執行要求 hard reject |
+| 可更新結果 | read-only coverage wording、migration matrix、decision table、readiness blocker | 不寫 Gitea、不建 GitHub repo、不同步 refs、不切 primary、不開 runtime gate |
+
+### 1.1.1 五題缺口矩陣
+
+| 順序 | Template | 目前缺口 | 合格回覆最小條件 | 失敗路由 |
+|------|----------|----------|------------------|----------|
+| 1 | `response-public-only-vs-local-gitea-gap` | `wooo/clawbot-v5`、`wooo/wooo-aiops` 是否屬本輪 scope 尚未由 owner 判定 | 逐 repo 填 owner、decision、reason、affected repos、redacted evidence refs、followup owner | 缺 repo 粒度時 `request_more_evidence`；含 refs / repo 執行要求時 `hard_reject` |
+| 2 | `response-org-user-endpoint-identity` | `wooo` 應以 user、org 或兩者盤點尚未確認 | 指定 canonical namespace 或要求管理者補脫敏 evidence | 把 org 404 當完成時 `request_more_evidence`；要求 write/admin token 時 `hard_reject` |
+| 3 | `response-internal-110-adjacent-scope` | 110 adjacent sources 是否納入本輪 scope 尚未確認 | 逐 source 判定 in-scope / out-of-scope / legacy / external / follow-up | 一句話排除全部時 `request_more_evidence`；要求 fetch / push / delete refs 時 `hard_reject` |
+| 4 | `response-repo-owner-canonical-scope` | in-scope repo owner、canonical source、GitHub target 與 visibility review owner 尚未收齊 | 指定 repo owner、canonical source、GitHub target candidate、visibility review owner 與 evidence refs | 缺 owner 或 canonical 時 `request_more_evidence`；把 target candidate 當 repo creation approval 時 `hard_reject` |
+| 5 | `response-legacy-or-inaccessible-disposition` | legacy、inaccessible、external repo disposition 與後續 owner 尚未收齊 | 指定 disposition、理由、後續 owner 與脫敏 evidence refs | 把 legacy candidate 當刪除 / 封存 approval 時 `hard_reject` |
+
+### 1.1.2 收件結果分流
+
+| Outcome | 何時使用 | 計數影響 |
+|---------|----------|----------|
+| `keep_waiting_owner_response` | 只有 request packet、template status 或空回覆 | received / accepted 維持 0 |
+| `request_more_evidence` | 欄位缺漏、repo/source 粒度不足、evidence refs 不足 | 不增加 accepted |
+| `quarantine_sensitive_payload` | 疑似含 token、secret、private key、cookie、session、未脫敏截圖或 private URL credential | 不保存 raw payload |
+| `reject_execution_request` | 夾帶 repo / refs / workflow / secret / runner / Kali / primary 執行要求 | 不建立 action button、不進 runtime gate |
+| `ready_for_reviewer_validation` | 五題欄位完整、evidence 已脫敏、無執行要求 | 只進 reviewer checklist；仍非 accepted |
+
 ## 2. Owner Response 必填欄位
 
 每筆 response 至少要能回答：
diff --git a/docs/security/SOURCE-CONTROL-MIGRATION-MATRIX.md b/docs/security/SOURCE-CONTROL-MIGRATION-MATRIX.md
index 444c1cffe..2e860b2bb 100644
--- a/docs/security/SOURCE-CONTROL-MIGRATION-MATRIX.md
+++ b/docs/security/SOURCE-CONTROL-MIGRATION-MATRIX.md
@@ -145,7 +145,7 @@ Owner response validation rollup 已建立，S4.13 彙整 S4.9 / S4.10 / S4.11 /
 
