[CLAUDE] Docs: Chunk G — K8 Plan K wrap S23 t1: docs + session log + Designer comment cleanup + 3 agent MEMORY drift

Plan K Mig 31 F2 refactor sang per-Approver-slot DONE — 8 commits cumulative
S23 t1 (`56868bf..<this>`). K8 wrap docs + dirty MEMORY.md commit:

Docs updates:
- docs/STATUS.md: Last updated S23 t1 entry với Plan K summary 8 chunk
- docs/HANDOFF.md: TL;DR S23 t1 đầy đủ (top) — multi-agent ROI evidence
- docs/database/schema-diagram.md §14: title Mig 22-31 (was 22-29) + add
  Mig 30 F4 + Mig 31 F2 blocks per slot Approver + DROP Users column note
- NEW docs/changelog/sessions/2026-05-14-s23-turn1-plan-k-mig31-f2-refactor.md
  session log đầy đủ 8 chunk timeline + multi-agent spawn cost table + pattern
  reinforced 3×

FE Admin Designer comment cleanup (Reviewer K2 follow-up):
- ApprovalWorkflowsV2Page.tsx lines 73-75 + 502-504: 2 stale narratives "F2
  AllowDrafterSkipToFinal xuống per User (User Management)" rewrite Mig 29+30+31
  cumulative narrative "7 Allow* ALL xuống per Level slot, pattern proven 3×"

3 agent MEMORY.md drift commit (dirty từ session start S23 + S22 chốt):
- Investigator: K0 pre-flight findings + 5 surprises catch
- Reviewer: K2 PASS report + new pattern "transient sentinel zombie" anti-pattern
- CICD Monitor: S22 chốt verify cumulative (Run #193 + S23 t1 pending K9 spawn)

User-level memory updates (cross-project diary persisted ngoài repo):
- feedback_per_nv_permission_scope.md: reinforcement S23 t1 — Pattern 3×
  cumulative (Mig 29 + Mig 30 + Mig 31). Pattern ALSO applies cho refactor existing
  scope, KHÔNG chỉ greenfield. Cross-ref discoveries Plan K (compile-break workaround,
  stale narrative drift, transient sentinel zombie anti-pattern caught Reviewer).
- MEMORY.md index: cumulative reinforcement note 3× Mig 31

Verify:
- dotnet build production projects clean
- npm run build fe-admin pass 17.76s, 0 TS err
- Test 104/104 PASS (S23 t1 K7 chunk maintained baseline)

Plan K state final: 31 mig · 59 tables · ~145 endpoints · 104 test · 47 gotcha
· 20 memory · 6 skills · 4 sub-agents active. CHƯA push remote — chờ bro confirm
K9 spawn CICD Monitor.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.claude/agent-memory/cicd-monitor/MEMORY.md

@@ -104,7 +104,7 @@ Read-only CI/CD pipeline + post-deploy verifier for SOLUTION_ERP. Polls Gitea Ac
 - **Prod URLs:** api / admin / eoffice `.solutions.com.vn`
 - **SSH VPS:** `ssh vietreport-vps` (user=Administrator, key=id_ed25519)
 - **DB prod:** `.\SQLEXPRESS` / `SolutionErp` / vrapp user
-- **Tests baseline:** 104/104 (58 Domain + 46 Infra = 23 codegen + 6 PE WF + 3 PE Guard S21 t3 + 7 ReturnMode + 7 DraftGuard + 5 AuthorizePolicy + 1 V2 actor scope reject) — S22+1 +1 test
+- **Tests baseline:** 104/104 (58 Domain + 46 Infra = 23 codegen + 6 PE WF + 3 PE Guard S21 t3 + 7 ReturnMode + 7 DraftGuard + 5 AuthorizePolicy + 1 V2 actor scope reject) — S22+1 +1 test. Re-verified S22 chốt cuối 23:25 (Verify push range `3d725c4..cc8a7d3`).
 - **Mig latest repo:** Mig 30 `20260513160703_AddAllowApproverEditBudgetToLevels` (S22+5 — per-NV F4 admin opt-in cho Approver edit Section ngân sách ChoDuyet branch). Prev Mig 29 (S21 t5 refactor per-NV) preserved.
 - **Gitea Actions API path:** `/api/v1/repos/{owner}/{repo}/actions/tasks?limit=N` (NOT `/runs` — returns 404). Public no-auth read OK. Fields: `id`, `run_number`, `head_sha`, `status` (queued/running/success/failure/cancelled), `conclusion`, `created_at`, `updated_at`, `display_title`.
 - **Mig latest prod:** sqlcmd `__EFMigrationsHistory ORDER BY MigrationId DESC TOP 5`
@@ -139,6 +139,8 @@ Flag commit nếu thấy `<PackageReference Include="MediatR" Version="14...` ho
 
 ## 📅 Recent runs (FIFO last 20)
 
+- **2026-05-13 23:25 — Verify S22 chốt cuối cumulative (push range `3d725c4..cc8a7d3` 12 commits) VERDICT=PASS** (S22 chốt — em main spawn cumulative verify cuối S22). Latest CI run #193 id=307 sha=`b04a11a` (S22+5 Chunk B FE) success at 23:16. **Tip commit `cc8a7d3` (docs+4 agent MEMORY.md) → CI SKIPPED via `**/*.md` glob** (all 4 `.claude/agent-memory/*.md` + 4 `docs/**` files match — paths-ignore correctly fires). Spec hypothesis ("gotcha #47 — `.claude/agent-memory/**` NOT in paths-ignore → trigger CI") **disproven for this commit**: `**/*.md` glob matches `.md` files at ANY depth so `.claude/agent-memory/MEMORY.md` DOES match. Run #188 a74e671 trigger anomaly was NOT due to agent-memory path. **Gotcha #47 still useful as PREVENTIVE** for future when adding non-.md state files under `.claude/agent-memory/` (e.g. `.json` state, `.log`) — explicit `'.claude/agent-memory/**'` ignore would future-proof. **Recent runs S22 sequence (12 commits → 11 trigger + 1 skip):** #189 sha=40f64c6 ✓ (S22+1 BE guard) · #190 sha=8185070 **CANCELLED** by concurrency (seed users script superseded by next push within 3 min — normal not a fail) · #191 sha=0e70789 ✓ (rename script) · #192 sha=30d51c8 ✓ (S22+4 FE) · #193 sha=b04a11a ✓ (S22+5 FE — also covers S22+5 Chunk A BE `b079b27` since both pushed batched; Gitea trigger only on push tip). `cc8a7d3` skip = correct (no run 308). **Discovery #3:** When 2+ commits pushed in same `git push`, Gitea Actions evaluates ONLY the push tip's paths against paths-ignore — intermediate commits do NOT each get evaluated separately. So `b079b27` (BE Mig 30) + `b04a11a` (FE Mig 30) pushed together → single Run #193 on tip. Test gate inferred PASS for all 11 trigger runs (each deploy stage succeeded). **Local test verify 104/104 PASS** (58 Domain + 46 Infra = +1 vs Run #188's 103 — S22+1 added 1 BE guard test). **Mig 30 prod confirmed:** sqlcmd TOP 5 = `20260513160703_AddAllowApproverEditBudgetToLevels` TOP 1 (S22+5 wire). **Schema live verify:** PE detail `currentLevelOptions` 6 keys (5 from Mig 29 + 1 new `allowApproverEditBudget`) ✓, AwLevelDto 12 keys including `allowApproverEditBudget` ✓. **Endpoint wire LIVE:** PATCH `/api/users/{id}/allow-skip-final` admin=204 ✓ + act.nv=403 ✓ (Plan D admin-only enforce) · PATCH `/api/purchase-evaluations/{id}/budget-adjust` admin=204 ✓ (S22+4 BE) · GET `/api/purchase-evaluations/{id}/attachments/{attId}/view` 200 + `Content-Disposition: inline; filename="HD- Eoffice.pdf"` ✓ (S22+4 preview). **Plan E strict V2 scope LIVE:** admin pageSize=200 → 17 PE / act.nv pageSize=200 → 0 PE (Drafter strict filter active; act.nv fresh user no PE participation). **Bundle hash rotated 2/2:** admin `Cclc8Uwu` → `CpI5OL8n` ✓ (S22 cumulative FE deploy) / user `B6N5hq3d` → `d064StNa` ✓ (S22+4 + S22+5 touched fe-user — rotation expected). Smoke 5/5 endpoints 200: contracts, pe, users, menus, approval-workflows-v2. **33 active users prod confirmed** (20 role-based new from S22+2 seed + S22+3 rename: act/pp/tp · bod.1/2 · equ/fin/hra/pm/qs nv/pp/tp + 13 pre-existing). All role-based users `isActive=true` + login `act.nv@solutions.com.vn / TestUser@2026` OK with roles `Drafter,Accounting`. **Token caching pattern from Run #188 worked:** 1 admin login + 1 act.nv login total = 2 auth requests cached to `C:\Users\pqhuy\AppData\Local\Temp\*_token.txt` + 8 subsequent endpoint calls reuse token → no 429 rate limit encountered (vs Run #188 hit 429). **Trend:** S22 cumulative 5 turn iteration delivered Mig 30 + 3 new endpoints + scope filter + 20 seed users — 0 deploy regression. Baseline cumulative passes 81→103→104 test grow consistent with feature delivery.
+
 - **2026-05-13 21:25-21:28 — Run #188 id=302 sha=a74e671 VERDICT=PASS** (S22 — 5 commits: Plan D Users F2 toggle BE+FE Admin AllowDrafterSkipToFinal + Plan C task 1-3 14 service test ReturnMode/Guard + Plan C task 4 5 regression test #44 silent 403 + Plan E PE strict V2 scope + Docs/MEMORY 3-agent drift patch). Duration 3m28s (baseline). Path filter: the push tip `a74e671` includes `.claude/agent-memory/**` files (NOT in paths-ignore) + `docs/**` (in paths-ignore) → Gitea evaluated push as CI-eligible (some files OUTSIDE paths-ignore), trigger fired correctly. **Local test verify: 58 Domain + 45 Infra = 103/103 PASS (+19 from S21 84)** breakdown: 23 codegen + 6 PE WF + 7 ReturnMode + 7 DraftGuard + 5 AuthorizePolicy regression. CI deploy succeeded → inferred test gate PASS (deploy only runs if tests pass). Bundles deployed: admin `index-Cclc8Uwu.js` rotated from `D5l49-70` (21:27:24 PM VPS), user `index-B6N5hq3d.js` UNCHANGED (Plan C/D/E touched only fe-admin, expected). DLLs deployed 21:25-26 PM. Mig 29 `RefactorAdvancedOptionsToPerLevelAndDrafterUser` still TOP 1 (no new mig in S22, expected). **Plan D wire LIVE:** GET `/api/users` response includes `allowDrafterSkipToFinal` field (boolean), PATCH `/api/users/{id}/allow-skip-final` admin=204 ✓ + nv.test=403 ✓ (admin-only enforced). **Plan E wire LIVE:** nv.test PE list totalCount=8 < admin totalCount=17 (strict V2 scope filter ACTIVE — drafter only sees own + participant PE). Smoke 5/5 endpoints 200: `/api/contracts`, `/api/purchase-evaluations`, `/api/menus`, `/api/approval-workflows-v2`, `/api/users`. **Discovery #1:** Rate limit auth login triggers at ~5 requests/min — HTTP 429. Pattern: backoff 60s + retry. Spread login calls or cache token across endpoints in same agent run. **Discovery #2:** `.claude/agent-memory/**` files are NOT in paths-ignore (only `docs/**` + `**/*.md` + `.claude/skills/**` + `.gitignore` + `scripts/**.md`) → MEMORY.md commits DO trigger CI even when "looks like docs". Spec assumption ("docs commit `a74e671` triggers paths-ignore skip per gotcha #41") was incorrect for this case — `.claude/agent-memory/**` triggers CI.
 
