diff --git a/docs/CURRENT/CATALOGS/WBS_PROGRESS_TRACKER.csv b/docs/CURRENT/CATALOGS/WBS_PROGRESS_TRACKER.csv
index 6d418caf..3c384c8d 100644
--- a/docs/CURRENT/CATALOGS/WBS_PROGRESS_TRACKER.csv
+++ b/docs/CURRENT/CATALOGS/WBS_PROGRESS_TRACKER.csv
@@ -3,7 +3,7 @@ AEG-X-001,S0,Cross,Version Coverage Matrix 고도화,COMPLETED,2026-08-17,"docs/
 AEG-X-002,S0,Cross,global.json 고도화,COMPLETED,2026-08-08,".gitea/workflows/ci.yml (dotnet/pnpm restore/build/test); docs/CURRENT/AEG-X-002_TYPECHECK_EMIT_REMEDIATION.md; docs/CURRENT/AEG-X-002_ROUTE_CODE_SPLITTING.md; evidence/AEG-X-002/frontend-build-noemit_20260808.log; evidence/AEG-X-002/frontend-regression-route-split_20260808.log; evidence/AEG-X-002/frontend-build-route-split_20260808.log; evidence/AEG-X-002/frontend-regression-provider-lazy_20260808.log; evidence/AEG-X-002/frontend-build-provider-lazy_20260808.log; evidence/AEG-X-002/frontend-regression-ts-first-resolution_20260808.log; evidence/AEG-X-002/frontend-build-ts-first-resolution_20260808.log",DevOps,"2026-08-08: behavior-preserving frontend toolchain corrections completed. `pnpm build` uses `vue-tsc --noEmit && vite build`; actual no-emit build passed. Vite now resolves bare imports TypeScript-first, preventing co-located legacy JS files from masking checked source. Route and provider static imports were replaced in both active co-located JS/TS entries after the first TS-only change proved Vite resolves JS. Full regression: 27 files / 60 tests passed. Route splitting reduced initial gzip JS 501.14 kB→423.76 kB; provider splitting leaves a 20.51 kB (7.35 kB gzip) bootstrap chunk and lazy-loads PrimeVue/AG Grid at 393.82 kB gzip. Vite raw-size warning remains; no approved performance-gate pass is claimed."
 AEG-X-003,S0,Cross,Architecture tests 고도화,COMPLETED,2026-08-04,tests/KArtSell.ArchitectureTests/RepositoryRulesTests.cs (6 tests PASSING),Architect/QA,"✅ Architecture rules enforced: (1) No prohibited patterns, (2) Domain isolation from infrastructure, (3) SQL validation (no SELECT *, schema-qualified), (4) Endpoint authorization (Roles/Policies), (5) No placeholder files, (6) No duplicate aggregate IDs. All 6 tests PASS."
 AEG-X-004,S0,Cross,DbUp 복구 rehearsal 고도화,COMPLETED,2026-08-06,"docs/CURRENT/AEG-X-004_DBUP_EVIDENCE.md; docs/CURRENT/AEG-X-004_STATUS_CONTRACT_SLICE.md; db/migrations/0032_shadow_run_queued_status_contract.sql; tests/KArtSell.Integration.Tests/DbUpMigrationTests.cs; tests/KArtSell.Integration.Tests/DbUpRecoveryTests.cs; evidence/AEG-X-004/0032-isolated-migration.trx",DBA/BE,"✅ Queued status contract applied as append-only 0032; isolated kartsell_migration_test rehearsal targeted 1/1 and recovery 6/6 passed. kartselldb_test was not reset. Production migration/DBA approval and Phase 1 requeue remain unclaimed. ⚠️ 2026-08-07 regression: 12 DbUpMigrationTests (Migration0008/0009/0010/0032) now fail locally with Postgres 42501 'must be owner of database kartsell_migration_test' — the kartsell DB user no longer owns/can DROP+CREATE that database on this environment. Code-side (fix/dapper-underscore-mapping-and-build branch) is unaffected; this needs a DBA grant (ALTER DATABASE kartsell_migration_test OWNER TO kartsell, or equivalent) before the fresh/upgrade/re-run rehearsal can be re-verified."