 | Repo | Status | Gitea branches | GitHub branches | Gitea tags | GitHub tags | Gitea main | GitHub main | Evidence |
 |------|--------|----------------|-----------------|------------|-------------|------------|-------------|----------|
-| `wooo/awoooi` -> `owenhytsai/awoooi` | `blocked` | `170` | `2` | `2` | `0` | `0df3f1c3524304b44831cc521888b12de124ff11` | `202071f7a8724d5e8c29de441c3f380575a0ea94` | `docs/security/SOURCE-CONTROL-REF-DETAIL-DIFF.md` |
+| `wooo/awoooi` -> `owenhytsai/awoooi` | `blocked` | `170` | `2` | `2` | `0` | `64490d32c67d24ed123cbd4e2261c69e17913e38` | `202071f7a8724d5e8c29de441c3f380575a0ea94` | `docs/security/SOURCE-CONTROL-REF-DETAIL-DIFF.md` |
 | `wooo/clawbot-v5` -> `owenhytsai/clawbot-v5` | `blocked` | `1` | `1` | `1` | `0` | `22074fbe4d6ec6c11c86f76139eea55756d1d160` | `7a769de46450087f9d6a8ef0d2ac23ed15565d2c` | `docs/security/SOURCE-CONTROL-CLAWBOT-V5-SNAPSHOT.md` |
 | `wooo/wooo-aiops` -> `owenhytsai/wooo-aiops` | `blocked` | `2` | `3` | `0` | `19` | `507384a2e1943f4183942bf17d7b52e223067853` | `7c7aa109d93da6d75d687d6ee5131151afee37e8` | `docs/security/SOURCE-CONTROL-WOOO-AIOPS-SNAPSHOT.md` |
 
diff --git a/docs/security/SOURCE-CONTROL-OWNER-RESPONSE-VALIDATION-ROLLUP.md b/docs/security/SOURCE-CONTROL-OWNER-RESPONSE-VALIDATION-ROLLUP.md
index a080e9fb5..01eb4b77e 100644
--- a/docs/security/SOURCE-CONTROL-OWNER-RESPONSE-VALIDATION-ROLLUP.md
+++ b/docs/security/SOURCE-CONTROL-OWNER-RESPONSE-VALIDATION-ROLLUP.md
@@ -111,6 +111,20 @@ S4.13 不新增第 36 個主 contract，不新增 approval item，不啟用 runt
 
 AwoooP 顯示 S4.9 時，應同步讀取 `gitea-inventory-owner-attestation-response.snapshot.json` 的 1 個 owner response request packet、5 個 template statuses、3 個 audit event templates、5 個 redaction examples、8 個 display sections、6 個 collection checks、6 個 intake preflight checks 與 5 個 outcome lanes；request packet 只提示 owner 要填什麼與不得貼什麼，template statuses 只逐項顯示 waiting / request ready，audit event templates 只定義 request shown / response received metadata / outcome classified 的脫敏 metadata 欄位且目前 0 emitted，redaction examples 只提供安全回覆形狀，display sections 只固定只讀 UI 順序，collection checks 只維持 request / received / accepted 狀態分離，preflight / outcome 只分類可審、補證、隔離、拒收或等待，不代表 owner response accepted 或 AwoooP production ingestion 已啟用。
 
+### 2.3.1 2026-06-04 S4.9 Current Intake Readiness
+
+S4.9 目前已具備可直接照表收件與預檢的準備度，但尚未收到任何 owner response。這個狀態應顯示在 AwoooP 操作控制台作為下一個收件焦點，不得變成 approval queue 或 execution queue。
+
+| 項目 | 目前值 | 不得誤讀成 |
+|------|--------|------------|
+| 收件準備度 | `100%` | owner response 已收到 |
+| owner response gate | `0%` | S4.9 已接受 |
+| request sent | `false` | 已正式送件 |
+| received / accepted / rejected | `0 / 0 / 0` | 任一項已完成 |
+| 五題缺口 | public-only/local gap、org/user endpoint、110 adjacent scope、repo owner/canonical、legacy/inaccessible disposition | inventory complete、GitHub primary ready |
+| 合格回覆封套 | owner role / team、decision、decision reason、affected scope、redacted evidence refs、followup owner | 執行授權或資安批准 |
+| 通過後可做 | 只更新 read-only coverage / matrix / readiness wording | 寫 Gitea、建立 repo、sync refs、切 primary、開 runtime gate |
+
 ## 2.4 S4.9 最小回覆封套
 