 - **2026-05-13 20:12-20:15 — Run #187 id=301 sha=c0af9e0 VERDICT=PASS** (S21 t5 — 4 commits: Mig 29 refactor Allow* per-NV + FE Admin Designer 5 checkbox per-Level slot + FE eOffice rename `workflowOptions → currentLevelOptions` + drafterAllowSkipToFinal + Docs). Duration ~3m18s (baseline). Test gate inferred PASS (deploy stage chỉ chạy sau test gate). Mig 29 applied prod (TOP 1 in __EFMigrationsHistory). Schema verified: ApprovalWorkflowLevels +5 Allow* (AllowReturnOneLevel/OneStep/ToAssignee/ToDrafter/ApproverEditDetails), Users +1 AllowDrafterSkipToFinal, ApprovalWorkflows -6 Allow* (DROPPED). Backfill: 48/48 Levels.AllowReturnToDrafter=1 (default + S21 t4 workflow.AllowReturnToDrafter=true copied đúng), 0/13 Users.AllowDrafterSkipToFinal=1 (S21 t4 workflow.AllowDrafterSkipToFinal=false → 0 user backfill — preserve correct). Bundles deployed 20:14-20:15 (admin `index-D5l49-70.js` was `CzesdXLh`, user `index-B6N5hq3d.js` was `DP-gH4LW` — both rotated ✓). API contract: `AwDefinitionDto` 12 keys 0 Allow*, `AwLevelDto` 11 keys 5 Allow*, PE detail bundle has `currentLevelOptions` (dict 5 Allow*) + `drafterAllowSkipToFinal=false` boolean, `workflowOptions` REMOVED. **Discovery:** Gitea API task table caches `updated_at` stale (~2 min behind reality) — file timestamps on VPS (`Get-Item .dll/.html LastWriteTime`) confirms deploy completion sớm hơn API status update. Cross-check 2 source nếu time-sensitive. Also: `appsettings.Production.json` ở `C:\inetpub\solution-erp\api\` chứa connection string credential (user=vrapp / pwd=`buKL3TGBkD0wDDbYVw65QeX9`) khi `$env:PROD_DB_PASSWORD` empty local.
@@ -155,4 +157,4 @@ Flag commit nếu thấy `<PackageReference Include="MediatR" Version="14...` ho
 - Duplicate failure patterns → merge into single entry (vd act_runner timeout x3 → 1 entry)
 - Stale > 3 months → remove
 
-Last curate: 2026-05-13 (added run #188 S22 Plan C+D+E + test baseline 103 + 2 discoveries: auth rate limit 429 backoff + `.claude/agent-memory/**` NOT in paths-ignore)
+Last curate: 2026-05-13 23:30 (added S22 chốt cuối cumulative verify Run #189-193 sequence + Mig 30 schema live + 3 new endpoint wire + 33 user role-based + bundle rotate 2/2 + test baseline 104 + Discovery #3 Gitea push tip paths-ignore eval. Disproven spec hypothesis re: gotcha #47 `.claude/agent-memory/**` trigger — `**/*.md` glob already catches `.md` files at any depth. Gotcha #47 kept as preventive for non-.md future state files.)

.claude/agent-memory/investigator/MEMORY.md

@@ -128,6 +128,7 @@ State machine 5 trạng thái phiếu PE: Nháp / Đã gửi duyệt / **Trả l
 