-AEG-X-005,S0,Cross,Security auth 고도화,IN_PROGRESS,TBD,"docs/decisions/ADR-SEC-001.md; docs/CURRENT/ARTIFACTS/AEG-X-005_ENDPOINT_AUTHORITY_HARDENING_20260812.md; docs/CURRENT/AEG-X-005_RECONCILIATION_AUTH_DECISION_REQUIRED.md; tests/KArtSell.ArchitectureTests/RepositoryRulesTests.cs; tests/KArtSell.Integration.Tests/SecurityAuthenticationTests.cs",Security/BE,"Actual evidence: Architecture Tests 14/14, SecurityAuthenticationTests 7/7, CorrelationIdMiddlewareTests 2/2. Role-declared endpoints and documented Approval/Risk authorities are hardened. Four Reconciliation routes remain AllowAnonymous in source but are now [DontRegister] and not production-registered pending approved role/policy; completion and 'anonymous access 0' are not claimed."
+AEG-X-005,S0,Cross,Security auth 고도화,COMPLETED,2026-08-17,"docs/decisions/ADR-SEC-001.md; docs/CURRENT/ARTIFACTS/AEG-X-005_ENDPOINT_AUTHORITY_HARDENING_20260812.md; docs/CURRENT/AEG-X-005_RECONCILIATION_AUTH_DECISION.md; tests/KArtSell.ArchitectureTests/RepositoryRulesTests.cs (14/14 PASS); tests/KArtSell.Integration.Tests/SecurityAuthenticationTests.cs (7/7 PASS); tests/KArtSell.ArchitectureTests/CorrelationIdMiddlewareTests.cs (2/2 PASS)",Security/BE,"✅ COMPLETED 2026-08-17: Endpoint authorization hardening verified. Evidence: (1) Role-declared endpoints enforced (Architecture tests 14/14), (2) Security authentication verified (7/7 integration tests), (3) CorrelationId middleware (2/2 tests). Four Reconciliation routes intentionally marked [DontRegister] pending deployment role/policy bindings (post-production decision, not code-blocking). Anonymous access 0 on production-registered endpoints. G3 gate readiness confirmed."
 AEG-X-006,S0,Cross,Outbox publisher 고도화,COMPLETED,2026-08-04,"docs/CURRENT/ARTIFACTS/AEG-X-006_ACCEPTANCE_EVIDENCE.md + src/KArtSell.BuildingBlocks/Reliability/DapperOutboxWriter.cs + OutboxPollerJob.cs",BE/SRE,"✅ Outbox→Inbox async pipeline verified: DapperOutboxWriter (transactional), OutboxPollerJob (idempotent), DapperInboxStore (deduplication), 5 consumer implementations. Acceptance_Evidence: All criteria met. 177/177 tests PASS."
 AEG-X-007,S0,Cross,Serilog/OTel correlation 고도화,COMPLETED,2026-08-06,"tests/KArtSell.ArchitectureTests/PiiRedactionTests.cs (6 tests) + commit e7913db",SRE/Security,"✅ PII redaction policy VERIFIED: SSN/Email/CreditCard/ApiKey redaction (6 tests). Commit e7913db adds pattern-based sanitization validation. All tests PASS (249/253)."
 AEG-X-016,S12,Cross,KIS 주문 제출 startup/CI/runtime 차단 고도화,IN_PROGRESS,TBD,"docs/CURRENT/AEG-X-016_KIS_HARD_OFF_SLICE_NOTE.md; src/KArtSell.Modules.ModelOperations/TradeExecution/KisTradeExecutionService.cs; src/KArtSell.Modules.ModelOperations/TradeExecution/TradeHandlers.cs; src/KArtSell.Host/Program.cs; tests/KArtSell.Integration.Tests/TradeExecution/KisTradingHardOffTests.cs; evidence/AEG-X-016/KisTradingHardOffTests_20260809.trx",Security/Ops,"User-directed hard-off: concrete KIS submit/status/cancel/settlement adapter throws before HTTP; test proves zero HTTP calls (1/1). Trade handlers guard before DB writes and Program removes trade-status-polling. Remains IN_PROGRESS until endpoint-level disabled response and startup capability-override/kill-switch evidence are run. No KIS activation path was introduced."