 S4.9 owner response 收件前，必須具備以下六個欄位。缺任一欄位只能補件，不得增加 received / accepted count。
diff --git a/docs/security/SOURCE-CONTROL-PRIMARY-READINESS-GATE.md b/docs/security/SOURCE-CONTROL-PRIMARY-READINESS-GATE.md
index a29da04b6..eae1a454a 100644
--- a/docs/security/SOURCE-CONTROL-PRIMARY-READINESS-GATE.md
+++ b/docs/security/SOURCE-CONTROL-PRIMARY-READINESS-GATE.md
@@ -28,7 +28,7 @@
 
 | 證據 | 2026-06-04 結果 | Gate 判讀 |
 |------|-----------------|-----------|
-| `awoooi` Gitea / GitHub refs | Gitea heads `170`、GitHub heads `2`、Gitea tags `2`、GitHub tags `0`、main SHA 不一致：`0df3f1c3524304b44831cc521888b12de124ff11` vs `202071f7a8724d5e8c29de441c3f380575a0ea94` | `blocked`；S4.11 current refs truth queue 已重產為 `194` items，但 owner response received / accepted 仍為 0 |
+| `awoooi` Gitea / GitHub refs | Gitea heads `170`、GitHub heads `2`、Gitea tags `2`、GitHub tags `0`、main SHA 不一致：`64490d32c67d24ed123cbd4e2261c69e17913e38` vs `202071f7a8724d5e8c29de441c3f380575a0ea94` | `blocked`；S4.11 current refs truth queue 已重產為 `194` items，但 owner response received / accepted 仍為 0 |
 | Gitea repo inventory | user endpoint public-only 仍只看到 `wooo/awoooi`、`wooo/ewoooc`；org endpoint 仍 blocked / 404 | `blocked`；不得視為所有 Gitea 專案已盤完 |
 | GitHub target probe | 8 個候選中 5 個可讀、3 個 `not_found_or_private`；`nexu-io/open-design` 為 external scope 且 heads 增至 `644` | `pending_review`；可讀性不是 owner approval |
 | Workflow / secret 名稱本機 evidence | 8 個候選、7 個本機可見、4 個 local evidence repo、31 個 workflow files、42 個 unique referenced secret names、`secret_value_detected=false` | `missing_evidence`；仍缺 webhook、runner owner、deploy key、branch protection、repository secret parity |
diff --git a/docs/security/SOURCE-CONTROL-RECONCILE-PLAN.md b/docs/security/SOURCE-CONTROL-RECONCILE-PLAN.md
index baf2a7591..df644faf9 100644
--- a/docs/security/SOURCE-CONTROL-RECONCILE-PLAN.md
+++ b/docs/security/SOURCE-CONTROL-RECONCILE-PLAN.md
@@ -19,7 +19,7 @@
 
 | Repo | Risk | Gitea branches | GitHub branches | Gitea tags | GitHub tags | Gitea main | GitHub main |
 |------|------|----------------|-----------------|------------|-------------|------------|-------------|
-| `wooo/awoooi -> owenhytsai/awoooi` | `HIGH` | `170` | `2` | `2` | `0` | `0df3f1c3` | `202071f7` |
+| `wooo/awoooi -> owenhytsai/awoooi` | `HIGH` | `170` | `2` | `2` | `0` | `64490d32` | `202071f7` |
 | `wooo/clawbot-v5 -> owenhytsai/clawbot-v5` | `MEDIUM` | `1` | `1` | `1` | `0` | `22074fbe` | `7a769de4` |
 | `wooo/wooo-aiops -> owenhytsai/wooo-aiops` | `MEDIUM` | `2` | `3` | `0` | `19` | `507384a2` | `7c7aa109` |
 
diff --git a/docs/security/SOURCE-CONTROL-REF-DETAIL-DIFF.md b/docs/security/SOURCE-CONTROL-REF-DETAIL-DIFF.md
index bb0a1e97c..5d06668ea 100644
--- a/docs/security/SOURCE-CONTROL-REF-DETAIL-DIFF.md
+++ b/docs/security/SOURCE-CONTROL-REF-DETAIL-DIFF.md
@@ -31,7 +31,7 @@
 