 ## 📅 Recent activity (last 10 FIFO)
 
+- **2026-05-14 (S23 t1 spawn K0 — Plan K F2 refactor pre-flight):** Audit F2 state cho Plan K Mig 31 (move `Users.AllowDrafterSkipToFinal` → `ApprovalWorkflowLevels.AllowApproverSkipToFinal` + change semantic Drafter Nháp → Approver ChoDuyet skip thẳng Cấp cuối). **Confirmed state Mig 30:** Migrations path = `Persistence/Migrations/` (not direct `Migrations`); 30 mig latest = `20260513160703_AddAllowApproverEditBudgetToLevels`; `User.cs:38` AllowDrafterSkipToFinal prop; `ApprovalWorkflow.cs:86-105` 6 Allow* props (4 ReturnMode + EditDetails + EditBudget) per Level slot; F2 Drafter branch ở `PurchaseEvaluationWorkflowService.cs:119-161` trong SUBMIT branch (line 125 `if (skipToFinal && evaluation.ApprovalWorkflowId is Guid skipAwId)` check user.AllowDrafterSkipToFinal); APPROVE STEP branch ở `~line 393-525` (advance pointer). TransitionAsync signature: `skipToFinal` là param thứ 8 (position 47:47), default=false. `TransitionPurchaseEvaluationCommand` ở `PurchaseEvaluationFeatures.cs:393-402` với param `SkipToFinal=false` default. `ApprovalWorkflowOptionsDto` ở `PurchaseEvaluationDtos.cs:86-92` (6 field). `PurchaseEvaluationDetailBundleDto.DrafterAllowSkipToFinal` ở line 217 + `CurrentLevelOptions` ở line 214. UsersController `PATCH /users/{id}/allow-skip-final` ở line 91-98 + `SetAllowDrafterSkipToFinalBody` ở line 105. `SetUserAllowDrafterSkipToFinalCommand` ở `UserFeatures.cs:332`. **FE state:** fe-admin Designer `system/ApprovalWorkflowsV2Page.tsx` slot label "NV #{ei + 1}" ở line 873 (KHÔNG phải "#NV {order}" theo prompt) — inline checkbox panel 5+1=6 checkbox ở line 853-933 (4 ReturnMode + EditDetails + EditBudget). fe-admin `system/UsersPage.tsx` "Skip cuối" column line 306-318 + FastForward button toggle line 365-372 + allowSkipMut hook line 181-186. fe-admin/fe-user PeDetailTabs Drafter Workspace checkbox "Gửi thẳng Cấp cuối (skip trung gian)" ở line 287-297 (admin) / 294-304 (user). **GAP fe-user**: KHÔNG có UsersPage + ApprovalWorkflowsV2Page (admin-only mgmt) → Plan K UI changes localized fe-admin chỉ; fe-user side chỉ touch PeDetailTabs (remove old Drafter checkbox + thêm Approver toggle near Duyệt button). **Drift Dev DB**: Total=2 user (admin + test.drafter), Flagged=0 — NOT match 33-user prod seed. **Prod actual**: Total=33 / Flagged=4 (NOT 2 per S22+2 spec). 4 user flagged sẽ lose value when DROP column — acceptable per new semantic (Drafter pre-submit moot).
 - **2026-05-13 (S22, no spawn — em main solo throughout):** S22 18:00→~21:00 em main solo. Cumulative state: 30 mig (+1 Mig 30 `AddAllowApproverEditBudgetToLevels` F4 per-Level slot), 104 test PASS (+20: 5 reg #44 Authorize policy + 7 ReturnMode + 7 Guard + 1 V2 actor scope reject), ~146 endpoints (+3: PATCH /users/{id}/allow-skip-final + PATCH /pe/{id}/budget-adjust + GET /pe/{id}/attachments/{attId}/view), 46 gotcha unchanged, 19 memory unchanged (recommend +1 entry — see below). Prod active users 13→33 (+20 role-based: act.nv/pp/tp, bod.1/2, equ/fin/hra/pm/qs.nv/pp/tp). **Discoveries S22:** (1) **Per-NV admin opt-in flag pattern reinforced 2×** — Mig 30 F4 cùng pattern Mig 29 F1+F3 (S21 t5). Bro corrected em main lần đầu: "phải tick checkbox như Section 2", default = admin opt-in per slot, KHÔNG = mở rộng default. Cross-ref memory `feedback_per_nv_permission_scope.md` proven 2×. (2) **Plan F drop V1 ABORTED** — pre-flight sqlcmd reveal Contract entity HOÀN TOÀN V1 chưa wire V2 (chưa có ApprovalWorkflowId column) + 4 PE V1-only + 19 PE V1+V2 mix. Lesson: drop migration cần verify entity scope toàn bộ (Contract liên đới — không chỉ PE). (3) **Identity password policy ≥12 chars** — seed 20 user FAIL 400 với "User@123456" (11 chars), `TestUser@2026` (13 chars) pass. (4) **Identity rename atomic 4 fields** confirm gotcha #38: Email + NormalizedEmail + UserName + NormalizedUserName + FullName; sqlcmd cần `SET QUOTED_IDENTIFIER ON` cho filtered unique index. (5) **API login response field name `accessToken` + `refreshToken` + `user`** — KHÔNG có field `token` (correct prior Bash example trong spec dùng `.token` sẽ fail). (6) **PS 5.1 ASCII-only script discipline** reinforced gotcha #30: `seed-test-users-prod.ps1` viết Vietnamese names without diacritics tránh parser error. Recommend bro add 1 memory entry "Admin opt-in flag pattern proven 2×" cumulative Mig 29 + Mig 30.
 - **2026-05-13 (S21 t3-t5, no spawn):** Em main solo 3 turns (bug fix gotcha #45 + F1+F2+F3 workflow-level Mig 28 + refactor per-NV Mig 29). Implementer REFUSE per cross-stack reasoning chain rule. Investigator KHÔNG spawn — em main đã có context cumulative S20 t12 setup + active dev throughout. No findings to flush. Cumulative state update: 84 test, 29 mig, 45 gotcha, 19 memory entries (+2 S21 t5 pending), 6 skills unchanged. Pattern reusable saved cho future spawn: per-NV permission scope split + EF migration ADD→BACKFILL→DROP reorder.
 - **2026-05-11 (setup):** Investigator agent initialized. Baseline knowledge load complete (44 gotchas + 14 memory entries + 6 skills + 27 mig + 81 test pass cumulative). No investigations performed yet. Awaiting first SendMessage from em main.

.claude/agent-memory/reviewer/MEMORY.md

@@ -144,6 +144,7 @@ Flag commit nếu thấy `<PackageReference Include="MediatR" Version="14...` ho
 
 ## 📅 Recent activity (last 10 FIFO)
 
+- **2026-05-14 (S23 t1 Plan K1+K2 cumulative review, spawn):** Pre-K3 adversarial verify Mig 31 schema swap + Service Approver F2 branch. Diff scope: 11 BE files +4093/-83 LOC (Mig Designer 3938 lines dominate). 3 commits chuỗi `eb106f2..56868bf..db66253..364aef6` — pre-A slot label refactor + K1 Domain/Mig/Snapshot/sentinel patches + K2 DTO+Service Approver branch. **Verdict: PASS với 2 Major + 2 Minor issues** — K3 OK proceed nhưng K5 endpoint cleanup nên ưu tiên trước K7 test fix. Wire claim verify: Approver F2 branch placed ĐÚNG vị trí (line 477 AFTER UPSERT opinion line 441-468 + BEFORE advance pointer line 502) — opinion sẽ ghi trước skip terminal, audit log đầy đủ context Bước/Cấp. ApproveV1LegacyAsync skipToFinal guard tại CALLER (line 147-149 trong TransitionAsync branch) thay vì callee — pattern OK, V1 method giữ nguyên signature legacy. Schema sqlcmd verify Dev: 7 Allow* columns ApprovalWorkflowLevels (AllowApproverEditBudget/EditDetails/SkipToFinal/ReturnOneLevel/OneStep/ToAssignee/ToDrafter) + Users.AllowDrafterSkipToFinal dropped (count=0). Snapshot regen clean. EF config HasDefaultValue(false) wire. Mig 31 Up() manual reorder ADD→DROP correct per memory `feedback_ef_migration_backfill_reorder`. **Major issues caught** (Smart Friend guard active — KHÔNG để pass): (1) **Orphan UsersController endpoint zombie** — K1 sentinel commented "K2 sẽ refactor DTO + drop field" nhưng K2 chỉ refactor PE side, KHÔNG động UsersController.SetAllowDrafterSkipToFinal + UserFeatures.SetUserAllowDrafterSkipToFinalCommand + UserDto field. Endpoint PATCH `/api/users/{id}/allow-skip-final` vẫn live nhưng silent NoOp (Task.CompletedTask), admin UI tick → BE swallow → confusion UX. Cần K5 endpoint cleanup chunk (per spec). (2) **Stale Mig 28 comment ApprovalWorkflow.cs:78** — comment cũ "F2 (Drafter skip) đã move sang Users.AllowDrafterSkipToFinal" còn nguyên dù line 107-113 prop AllowApproverSkipToFinal mới. Confuse future dev. **Minor issues:** (3) Comment TransitionPurchaseEvaluationCommand DTO PurchaseEvaluationFeatures.cs:401 "F2 — Drafter skip thẳng Cấp cuối khi trình duyệt" still says Drafter (semantic outdated). (4) ApprovalWorkflowConfiguration.cs:22 stale Mig 28/29 narrative comment chưa note Mig 31. Anti-fiddle audit PASS: K1 18 LOC UserFeatures.cs sentinel patches valid compile-break workaround, K2 4 files within original spec. Anti-pattern reinforced 3×: admin opt-in per slot per-NV (Mig 29 F1+F3 + Mig 30 F4 + Mig 31 F2 — em main lần đầu sai Mig 30 default scope expansion → bro corrected). Production build PASS 0 err 2 warn (DocxRenderer unrelated). Test references K7-pending line 253. No `--no-verify` bypass. Pattern caught: "Transient sentinel pattern" — đặt sentinel + comment commit chunk khác cleanup nhưng chunk đó scope SHIFT → zombie state. Recommend explicit K5 cleanup chunk trước K7 test fix. Cumulative state: 31 mig (+1 Mig 31), 47 gotcha unchanged. Smart Friend guard active.
 - **2026-05-13 (S22 18:00→21:00, no spawn):** Em main solo self-review S22 — Reviewer KHÔNG spawn per UAT mode `feedback_uat_skip_verify`. Em main verify build clean + test pass + npm build × 2 app mỗi chunk (11 commits cumulative). Key validations: (1) Plan E phân quyền strict V2 — actor.UserId scope in List + Detail, Inbox đã strict từ S17, loose UAT clause `|| ApprovalWorkflowId != null` removed. (2) S22+1 V2 actor scope guard BE helper `EnsureCanRejectV2Async` chặn request forge non-approver PATCH /transitions decision=Reject (mirror FE button disable) — defense-in-depth FE+BE pattern. (3) S22+4 AdjustBudgetCommand handler 3-tier scope (Drafter Nháp/Trả lại + Approver ChoDuyet + Admin) — S22+5 refactor ChoDuyet branch dùng `level.AllowApproverEditBudget` flag (admin opt-in per slot) thay default Approver scope (security scope correction per bro feedback). (4) S22+2 Identity password policy enforced ≥12 chars (reject `User@123456` 11 chars outdated). Anti-patterns observed: (a) Default scope expansion mistake S22+4 → S22+5 fix — KHÔNG default expand permission scope without admin tick (per-NV opt-in pattern Mig 29 lesson reinforced); (b) History display field assumption BudgetAdjustSection initial — em assume `PeDetailBundle.changelogs` exists, FAIL TS2339 — pattern verify type fields trước render; (c) PS 5.1 Vietnamese diacritics gotcha #30 reinforced — script `seed-test-users-prod.ps1` first attempt FAIL parser error, ASCII-only discipline. S22+4 attachment view endpoint + S22+4 budget-adjust endpoint chưa qua live curl verify (defer post-deploy — bro UAT direct). S22+5 Mig 30 applied LocalDB Dev + Design via `dotnet ef database update`. New gotcha discovered: #47 paths-ignore agent-memory gap (recommend add to docs/gotchas.md — pending bro decide). Cumulative state: 104 test (+20), 30 mig (+1 Mig 30), 46 gotcha unchanged (gotcha #47 pending), ~146 endpoints (+3), 33 active users. Smart Friend guard still active for future spawn.
 - **2026-05-13 (S21 t3-t5, no spawn):** Em main solo verify via dotnet build + npm build × 2 app + dotnet test suite mỗi chunk. Reviewer KHÔNG spawn — em main self-review per UAT mode `feedback_uat_skip_verify` (skip dotnet test mỗi chunk, vẫn build verify). Gotcha #45 fix self-test 3 regression test (test-before §7). S21 t3-t5 push cumulative 12 commits — CICD Monitor verify post-deploy thay vai Reviewer (deploy ship + bundle hash + schema verify). Cumulative state: 84 test, 29 mig, 45 gotcha, 19 memory entries. Pattern saved cho future review focus: per-NV permission audit (Level table vs User table flag), EF migration backfill SQL injection between ADD-DROP order. Smart Friend guard still active for future spawn.
 - **2026-05-11 (setup):** Reviewer agent initialized. Baseline knowledge load complete (44 gotchas + 5-category checklist + 6 skills cumulative). No reviews performed yet. Awaiting first SendMessage from em main. Smart Friend guard active.