 #### Branch SHA 不一致
 
-- `main`：Gitea `0df3f1c3` / GitHub `202071f7`
+- `main`：Gitea `64490d32` / GitHub `202071f7`
 
 #### Branch 只在 Gitea
 
diff --git a/docs/security/SOURCE-CONTROL-REF-TRUTH-CLASSIFICATION.md b/docs/security/SOURCE-CONTROL-REF-TRUTH-CLASSIFICATION.md
index 077e64736..1a2452d75 100644
--- a/docs/security/SOURCE-CONTROL-REF-TRUTH-CLASSIFICATION.md
+++ b/docs/security/SOURCE-CONTROL-REF-TRUTH-CLASSIFICATION.md
@@ -32,7 +32,7 @@
 
 | Ref | Type | Lane | Classification | Gitea | GitHub | 下一步 |
 |-----|------|------|----------------|-------|--------|--------|
-| `main` | `branch` | `main_truth_required` | `manual_truth_required` | `0df3f1c3` | `202071f7` | 先確認目前 production deploy 真相來源、deploy marker、rollback 點，再決定單 repo reconcile。 |
+| `main` | `branch` | `main_truth_required` | `manual_truth_required` | `64490d32` | `202071f7` | 先確認目前 production deploy 真相來源、deploy marker、rollback 點，再決定單 repo reconcile。 |
 | `codex/iwooos-command-map-20260531` | `branch` | `manual_review` | `manual_review` | `c80aae34` | `無` | 確認 ref owner、是否 active、是否需保留到 GitHub 或改列封存。 |
 | `codex/iwooos-decision-runway-20260601` | `branch` | `manual_review` | `manual_review` | `5a56162a` | `無` | 確認 ref owner、是否 active、是否需保留到 GitHub 或改列封存。 |
 | `codex/iwooos-deploy-ledger-20260531` | `branch` | `manual_review` | `manual_review` | `514c201f` | `無` | 確認 ref owner、是否 active、是否需保留到 GitHub 或改列封存。 |
diff --git a/docs/security/gitea-github-awoooi-inventory.snapshot.json b/docs/security/gitea-github-awoooi-inventory.snapshot.json
index f3a6cd930..41e00ce20 100644
--- a/docs/security/gitea-github-awoooi-inventory.snapshot.json
+++ b/docs/security/gitea-github-awoooi-inventory.snapshot.json
@@ -6,7 +6,7 @@
   "branch_count_github": 2,
   "tag_count_gitea": 2,
   "tag_count_github": 0,
-  "latest_sha_gitea": "0df3f1c3524304b44831cc521888b12de124ff11",
+  "latest_sha_gitea": "64490d32c67d24ed123cbd4e2261c69e17913e38",
   "latest_sha_github": "202071f7a8724d5e8c29de441c3f380575a0ea94",
   "workflows_mapped": false,
   "webhooks_mapped": false,
diff --git a/docs/security/gitea-inventory-owner-attestation-response.snapshot.json b/docs/security/gitea-inventory-owner-attestation-response.snapshot.json
index 88051a1d3..3b96ca0b0 100644
--- a/docs/security/gitea-inventory-owner-attestation-response.snapshot.json
+++ b/docs/security/gitea-inventory-owner-attestation-response.snapshot.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "gitea_inventory_owner_attestation_response_v1",
   "status": "draft_waiting_owner_response",
-  "date": "2026-05-17",
+  "date": "2026-06-04",
   "mode": "owner_response_intake_only",
   "runtime_execution_authorized": false,
   "source_contract": "gitea_inventory_coverage_attestation_v1",
diff --git a/docs/security/source-control-primary-readiness-gate.snapshot.json b/docs/security/source-control-primary-readiness-gate.snapshot.json
index 9f6ce429f..0b0a4197a 100644
--- a/docs/security/source-control-primary-readiness-gate.snapshot.json
+++ b/docs/security/source-control-primary-readiness-gate.snapshot.json
@@ -84,7 +84,7 @@
       ],
       "current_gap": [
         "3 個 mapped repos 仍有 refs drift",
-        "2026-06-04 awoooi read-only refresh 顯示 Gitea heads=170、GitHub heads=2、Gitea tags=2、GitHub tags=0、main SHA=0df3f1c3524304b44831cc521888b12de124ff11 vs 202071f7a8724d5e8c29de441c3f380575a0ea94",
+        "2026-06-04 awoooi read-only refresh 顯示 Gitea heads=170、GitHub heads=2、Gitea tags=2、GitHub tags=0、main SHA=64490d32c67d24ed123cbd4e2261c69e17913e38 vs 202071f7a8724d5e8c29de441c3f380575a0ea94",
         "S4.11 current refs truth classification 已重產為 194 個 refs review items；owner response received/accepted 仍為 0",
         "S4.11 已建立 refs truth owner response request packet、template status ledger、audit event templates、redaction examples、collection checks、intake preflight checks 與收件包，但目前 received_response_count=0、accepted_response_count=0、audit_events_emitted=0",
         "不得 push/delete/force push refs"
diff --git a/docs/security/source-control-reconcile-plan.snapshot.json b/docs/security/source-control-reconcile-plan.snapshot.json
index 17afc26c6..353823565 100644