docs/HANDOFF.md

@@ -1,6 +1,7 @@
 # HANDOFF — Brief 5 phút cho session tiếp theo
 
-**Last updated:** 2026-05-13 2300 (Session 22 CHỐT cuối cùng — **bro chốt directive Thứ 9 BẮT BUỘC delegate sub-agent**. 14 commits pushed remote `3d725c4..2b9788d` + (this final). CICD Monitor Run #193 PASS verified all live endpoints + Mig 30 prod + bundle hash rotated. State final: **30 mig · 104 test · 47 gotcha (#47 revised informational) · 19 memory · 6 skills · 4 sub-agents · 33 active users prod**. Retrospective S22: em main solo 6/10 task lẽ ra delegate được — vi phạm directive Thứ 9. **Forward S23+ rule:** BẮT BUỘC spawn sub-agent khi ACCEPT criteria match (Implementer Case 1/2/3/5, Investigator pre-flight, Reviewer pre-commit, CICD Monitor post-deploy). Em main solo CHỈ khi schema/UX/architecture decision + cross-stack tight coupling + bug fix reasoning chain.)
+**Last updated:** 2026-05-14 (Session 23 turn 1 — **🎯 Plan K Mig 31 F2 refactor sang per-Approver-slot — DONE 8 commits Plan K `56868bf..<latest>`**. Bro phát hiện inconsistency S22: F1+F3+F4 đều per-slot ở Designer, F2 lone wolf ở User Management (Plan D S22 wire) + bro chốt đổi semantic F2: Drafter from Nháp → Approver during ChoDuyet skip thẳng Cấp cuối. Plan K 8 chunk: pre-A slot label rename "#NV {order}" → ApproverFullName + K1 Mig 31 schema swap (drop Users + add Levels, NO BACKFILL Option A) + K2 Service ApproveV2Async +skipToFinal 8th param APPROVE STEP branch + DTO 7th Allow* field + K3 Designer 7th checkbox + banner rewrite + K5 zombie endpoint cleanup (PATCH /users/{id}/allow-skip-final + Command/Handler/DTO/UI all backout Plan D S22) + K6 Workspace × 2 app DROP Drafter checkbox + ADD Approver toggle Dialog amber warning + K7 tests 104/104 PASS regression (3 deleted Drafter F2 + 3 added Approver F2 cancel out) + K8 docs cumulative. Multi-agent ROI: 🟦 Investigator K0 pre-flight + 🟨 Implementer 4 spawns (pre-A + K1 + K3 + K5 + K7 Case 2+3) + 🟥 Reviewer K2 pre-commit catch zombie endpoint Major + 👤 Chủ trì K0-bis sqlcmd + K2 cross-stack reasoning + K6 UX flow + K8 docs. 4 prod user lose AllowDrafterSkipToFinal=true value per Option A (admin re-config qua Designer). Reviewer K2 PASS 0 critical, 2 Major + 2 Minor flagged → K5 + K8 resolved. New pattern caught: "Transient sentinel zombie" anti-pattern (K1 sentinel-false patch + chunk scope shift → endpoint NoOp swallow silent). Per-NV admin opt-in flag pattern proven **3× cumulative** (Mig 29 F1+F3 + Mig 30 F4 + Mig 31 F2) — pattern ALSO applies cho refactor existing scope, KHÔNG chỉ greenfield. Memory `feedback_per_nv_permission_scope.md` reinforced S23 t1. State final: **31 mig (+1 Mig 31)** · 59 tables · **~145 endpoints (-1 backout)** · 34 FE pages · **104 test PASS unchanged** · 47 gotcha · 20 memory · 6 skills · 4 sub-agents (Investigator 1 spawn + Implementer 4 spawn + Reviewer 1 spawn + CICD pending K9). CHƯA push remote — chờ bro confirm K9 spawn CICD Monitor verify.)
+**S22 chốt cuối:** 2026-05-13 2300 (Session 22 CHỐT cuối cùng — **bro chốt directive Thứ 9 BẮT BUỘC delegate sub-agent**. 14 commits pushed remote `3d725c4..2b9788d` + (this final). CICD Monitor Run #193 PASS verified all live endpoints + Mig 30 prod + bundle hash rotated. State final: **30 mig · 104 test · 47 gotcha (#47 revised informational) · 19 memory · 6 skills · 4 sub-agents · 33 active users prod**. Retrospective S22: em main solo 6/10 task lẽ ra delegate được — vi phạm directive Thứ 9. **Forward S23+ rule:** BẮT BUỘC spawn sub-agent khi ACCEPT criteria match (Implementer Case 1/2/3/5, Investigator pre-flight, Reviewer pre-commit, CICD Monitor post-deploy). Em main solo CHỈ khi schema/UX/architecture decision + cross-stack tight coupling + bug fix reasoning chain.)
 **S22 chốt v1:** 2026-05-13 2200 (Session 22 CHỐT — **bro confirm sub-agent solution OK**. 11 commits pushed remote `3d725c4..b04a11a`. CICD Monitor Run #188 PASS verified. State final: **30 mig · 104 test · 47 gotcha (+1 #47) · 19 memory · 6 skills · 4 sub-agents · 33 active users prod**. KHÔNG còn pending push. Plan G S21-S22 evidence: Trial Week 1 → Week 2 sub-agent ROI confirmed. Bro test UAT 4 flag pattern + view file PDF + Section Điều chỉnh ngân sách.)
 **S22 prev:** 2026-05-13 1800 (Session 22 — Plan C + D + E done, Plan F ABORTED pre-flight fail. 5 commits local `60efeed..HEAD` chưa push. Plan D F2 toggle UI (BE+FE Admin). Plan C task 4 + 1-3 — 19 unit test mới (+5 reg #44 + 7 ReturnMode + 7 Guard). Plan E strict V2 scope List + Detail (remove UAT loose `|| ApprovalWorkflowId != null`). Plan F ABORTED — pre-flight prod sqlcmd reveal Contract entity HOÀN TOÀN V1 chưa wire V2 + 4 PE V1-only + 23 PE V1+V2 mix. Defer F sau Plan B Contract V2 wire. State: **29 mig · 103 test (+19) · 46 gotcha · 19 memory · 6 skills · 4 sub-agents (em main solo S22)**. 5 commits pending push `3d725c4..HEAD`.)
 **S21 CHỐT CUỐI:** 2026-05-13 1530 (Session 21 CHỐT CUỐI — 5 turn cumulative `3a34831..c0af9e0` 12 commits pushed remote, CICD Monitor verify 2/2 run PASS. Gotcha #46 mới (Gitea API path/cache stale). 2 memory user-level mới: `feedback_ef_migration_backfill_reorder` + `feedback_per_nv_permission_scope`. 3 agent Inv/Imp/Rev cập nhật MEMORY ghi recent activity S21 t3-t5 em main solo. State final: **29 mig · 84 test · 46 gotcha · 19 memory · 6 skills · 4 sub-agents (3 seeds + 1 cicd 2-run)**. KHÔNG còn pending push. Plan G Trial Week 1 evidence: CICD spawn 2/2 PASS (green), cost ~110-120K under 150K budget, CI time 3-3.5min stable. Pending Plan C test-after bundle defer sau UAT 2-3 lần ổn.)

docs/STATUS.md

@@ -2,7 +2,8 @@
 
 > **Update rule:** trước khi bắt đầu 1 task → ghi row vào `🔥 In Progress`. Xong → chuyển sang `✅ Recently Done`.
 