--- a/docs/security/source-control-reconcile-plan.snapshot.json
+++ b/docs/security/source-control-reconcile-plan.snapshot.json
@@ -28,7 +28,7 @@
         "github_branch_count": 2,
         "gitea_tag_count": 2,
         "github_tag_count": 0,
-        "gitea_main_sha": "0df3f1c3524304b44831cc521888b12de124ff11",
+        "gitea_main_sha": "64490d32c67d24ed123cbd4e2261c69e17913e38",
         "github_main_sha": "202071f7a8724d5e8c29de441c3f380575a0ea94",
         "blocking_reason": "branches 尚未完全對齊；tags 尚未完全對齊"
       },
diff --git a/docs/security/source-control-ref-detail-diff.snapshot.json b/docs/security/source-control-ref-detail-diff.snapshot.json
index 7e62ff29c..6b2179f83 100644
--- a/docs/security/source-control-ref-detail-diff.snapshot.json
+++ b/docs/security/source-control-ref-detail-diff.snapshot.json
@@ -702,7 +702,7 @@
         "sha_mismatch": [
           {
             "name": "main",
-            "gitea_sha": "0df3f1c3524304b44831cc521888b12de124ff11",
+            "gitea_sha": "64490d32c67d24ed123cbd4e2261c69e17913e38",
             "github_sha": "202071f7a8724d5e8c29de441c3f380575a0ea94"
           }
         ],
diff --git a/docs/security/source-control-ref-truth-classification.snapshot.json b/docs/security/source-control-ref-truth-classification.snapshot.json
index 8b16992fe..97f0921d2 100644
--- a/docs/security/source-control-ref-truth-classification.snapshot.json
+++ b/docs/security/source-control-ref-truth-classification.snapshot.json
@@ -40,7 +40,7 @@
           "classification": "manual_truth_required",
           "reason": "兩端 main SHA 不一致，這是 GitHub primary / deploy control plane 的硬阻塞。",
           "next_review": "先確認目前 production deploy 真相來源、deploy marker、rollback 點，再決定單 repo reconcile。",
-          "gitea_sha": "0df3f1c3524304b44831cc521888b12de124ff11",
+          "gitea_sha": "64490d32c67d24ed123cbd4e2261c69e17913e38",
           "github_sha": "202071f7a8724d5e8c29de441c3f380575a0ea94",
           "allowed_now": [
             "mirror_classification",
diff --git a/docs/workplans/2026-06-04-iwooos-security-governance-p0.md b/docs/workplans/2026-06-04-iwooos-security-governance-p0.md
index 3de7a326c..46118f484 100644
--- a/docs/workplans/2026-06-04-iwooos-security-governance-p0.md
+++ b/docs/workplans/2026-06-04-iwooos-security-governance-p0.md
@@ -9,7 +9,7 @@
 | 工作視窗 | IwoooS / AWOOOI 資安治理 P0 |
 | 本次乾淨 worktree | `/private/tmp/awoooi-iwooos-governance-p0-20260604` |
 | 本次分支 | `codex/iwooos-governance-p0-20260604` |
-| 最新觀察到的 `gitea/main` | `0df3f1c3 feat(web): bridge WOOO Open Design tokens` |
+| 最新觀察到的 `gitea/main` | `64490d32 docs(logbook): record WOOO design rollout smoke [skip ci]` |
 | 前一個正式 IwoooS 候選基準 | code `7b8fc093`、deploy marker `45c63488`、LOGBOOK `02cadee6` |
 | 最新導航 IA 基準 | code `973fc7a4`、LOGBOOK `2555c811`、deploy marker `0260ec89` |
 | 禁止事項 | 不 force push、不 destructive git、不 SSH 修改主機、不 active scan、不收 secrets 明文、不把 AwoooP approval 當資安批准、不把 UI 可見當 runtime 授權 |
@@ -35,6 +35,7 @@
 | P0-0 | 跨 Session 同步與乾淨 worktree | 100% | 每次改檔前重新 `git fetch gitea` 與檢查 `gitea/main` | `git status --short --branch`、`git log --oneline -8 gitea/main` |
 | P0-1 | IwoooS 狀態總帳 | 100% | 本文件已落地；後續每階段只更新同一總帳與 LOGBOOK | Markdown 檢查、guard、不調高 0 / false gate |
 | P0-2 | S4.9 owner response gate | 100% | 欄位、預檢、收件、驗收、拒收與補件條件已固定成人類可讀規範 | `source-control-owner-response-guard.py --root .` 通過 |
+| P0-2a | S4.9 current intake readiness | 100% | 五題缺口、合格封套、結果分流與只讀更新邊界已補進收件包與 S4.13 rollup；owner response gate 仍 0% | JSON parse、owner response guard、progress guard |
 | P0-3 | AwoooP 同步封包 | 90% | 同步內容已固定；缺後續實際 AwoooP Session readback | 本文件與 mirror checklist readback |
 | P0-4 | production live sanity 節點 | 100% | desktop / mobile / 展開區塊 / overflow / action href 檢查已完成 | Playwright production sanity 通過 |
 | P0-5 | LOGBOOK 與完成度更新 | 90% | LOGBOOK 本輪將同步記錄；Gitea run 需等實際 push 後回填 | `docs/LOGBOOK.md` readback |
@@ -65,6 +66,18 @@ S4.9 是目前 IwoooS 64% 能往前的第一優先 gate。驗收前所有 count
 | 收 secrets 明文 | token、secret、private key、cookie、session、authorization header、runner token、webhook secret 全部拒收或隔離 |
 | 夾帶執行要求 | repo 建立、visibility change、refs sync、workflow 修改、runner 啟用、Kali scan、`/execute`、host update 全部 hard reject |
 
+### 3.3 2026-06-04 Current Intake Readiness
+
+本輪把 S4.9 從「收件規則已定義」推到「AwoooP / reviewer 可直接照表收件與預檢」。這是收件準備度，不是 owner response gate 解鎖；驗收前所有 count 仍必須維持 `0`，所有授權 flag 仍必須維持 `false`。
+
+| 項目 | 完成度 | 目前狀態 | 下一步 |
+|------|--------|----------|--------|
+| 五題缺口矩陣 | 100% | public-only/local gap、org/user endpoint、110 adjacent scope、repo owner/canonical、legacy/inaccessible disposition 已拆成逐題缺口 | 等 owner 以脫敏 metadata 回覆 |
+| 合格回覆封套 | 100% | owner role / team、decision、decision reason、affected scope、redacted evidence refs、followup owner 已固定 | 收件時逐欄預檢 |
+| 結果分流 | 100% | waiting、request_more_evidence、quarantine、hard_reject、ready_for_reviewer_validation 已明確 | 不合格先補件 / 隔離 / 拒收 |
+| S4.9 owner response gate | 0% | request_sent=false、received=0、accepted=0、rejected=0 | 合格回覆前不得調高 |
+| 可更新範圍 | 只讀 | 只允許 coverage / migration matrix / decision table / readiness wording | 不寫 Gitea、不建 repo、不同步 refs、不切 primary |
+
 ## 4. 驗證節點規則
 