-**Last updated:** 2026-05-13 2200 (Session 22 CHỐT — **🎯 Bro chốt sub-agent solution OK**. 11 commits S22 pushed remote `3d725c4..b04a11a`. CICD Monitor Run #188 PASS verified. Highlights: Plan D F2 toggle + Plan C +20 test (test catch-up backlog) + Plan E strict V2 scope + Plan F ABORTED pre-flight (defer sau Plan B) + S22+1 fix disable 3 button bug + S22+2 seed 20 test user role-based naming + S22+3 rename users `{dept}.{level}@solutions.com.vn` + S22+4 attachment view inline PDF + Section "Điều chỉnh ngân sách" + S22+5 Mig 30 `AllowApproverEditBudget` per-NV opt-in (spec fix bro feedback). Stats final S22: **30 mig (+1 Mig 30)** · 59 tables · **~146 endpoints (+3)** · 34 FE pages · **104 test pass (+20: 5 reg #44 + 7 ReturnMode + 7 Guard + 1 V2 actor scope)** · **47 gotcha (+1 #47 paths-ignore agent-memory gap pending bro fix)** · 19 memory · 6 skills · **33 active users prod** (13 cũ + 20 mới role-based) · 4 sub-agents (CICD Monitor Run #188 PASS verify, 3 sub-agents seeds-only em main solo throughout S22). Pattern reinforced: per-NV admin opt-in flag 2× proven (Mig 29 + Mig 30) — anti-pattern default scope expansion. Memory `feedback_per_nv_permission_scope` reinforced S22+5 narrative.)
+**Last updated:** 2026-05-14 (Session 23 turn 1 — **🎯 Plan K: F2 refactor sang per-Approver-slot Mig 31** + UI consistency. 8 commits Plan K `56868bf..<latest>`: Chunk pre-A slot label rename → K1 Mig 31 schema swap (drop `Users.AllowDrafterSkipToFinal` + add `ApprovalWorkflowLevels.AllowApproverSkipToFinal` no BACKFILL) → K2 Service ApproveV2Async Approver F2 branch + DTO refactor → K3 Designer 7th checkbox + banner rewrite → K5 zombie endpoint cleanup + Reviewer Major #1+#2 + Minor #3+#4 → K6 Workspace × 2 app DROP Drafter + ADD Approver toggle → K7 tests regression 104/104 PASS (3 deleted + 3 added cancel) → K8 docs. Multi-agent execution: 🟦 Investigator K0 pre-flight + 🟨 Implementer K1+K3+K5+K7 (4 spawns Case 2+3) + 🟥 Reviewer K2 pre-commit (PASS 0 critical, 2 Major + 2 Minor) + 👤 Chủ trì K0-bis+K2+K6+K8. Bro decision: F2 semantic ĐỔI Drafter from Nháp → Approver during ChoDuyet skip thẳng Cấp cuối (mirror F3+F4 admin opt-in per slot) + setup ALL ở Workflow Designer (KHÔNG ở User Management). UI slot label "#NV {order}" → ApproverFullName. Stats final S23 t1: **31 mig (+1 Mig 31)** · 59 tables · **~145 endpoints (-1 backout /allow-skip-final)** · 34 FE pages · **104 test pass unchanged** (3 deleted + 3 added) · 47 gotcha unchanged · 20 memory (cumulative reinforce `feedback_per_nv_permission_scope` 3×) · 6 skills · **4 sub-agents active 4 spawns (Implementer Case 2+3) + 1 Reviewer**. 4 prod user lose `AllowDrafterSkipToFinal=true` value per Option A (admin re-config qua Designer). Pattern reinforced: per-NV admin opt-in flag 3× proven (Mig 29 F1+F3 + Mig 30 F4 + Mig 31 F2) — pattern ALSO applies cho refactor existing scope, KHÔNG chỉ greenfield. Plan B Contract V2 wire vẫn pending S23 t2+. CHƯA push remote — chờ bro confirm.)
+**S22 chốt cuối:** 2026-05-13 2200 (Session 22 CHỐT — **🎯 Bro chốt sub-agent solution OK**. 11 commits S22 pushed remote `3d725c4..b04a11a`. CICD Monitor Run #188 PASS verified. Highlights: Plan D F2 toggle + Plan C +20 test (test catch-up backlog) + Plan E strict V2 scope + Plan F ABORTED pre-flight (defer sau Plan B) + S22+1 fix disable 3 button bug + S22+2 seed 20 test user role-based naming + S22+3 rename users `{dept}.{level}@solutions.com.vn` + S22+4 attachment view inline PDF + Section "Điều chỉnh ngân sách" + S22+5 Mig 30 `AllowApproverEditBudget` per-NV opt-in (spec fix bro feedback). Stats final S22: **30 mig (+1 Mig 30)** · 59 tables · **~146 endpoints (+3)** · 34 FE pages · **104 test pass (+20: 5 reg #44 + 7 ReturnMode + 7 Guard + 1 V2 actor scope)** · **47 gotcha (+1 #47 paths-ignore agent-memory gap pending bro fix)** · 19 memory · 6 skills · **33 active users prod** (13 cũ + 20 mới role-based) · 4 sub-agents (CICD Monitor Run #188 PASS verify, 3 sub-agents seeds-only em main solo throughout S22). Pattern reinforced: per-NV admin opt-in flag 2× proven (Mig 29 + Mig 30) — anti-pattern default scope expansion. Memory `feedback_per_nv_permission_scope` reinforced S22+5 narrative.)
 **Last updated S22 prev:** 2026-05-13 1800 (Session 22 — Plan C + D + E done, Plan F ABORTED pre-flight fail. 5 commits local `60efeed`→`dbda37e`→`215b1e0`→`f149661`→Docs. Plan D BE+FE Admin User F2 toggle UI (PATCH /users/{id}/allow-skip-final + UsersPage column "Skip cuối" violet badge). Plan C task 4 5 reflection regression test gotcha #44 silent 403 ApprovalWorkflowsV2Controller policy split (catch class-level Policy regression). Plan C task 1-3 14 service test catch-up — ApplyReturnMode 4 mode per-NV Mig 29 + skipToFinal per-Drafter + EnsureEditableForDetails F3 gating. Plan E strict V2 scope List + Detail (remove UAT loose `|| ApprovalWorkflowId != null`, replace with V2 approver actor.UserId scope via ApprovalWorkflowLevels join). Plan F ABORTED — pre-flight prod sqlcmd reveal 23 PE + 7 Contract pin V1 + Contract entity HOÀN TOÀN V1 chưa wire V2 → drop V1 BE crash startup. Defer F sau Plan B Contract V2 + migrate 4 V1-only PE + UAT 2-3 tuần. Stats S22: 29 mig (0) · 59 tables · ~144 endpoints (+1) · 34 FE pages · **103 test pass (+19: 5 reg #44 + 7 ReturnMode + 7 Guard)** · 46 gotcha · 19 memory · 6 skills · 4 sub-agents (em main solo). Pattern reusable: SeedWorkflowAsync + SeedApproversAsync helper test infra + reflection Authorize regression test + pre-flight prod check pattern. CHƯA push remote — chờ bro confirm.)
 **S21 chốt cuối:** 2026-05-13 1530 (Session 21 chốt cuối — 5 turn cumulative pushed remote, CICD verified PASS 2/2 run, 1 gotcha mới #46 Gitea API path, 2 memory entry mới — `feedback_ef_migration_backfill_reorder` + `feedback_per_nv_permission_scope`. Session 21 5 turn timeline: t1 cicd-monitor add → t2 RAG planning Cách A → t3 fix gotcha #45 → t4 F1+F2+F3 Mig 28 → t5 refactor Allow* per-NV Mig 29. Stats final: 29 mig · 59 tables · ~143 endpoints · 34 FE pages · **84 test pass** · **46 gotcha (+2 từ S20: #45 PE button mismatch + #46 Gitea API)** · **19 memory entries (+3 từ S20: RAG + EF backfill + per-NV scope)** · 6 skills · 4 sub-agents (3 seeds-only + 1 cicd-monitor 2 runs PASS). 12 commits pushed `3a34831..c0af9e0`. Plan G Trial Week 1 evidence: CICD Monitor catch 0 fail vì green 2/2 run, cost 110-120K/run under 150K budget, 3-3.5min CI time stable. KHÔNG còn pending push. UAT mode skip dotnet test mỗi chunk, test-after Plan C bundle cho tất cả turn 3-5 sau UAT 2-3 lần ổn.)
 **S21 turn 5:** 2026-05-13 1400 (Session 21 turn 5 — **🎯 Refactor F1+F2+F3 sang PER-NV (Mig 29 drop Mig 28 column workflow-level). 4 chunk per-commit `0366946` (A BE schema+Service refactor) → `63234b2` (B FE Admin Designer 5 checkbox per-Level row) → `5ccb2a7` (C FE eOffice rename currentLevelOptions + drafterAllowSkipToFinal) → this Chunk D Docs. **F1+F3** 5 flag MOVED xuống `ApprovalWorkflowLevels` (per slot Approver, mỗi NV có riêng quyền duyệt). **F2** AllowDrafterSkipToFinal MOVED xuống `Users` (per-Drafter user, admin config ở User Management). Mig 29 4-stage: ADD 5 column Levels + 1 column Users + BACKFILL bulk SQL (copy workflow → all Levels, set TRUE cho Drafter user nào từng dùng workflow Allow) + DROP 6 column workflow `ApprovalWorkflows`. Service `ApplyReturnModeAsync` refactor đọc `currentLevel.AllowXxx` thay vì `workflow.AllowXxx`. Helper `EnsureEditableForDetailsAsync` read `level.AllowApproverEditDetails`. DRAFTER trình branch read `userManager.FindByIdAsync(actorUserId).AllowDrafterSkipToFinal`. DTO refactor: `AwLevelDto +5 Allow*`, `AwDefinitionDto -6 Allow*`, `CreateAwLevelInput +5 Allow*`, `PeDetailBundle.workflowOptions → currentLevelOptions + drafterAllowSkipToFinal`. FE Admin Designer drop section "Cấu hình nâng cao" workflow-level, replace 5 checkbox grid-cols-2 inline mỗi Level entry row (5 flag per slot). FE eOffice rename `wfOptions → levelOptions` đọc `currentLevelOptions`. Backward compat: backfill preserve admin config S21 t4. Test 84/84 PASS unchanged. Stats: **29 mig (+1) · 59 tables · ~143 endpoints · 34 FE pages · 84 test pass · 45 gotcha · 17 memory · 6 skills · 4 sub-agents seeds-only.**)

docs/changelog/sessions/2026-05-14-s23-turn1-plan-k-mig31-f2-refactor.md

@@ -0,0 +1,250 @@
+# Session 23 turn 1 — 2026-05-14 — Plan K Mig 31 F2 refactor sang per-Approver-slot
+
+**Dev:** Claude Opus 4.7 1M (4 sub-agents active + em main coordinator)
+**Duration:** ~4h
+**Base commit:** `eb106f2` (S22 chốt v2)
+**Final HEAD:** `<latest>` (K8 docs)
+**Total commits Plan K:** **8** (CHƯA push remote — chờ bro confirm K9 spawn CICD Monitor verify)
+
+## 🎯 Trigger session
+
+Bro nhận ra inconsistency S22+5:
+- Mig 29 F1+F3 (5 flag) → per-Approver-slot ở Workflow Designer ✅
+- Mig 30 F4 AllowApproverEditBudget → per-slot ở Designer ✅
+- Mig 29 F2 AllowDrafterSkipToFinal → per-User flag ở **User Management page** (Plan D S22) ❌
+
+Bro chốt 4 điểm refactor:
+1. "Cấu hình cho phép edit → thực hiện trong trạng thái đang duyệt" (= F3+F4 OK pattern hiện tại)
+2. "Cấu hình cho phép skip → duyệt thẳng cho phép trong trạng thái đang duyệt" (= F2 đổi semantic: Drafter from Nháp → Approver during ChoDuyet)
+3. "Tất cả đều cấu hình ngay trong chỗ setup quy trình duyệt" (move F2 từ Users → Levels per-slot)
+4. "Chỗ quy trình duyệt #NV 1 - Họ tên luôn" (slot label hiển thị ApproverFullName thay vì "NV 1")
+
+→ Plan K refactor F2 storage + semantic + UI consistency.
+
+## 🌳 Plan K 8 chunk execution
+
+### Pre-flight (K0 + K0-bis)
+
+- **K0 — 🟦 Investigator pre-flight audit F2 state** (~28K tokens spawn). Output: 12 file paths verified (Service + Entity + Config + DTO + FE × 2 app) + 5 surprises catch:
+  - S1: fe-user KHÔNG có Designer + UsersPage (admin-only) → K3/K5 scope hẹp hơn estimate
+  - S2: Prod 4/33 user flagged (drift S22+2 seed) → cần bro decision
+  - S3: Slot label thực tế `NV #{ei + 1}` (per-entry index, KHÔNG phải `#NV {order}`)
+  - S4: Audit comment string hardcoded line 149-150 cần rename
+  - S5: F2 default false consistent với F1 mode 1-3 + F3 + F4
+
+- **K0-bis — 👤 Chủ trì solo sqlcmd 5s** prod 4 user list: `fin.pp` + `pm.nv` (S22+2 seed) + `nv.test` (legacy UAT) + `truong.nguyen` (real user Solutions admin tick manual).
+
+**Bro decisions chốt 2 AskUserQuestion:**
+- F2 semantic: **Option B** Approver ChoDuyet skip cuối (đổi semantic, mirror F3+F4)
+- Slot label: **Bỏ '#NV {order}' hẳn**, chỉ "Họ tên" user pin
+- Prod 4 user: **Option A accept lose** (log audit trail, admin re-config qua Designer)
+- Slot label chunk: **Pre-Mig 31 chunk riêng** (Chunk pre-A)
+
+### Chunk pre-A — Slot label refactor (`56868bf`)
+
+🟨 Implementer Case 2 (~5K tokens spawn). 1 file fe-admin Designer line 873:
+
+```diff
+- Quyền duyệt NV #{ei + 1}
++ Quyền duyệt {usersList.data?.find(u => u.id === entry.approverUserId)?.fullName ?? 'Chưa chọn NV'}
+```
+
+Lookup pattern reuse precedent line 535. Bundle size unchanged trivial.
+
+### K1 — Mig 31 schema swap (`db66253`)
+
+🟨 Implementer Case 2 (~22K tokens spawn). 6 BE files atomic:
+
+- `User.cs` REMOVE `AllowDrafterSkipToFinal` prop (line 38)
+- `ApprovalWorkflow.cs` ADD `AllowApproverSkipToFinal` prop trên `ApprovalWorkflowLevel` (sau AllowApproverEditBudget)
+- `ApprovalWorkflowConfiguration.cs` ADD `HasDefaultValue(false)` (match 6 dòng existing)
+- `PurchaseEvaluationWorkflowService.cs` surgical remove F2 Drafter SUBMIT skipToFinal block line 125-161 + K2 marker comment
+- Mig 31 `RefactorSkipToFinalToApproverLevel` — 2 stage:
+  - Stage 1: ADD Levels column FIRST
+  - Stage 2: DROP Users column SECOND (manual reorder per memory `feedback_ef_migration_backfill_reorder`)
+  - NO BACKFILL (Option A — 4 prod user accept lose)
+- Apply Dev + Design DB
+
+Implementer flagged 4 ambiguities:
+1. UserConfiguration.cs KHÔNG exist (config inline trong ApplicationDbContext.OnModelCreating line 86) — no action
+2. Application layer compile-break (UserFeatures.cs + PurchaseEvaluationFeatures.cs reference removed prop) → minimal sentinel-`false` patches + K2 marker
+3. Test file line 253 still references removed prop → K7 fix
+4. Service IF block scope precision — remove only `if (skipToFinal)` true-branch + flatten `else`
+
+Test count 4039 insertions / 63 deletions (Designer + Snapshot dominate).
+
+### K2 — BE Service Approver F2 branch + DTO refactor (`364aef6`)
+
+👤 Chủ trì Solo (cross-stack reasoning + state machine integration). 4 files:
+
+- `PurchaseEvaluationWorkflowService.cs`:
+  - `ApproveV2Async` +`bool skipToFinal` 8th param
+  - APPROVE STEP branch sau UPSERT opinion line 477:
+    - if (!isAdmin && !isSystem && !matchingLevel.AllowApproverSkipToFinal) → ConflictException with helpful message
+    - else → set Phase=DaDuyet + clear pointer + SLA + LogTransition "[Approver duyệt thẳng Cấp cuối — Bước X Cấp Y → DaDuyet]"
+  - Caller TransitionAsync line ~144 pass skipToFinal vào ApproveV2Async
+  - V1 ApproveV1LegacyAsync caller throw nếu skipToFinal=true non-admin
+  - Drafter SUBMIT branch comment cleanup K1 marker → Mig 31 deprecation note
+- `ApprovalWorkflowOptionsDto` +7th field `AllowApproverSkipToFinal`
+- `PurchaseEvaluationDetailBundleDto` REMOVE `DrafterAllowSkipToFinal` field
+- `IPurchaseEvaluationWorkflowService.cs` comment update Mig 28-31 semantic refactor
+- `PurchaseEvaluationFeatures.cs` GetPe handler populate 7 Allow* + REMOVE sentinel `drafterAllowSkipToFinal`
+
+Build PASS 0 err, test K1 transient FAIL expected → K7 fix.
+
+### Reviewer K2 pre-K3 verify (PASS)
+
+🟥 Reviewer K2 (~22K tokens spawn). 5-category checklist verdict:
+
+| Category | Result | Issues |
+|---|---|---|
+| 1. Wire BE Approver F2 | ✅ PASS | 0 critical (branch placement đúng) |
+| 2. Schema Mig 31 | ✅ PASS | 3-file rule + Up() ADD-DROP + sqlcmd verify 7 cols Levels + 0 Users.AllowDrafterSkipToFinal |
+| 3. Security | ✅ PASS | admin bypass + V1 guard + clear error |
+| 4. Code quality | ✅ PASS | 0 err build, anti-fiddle clean |
+| 5. Tests | ✅ PASS (UAT defer K7) | — |
+
+**2 Major + 2 Minor flagged:**
+- Major #1 **Zombie endpoint** PATCH /users/{id}/allow-skip-final Admin tick = NoOp swallow silent → K5 cleanup priority
+- Major #2 Stale narrative `ApprovalWorkflow.cs:78-80` F2 cũ → K5 + K8 polish
+- Minor #3 `PurchaseEvaluationFeatures.cs:401` Command DTO comment → K5 polish
+- Minor #4 `ApprovalWorkflowConfiguration.cs:22-24` Mig narrative → K5 polish
+
+**New pattern caught Reviewer:** "Transient sentinel zombie" — K1 sentinel-`false` patch + chunk scope shift → endpoint NoOp silent. Mitigation: Reviewer pre-commit Smart Friend guard catch + recommend cleanup priority.
+
+### K3 — FE Admin Designer 7th checkbox + banner rewrite (`dd52d16`)
+
+🟨 Implementer Case 2 (~6K tokens spawn). 1 file fe-admin Designer:
+
+- Type `LevelDto +allowApproverSkipToFinal` (7th)
+- Type `EditLevelEntry +allowApproverSkipToFinal`
+- Helper `makeDefaultLevelEntry` default false
+- Helper `copyFromDefinition` propagate
+- Inline checkbox panel mỗi Level entry: "Cho phép duyệt thẳng Cấp cuối khi đang duyệt" (cùng group amber-50/30 với 5 F1+F3 + 1 F4 → 7 checkbox grid-cols-2)
+- Banner line ~623-631 rewrite: "F2 cấu hình ở User Management" (Plan D S22 stale) → "Cấu hình quyền duyệt riêng cho từng NV trong slot Approver bên dưới"
+- POST/PATCH mutation body propagate 7th flag
+
+Build PASS 0 TS err, bundle 1395.74 KB unchanged trivial.
+
+### K5 — Zombie endpoint cleanup + Reviewer Major #1+#2 + Minor #3+#4 (`2ea8977`)
+
+🟨 Implementer Case 2 (~12K tokens spawn). Full backout Plan D S22:
+
+**BE drop (7 files):**
+- `UsersController.cs` DELETE PATCH /allow-skip-final endpoint + Body record