 | 階段類型 | 必跑驗證 | 是否需要實際開頁 |
@@ -136,7 +149,7 @@ P1 只讀重盤階段整體完成度：`62%`。它代表 freshness / inventory 
 
 | 分類 | 項目 | 原因 | 本輪處理 |
 |------|------|------|----------|
-| 已不符合現在要求 | `GITEA-GITHUB-MIGRATION-INVENTORY.md` 仍寫 2026-05-12 / 117 heads / 舊 main SHA | 2026-06-04 refresh 顯示 Gitea heads `170`、main SHA `0df3f1c3...` | 已更新為第三版 read-only inventory refresh |
+| 已不符合現在要求 | `GITEA-GITHUB-MIGRATION-INVENTORY.md` 仍寫 2026-05-12 / 117 heads / 舊 main SHA | 2026-06-04 refresh 顯示 Gitea heads `170`、main SHA `64490d32...` | 已更新為第三版 read-only inventory refresh |
 | 已不符合現在要求 | S4.11 `141` refs review items 被當成 current queue | current refs truth queue 已重產為 `194` items | 已改成 current classification；owner response 仍待收 |
 | 已不符合現在要求 | Workflow local evidence 指到舊暫存 worktree | 舊路徑不可重現，會污染 P1 evidence freshness | 已改為本輪乾淨 worktree，並新增 snapshot freshness 規則 |
 | 已不符合現在要求 | `SOURCE-CONTROL-PRIMARY-READINESS-GATE.md` 日期停在 2026-05-17 | Gate 內容未反映最新 refs / GitHub target / workflow evidence | 已新增 2026-06-04 P1 只讀重盤結論 |
@@ -174,7 +187,7 @@ P1 只讀重盤階段整體完成度：`62%`。它代表 freshness / inventory 
 | production mobile `/zh-TW/iwooos` | 展開「前台入口與既有資安頁」後候選卡可見；`horizontalOverflow=false` |
 | action href 檢查 | `/execute`、scan、repo / refs / workflow / secret / primary mutation href 皆為 0 |
 | 截圖 | `/private/tmp/iwooos-governance-p0-prod-desktop-summary-open-20260604.png`、`/private/tmp/iwooos-governance-p0-prod-mobile-summary-open-20260604.png` |
-| P1 `awoooi` refs inventory refresh | Gitea heads `170`、GitHub heads `2`、Gitea tags `2`、GitHub tags `0`，Gitea `main=0df3f1c3...`、GitHub `main=202071f...`，仍 `blocked` |
+| P1 `awoooi` refs inventory refresh | Gitea heads `170`、GitHub heads `2`、Gitea tags `2`、GitHub tags `0`，Gitea `main=64490d32...`、GitHub `main=202071f...`，仍 `blocked` |
 | P1 refs truth classification refresh | current queue `194` items；`manual_truth_required=4`、`deprecated_candidate=142`、`release_tag_review=3`、`github_only_review=20`；S4.11 owner response received / accepted 仍為 0 |
 | P1 Gitea repo inventory refresh | user endpoint public-only 2 repos；org endpoint blocked / 404；仍需只讀 token 或 redacted admin export |
 | P1 GitHub target probe refresh | 8 個候選中 5 個可讀、3 個 `not_found_or_private`；`open-design` heads `644` 僅作 external scope |