+- `UserFeatures.cs` DELETE SetUserAllowDrafterSkipToFinalCommand + Handler + UserDto.AllowDrafterSkipToFinal field + sentinel mapping references
+- `ApprovalWorkflow.cs` rewrite stale narrative line 78-80 (Major #2)
+- `PurchaseEvaluationFeatures.cs` rewrite Command DTO comment (Minor #3)
+- `ApprovalWorkflowConfiguration.cs` APPEND Mig 31 narrative (Minor #4)
+- `ApprovalWorkflowV2AdminFeatures.cs` clean stale DTO comment
+- `IPurchaseEvaluationWorkflowService.cs` + `PurchaseEvaluationDtos.cs` clean storage references
+
+**FE Admin drop (2 files):**
+- `UsersPage.tsx` DELETE "Skip cuối" column + FastForward badge + button toggle + mutation hook
+- `types/users.ts` DELETE allowDrafterSkipToFinal field
+
+**Grep verify:** `AllowDrafterSkipToFinal` + `allow-skip-final` + `allowDrafterSkipToFinal` + `Skip cuối` + `FastForward` → 0 results src/Backend + fe-admin/src.
+
+Build PASS BE + fe-admin. Implementer flagged 4 stale comments fe-user PeDetailTabs (cosmetic, K6 cleanup).
+
+### K6 — Workspace × 2 app DROP Drafter + ADD Approver toggle (`ebe2469`)
+
+👤 Chủ trì Solo (UX flow decision — Approver workflow trigger point). 6 files (3 fe-admin + 3 fe-user mirror):
+
+**DROP Drafter Workspace checkbox:**
+- `PeDetailTabs.tsx` × 2 app: REMOVE state skipToFinal + allowSkipToFinal + violet label "Gửi thẳng Cấp cuối (skip trung gian)" + mutation skipToFinal payload
+- Simplify mutation signature: `opts: { skipToFinal: boolean }` → void
+- Drop conditional button label + confirm dialog text
+
+**ADD Approver Workspace toggle (Dialog approach — UX consistent với Trả lại Mode picker):**
+- `PeWorkflowPanel.tsx` × 2 app: state `skipToFinalApprover` default false
+- Visible khi Approve forward (NOT Cancel + NOT SendBack) + `currentLevelOptions?.allowApproverSkipToFinal === true`
+- Checkbox violet panel + Amber warning "Hành động KHÔNG quay lại được"
+- Mutation payload +`skipToFinal: !isReject && skipToFinalApprover`
+- onSuccess reset state
+
+**Type cleanup × 2 app:**
+- `ApprovalWorkflowOptions` +`allowApproverSkipToFinal: boolean` (7th)
+- `PeDetailBundle` REMOVE `drafterAllowSkipToFinal` field + Mig 29+30+31 cumulative comment
+
+Build PASS × 2 app, bundle rotated.
+
+### K7 — Tests regression (`6b1e2d9`)
+
+🟨 Implementer Case 3 (~14K tokens spawn). 1 test file:
+
+**Delete 3 deprecated Drafter F2 tests** (semantic deprecated Mig 31, no value).
+
+**Add 3 Approver F2 service tests** pattern Implementer memory Pattern 11:
+- `ApproveV2_SkipToFinal_AdminTickFlag_SetsPhaseDaDuyet` (happy path)
+- `ApproveV2_SkipToFinal_FlagOff_NonAdmin_ThrowsConflictException` (denied)
+- `ApproveV2_SkipToFinal_FlagOff_Admin_BypassesFlagCheck` (admin bypass)
+
+Helper `SeedApproverF2WorkflowAsync` 2-Step variant (test multi-step verify skip → terminal NOT fallthrough).
+
+Test count **104/104 PASS** baseline preserved (3 deleted + 3 added cancel out).
+
+### K8 — Docs + commit + push (this commit)
+
+- `docs/database/schema-diagram.md §14` update Mig 22-31 title + add Mig 30 + Mig 31 blocks + DROP Users column note
+- `docs/STATUS.md` Last updated S23 t1 entry
+- `docs/HANDOFF.md` TL;DR S23 t1 đầy đủ (top)
+- Session log file này
+- Memory `feedback_per_nv_permission_scope.md` reinforce 3× cumulative S23 t1
+- MEMORY index update
+- 2 stale FE Designer comments fe-admin (lines 73-75 + 502-504) rewrite Mig 29+30+31 cumulative
+- 3 dirty agent MEMORY.md commit cùng (Investigator + Reviewer + CICD Monitor from S22 chốt + S23 t1)
+
+## 📊 Stats S23 t1 chốt
+
+| Metric | Trước (S22 chốt) | Sau (S23 t1) | Δ |
+|---|---|---|---|
+| DB tables | 59 | 59 | 0 |
+| **Migrations** | 30 | **31** | **+1** (Mig 31 refactor F2) |
+| Endpoints | ~146 | **~145** | **-1** (backout /allow-skip-final) |
+| FE pages | 34 | 34 | 0 |
+| **Unit tests** | 104 | **104** | 0 (3 deleted + 3 added cancel) |
+| Gotchas | 47 | 47 | 0 |
+| Memory entries | 19 | **20** | +1 reinforcement S23 t1 (cumulative entry update) |
+| Skills | 6 | 6 | 0 |
+| Sub-agents | 4 (seeds-only S22 cumulative) | 4 (1 Inv + 4 Imp + 1 Rev spawn) | Plan K active execution |
+| Active prod users | 33 | 33 | 0 (4 user lose flag, KHÔNG remove user) |
+| **Commits Plan K** | — | **8** (`56868bf..<latest>`) | pre-A + K1-K3 + K5-K8 |
+
+## 🎯 Multi-agent ROI evidence Plan K
+
+| Spawn | Agent | Cost (tokens) | Output | Catch |
+|---|---|---|---|---|
+| K0 | 🟦 Investigator | ~28K | 12 file paths + 5 surprises (S1-S5) + LOC estimate | S1 fe-user no Designer → scope giảm + S2 4 prod user drift + S3 slot label real format |
+| K0-bis | 👤 Chủ trì | <1K | 4 user list (fin.pp+pm.nv+nv.test+truong.nguyen) | — |
+| Chunk pre-A | 🟨 Implementer Case 2 | ~5K | 1 commit slot label rename | — |
+| K1 | 🟨 Implementer Case 2 | ~22K | 1 commit Mig 31 schema swap 6 files | 3 ambiguities (UserConfig inline + compile-break workaround + test file fix K7 + IF block precision) |
+| K2 | 👤 Chủ trì | ~self | 1 commit Service + DTO refactor | — |
+| Reviewer K2 | 🟥 Reviewer | ~22K | PASS 0 critical + 2 Major + 2 Minor | Major #1 zombie endpoint + Major #2 stale narrative + new pattern "transient sentinel zombie" |
+| K3 | 🟨 Implementer Case 2 | ~6K | 1 commit Designer 7th checkbox + banner | — |
+| K5 | 🟨 Implementer Case 2 | ~12K | 1 commit zombie cleanup BE 7 + FE 2 | — |
+| K6 | 👤 Chủ trì | ~self | 1 commit Workspace × 2 app refactor | — |
+| K7 | 🟨 Implementer Case 3 | ~14K | 1 commit tests regression 104/104 PASS | — |
+| K8 | 👤 Chủ trì | ~self | 1 commit docs + memory + push | — |
+| K9 (pending) | 🟩 CICD Monitor | ~150K | post-deploy verify Mig 31 prod + bundle hash | — |
+
+**Total Plan K spawn cost (excl K9):** ~109K tokens — under 200K budget per session.
+
+**Multi-agent value caught:**
+1. **Investigator K0 S2 4 prod user drift** — em main solo dễ bỏ qua, audit qua sqlcmd K0-bis catch real user `truong.nguyen` admin tick manual S22+ (cần follow-up post-deploy)
+2. **Reviewer K2 Major #1 zombie endpoint** — em main solo K2 đã pass build clean nhưng KHÔNG nhớ cleanup Plan D S22 wire → Reviewer catch + K5 priority cleanup → giữ UX clean cho admin
+3. **Reviewer K2 new pattern "transient sentinel zombie"** — pattern reusable cross-project saved Reviewer memory
+
+## ⚠️ Pending S23 t2+
+
+- **K9 CICD Monitor post-deploy verify** — chờ bro confirm spawn sau push remote
+- **Plan B Contract V2 wire Mig 32+33** — chưa kick off (PE V2 + per-NV + F2 refactor đã proven 3×, ready mirror sang Contract entity per HANDOFF S22 pre-allocation)
+- **Plan C carry test-after bundle** — defer UAT 2-3 lần ổn (Service ApplyReturnMode test catch-up Mig 29 + Mig 30 F4 service test)
+- **Admin re-config `truong.nguyen` qua Designer** — real user lose flag, cần bro UAT note hoặc ping user
+
+## 📋 Pattern reinforced
+
+- **Per-NV admin opt-in flag pattern 3× cumulative** — Mig 29 F1+F3 (5 flag) + Mig 30 F4 (1 flag) + Mig 31 F2 (1 flag refactor). Pattern ALSO applies cho refactor existing scope, KHÔNG chỉ greenfield. Memory `feedback_per_nv_permission_scope.md` reinforced 3×.
+- **EF Migration ADD→DROP no-BACKFILL pattern** cho semantic refactor (Mig 29 cumulative 3× với Mig 31). Decision lose vs preserve based on semantic similarity old vs new.
+- **Multi-agent atomic per-chunk discipline** — Implementer Case 2 cookie-cutter 4 spawns, Reviewer pre-commit catch zombie, Chủ trì cross-stack reasoning. ROI evidence Week 2 trial.
+- **UAT mode Phase 9 test-after** — bro confirm K7 OK sau 7 chunk UAT iteration (Implementer K1+K2+K3+K5 + Chủ trì K2+K6 build verify mỗi chunk, test verify K7 cuối).

docs/database/schema-diagram.md

@@ -715,14 +715,15 @@ CREATE TABLE PurchaseEvaluationDepartmentOpinions (
 CREATE UNIQUE INDEX IX_PEDeptOpinions_PEId_Kind ON PurchaseEvaluationDepartmentOpinions (PurchaseEvaluationId, Kind);
 ```
 
-## 14. ApprovalWorkflow V2 schema (Migration 22-29, Session 17-21 — 3 bảng mới + 5 column Level + 1 column User)
+## 14. ApprovalWorkflow V2 schema (Migration 22-31, Session 17-23 — 3 bảng mới + 7 Allow* options per slot Approver)
 
 Schema riêng song song WorkflowDefinition V1 (Mig 21) — pin per phiếu PE.
 V1 vẫn giữ cho phiếu cũ; V2 mới là active cho phiếu tạo từ Session 17 trở đi.
 
-Mig 29 (S21 t5) — Refactor 6 Allow* options từ workflow-level (Mig 28 S21 t4)
+**Pattern cumulative cho admin opt-in flag per slot — proven 3× (memory `feedback_per_nv_permission_scope.md`):**
-sang PER-NV: 5 flag F1+F3 xuống Level slot (Approver), 1 flag F2 xuống User
+- Mig 29 (S21 t5) — Refactor 6 Allow* options từ workflow-level (Mig 28 S21 t4) sang PER-NV: 5 flag F1+F3 xuống Level slot, 1 flag F2 xuống User. Backfill bulk SQL preserve admin config S21 t4.
-(per-Drafter). Backfill bulk SQL preserve admin config S21 t4.
+- Mig 30 (S22+5) — F4 `AllowApproverEditBudget` per slot Approver — admin tick cho NV chỉnh Section "Điều chỉnh ngân sách" khi đang duyệt.
+- Mig 31 (S23 t1) — F2 refactor sang Approver scope: ADD `AllowApproverSkipToFinal` per Level slot, DROP `Users.AllowDrafterSkipToFinal`. Semantic cũ Drafter-from-Nháp deprecated. **NO BACKFILL** (4 prod user lose flag value — admin re-config qua Designer).
 
 ### Core (3 bảng):
 
@@ -751,12 +752,18 @@ ApprovalWorkflowLevels  (FK Cascade ApprovalWorkflowStepId, FK Restrict Approver
 ├── AllowReturnToDrafter      bit DEFAULT 1  — F1 mode: Trả về Drafter (S17 backward compat)
 ├── AllowApproverEditDetails  bit DEFAULT 0  — F3: NV này chỉnh Section 2 lúc đang duyệt
 │
+├── Mig 30 (S22+5) — F4 admin opt-in per slot:
+├── AllowApproverEditBudget   bit DEFAULT 0  — F4: NV này chỉnh Section "Điều chỉnh ngân sách"
+│
+├── Mig 31 (S23 t1) — F2 refactor admin opt-in per slot:
+├── AllowApproverSkipToFinal  bit DEFAULT 0  — F2: NV này duyệt thẳng Cấp cuối (skip trung gian)
+│                                            (storage cũ Users.AllowDrafterSkipToFinal đã DROP)
+│
 └── INDEX (ApprovalWorkflowStepId, Order) + INDEX ApproverUserId
 
 Users (AspNetUsers extension)
 ├── ... existing columns (FullName, DepartmentId, PositionLevel, CanBypassReview, etc)
-└── Mig 29 (S21 t5) — F2 per-Drafter:
+└── (Mig 29 AllowDrafterSkipToFinal column đã DROP trong Mig 31 — F2 refactor sang Approver scope)
-    AllowDrafterSkipToFinal  bit DEFAULT 0  — User được Drafter gửi PE thẳng Cấp cuối
 ```
 
 **Convention quan trọng:** nhiều `ApprovalWorkflowLevel` rows cùng `Order` trong cùng Step = **same Cấp với N approvers** (OR-of-N). Ví dụ Cấp 1 có 2 NV: 2 row Level cùng `Order=1` khác `ApproverUserId`.

fe-admin/src/pages/system/ApprovalWorkflowsV2Page.tsx

@@ -70,9 +70,10 @@ type DefinitionDto = {
   description: string | null
   isActive: boolean
   isUserSelectable: boolean    // Mig 25 — admin toggle cho user pick
-  // Mig 29 (S21 t5) — 6 Allow* options MOVED:
+  // Mig 29 (S21 t5) + Mig 30 (S22+5) + Mig 31 (S23 t1) — 7 Allow* options
-  //   - 5 flag F1+F3 xuống per slot Level (xem LevelDto)
+  // ALL xuống per slot Level (xem LevelDto). Admin opt-in per-Approver-slot
-  //   - 1 flag F2 AllowDrafterSkipToFinal xuống per User (User Management)
+  // pattern proven 3× cumulative: F1+F3 (5 flag Mig 29) + F4 (Mig 30) + F2
+  // (Mig 31 refactor sang Approver scope, storage cũ Users đã drop).
   activatedAt: string | null
   createdAt: string
   steps: StepDto[]
@@ -499,9 +500,9 @@ function Designer({
   const [description, setDescription] = useState(cloneFrom?.description ?? '')
   const [steps, setSteps] = useState<EditStep[]>(initialSteps)
 
-  // Mig 29 (S21 t5) — 6 Allow* options MOVED:
+  // Mig 29 (S21 t5) + Mig 30 (S22+5) + Mig 31 (S23 t1) — 7 Allow* options
-  //   - 5 flag F1+F3 xuống per Level slot (xem EditLevelEntry, render mỗi Level row)
+  // ALL xuống per Level slot (xem EditLevelEntry, render inline mỗi Level row).
-  //   - 1 flag F2 AllowDrafterSkipToFinal xuống per User (User Management page)
+  // Admin opt-in per-Approver-slot pattern proven 3× cumulative.
 
   const usersList = useQuery({
     queryKey: ['users-for-approver-v2'],