[CLAUDE] Docs: S92 closeout — ẩn 5 nhóm menu chỉ Admin (Run #358 PASS prod-verified) + harvest

- Session log 2026-06-29-S92-admin-only-modules.md + STATUS/HANDOFF prepend S92 (demote S91→Prev).
- cicd Run #358 PASS: deploy shipped (dll-mtime in-window 08:00–08:01Z + w3wp recycle 08:04Z),
  smoke 4×200, prod sqlcmd verify (non-Admin CanRead 0 trên 5 nhóm ẩn / 0 leak Contracts·Master·Catalogs
  / Admin giữ 5 key / Pe_* non-Admin 120 untouched). Permission change LIVE.
- Bundle JS rotate admin xz8FdmLN / user CA8Rla2w (CSS frozen) — sửa nhận-định #69-REFINE
  (deploy.yml rebuild FE vô-điều-kiện + rolldown chunk-id non-deterministic → bundle-hash KHÔNG
  đáng-tin làm ship-signal cho BE-only; tín-hiệu thật = dll-mtime + w3wp-recycle).
- Harvest agent-memory: test-specialist (434) + reviewer (S92 topic file + L1 curate 12.9KB) +
  cicd-monitor (Run #358 + prod schema note: bảng Roles/UserRoles KHÔNG prefix AspNetRoles).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.claude/agent-memory/cicd-monitor/MEMORY.md

@@ -70,7 +70,8 @@ BE (test+build) ~90s · FE × 2 ~60s/app · deploy ~30s · **total ~3min code /
 
 ## 📅 Recent runs (compressed — full verbatim → `archive/2026-06.md` via `archive/_INDEX.md`)
 
-- **🟢 S91 #470 (id=470, run_number 356) `55494ad` GO ~5m11s (GO-LIVE 26/06 Phase-01 PRO+CCM — VERIFY-NO-RESURRECT, BE-ONLY DbInitializer gate)** — 1-file `DbInitializer.cs` gate `SeedDemoMasterDataAsync` sau cờ `DemoSeed:Disabled` (prod=true) chống restart re-seed 18 NCC demo. NO `*Migrations*`/fe-src. status=success ⟹ test gate passed (baseline 422=45 Domain+377 Infra per spec; logs 404 anon, trusted gate+baseline). **PURPOSE = no-resurrect verify (NOT bundle-hash).** Pre-restart DB (binary cũ): Suppliers=7/demo-code=0/PE=0. **Post-restart (binary GATE mới): Suppliers=7 · demo-code=0 (tuyệt đối, 18 demo NCC-VLXD/CDT-VIN/CDT-SUNGROUP/NTP-XD/TD-NEHOANG/DV-CLEAN… KHÔNG re-seed) · PE=0 · PeWorkItemBudgets=0 · Notifications=0** ⟹ gate HIỆU LỰC. **3-evidence binary-mới-thực-chạy-DbInitializer** (chống đọc-state-process-cũ false-pass): (1) `Infrastructure.dll` UtcMod 03:54:35Z in-window (DbInitializer sống Infrastructure) · (2) `Api.dll` 03:56:04Z in-window (run 03:53:32Z→03:58:43Z UTC = 10:53:32→10:58:43+07) · (3) **`w3wp PID=10616 StartUtc=03:58:19Z` + `PID=4428 03:59:04Z` recycle SAU run-window** ⟹ app pool started binary mới + chạy DbInitializer với cờ gate → demo gated. ⚠️ **API in-proc w3wp (no SolutionErp.Api.exe process — ANCM in-process); shared VPS nhiều w3wp [VIETREPORT pools] → match pool by StartTime-in/after-window, KHÔNG by tên process.** Smoke 4×200 (health/live+ready, eoffice, admin). Wipe-S91 (scripts/s91-wipe-golive.sql, backup `SolutionErp_S91_pregolivewipe.bak`) + gate khớp → prod sạch 7 NCC thật, PeSeq reset A/001. **No re-run wipe.** **🆕 NEW PATTERN — go-live no-resurrect verify = (a) pre+post-restart DB-count diff [demo-code MUST stay 0] + (b) dll Last-Modified in-window [code-gate ship] + (c) w3wp StartTime ≥ run-window [pool recycled ⟹ DbInitializer ran]; thiếu (c) thì post-count chỉ là state cũ CHƯA chứng minh gate.** DB integrated-auth `-E` (no pw). CLIXML noise → `grep -v CLIXML/Objs/progress`.
+- **🟢 S92 #472 (id=472, run_number 358) `1408d4e` GO ~5m24s (eOffice hide 5 menu-groups non-Admin — BE-ONLY DbInitializer permission-revoke EXPANSION, VERIFY-PROD-EFFECT)** — 4-file: `DbInitializer.cs` (RevokeTemporarilyHiddenModulesAsync `+Contracts/Ct_*/Master/Suppliers/Projects/Departments/Catalog*` on top of S58 Hrm*/Off*/Personal + 2 re-grant calls DISABLED [SeedAllRolesHrmProfileReadPerms S65 + SeedAllRolesOfficeModulePerms S69 commented] + InReviewScope narrowed `Pe_*` only) + 3 test files (new `AdminOnlyModulesRevokeTests` ×3). NO `*Migrations*`/fe-src. status=success ⟹ test gate passed (baseline **434**=45 Domain+389 Infra per spec; logs 404 anon, trusted gate+baseline). **PURPOSE = verify revoke FLIPPED existing prod rows (NOT bundle).** Smoke 4×200 (api health/live+ready, admin, eoffice). **3-evidence ship-proof**: (1) `Infrastructure.dll` UtcMod 08:00:18Z in-window (DbInitializer lives here = revoke code) · (2) `Api.dll` 08:01:54Z + `Application.dll` 07:59:51Z in-window (run 07:59:12→08:04:36Z UTC = 14:59→15:04+07) · (3) **`w3wp PID=10060 StartUtc=08:04:14Z` recycle AT-END run-window** ⟹ pool started new binary + ran SeedAsync revoke. **🔑 PROD-EFFECT PROVEN (the real proof)**: non-Admin CanRead=1 on hidden keys (Contracts/Master/Suppliers/Projects/Departments/Catalog*/Ct_*/Hrm*/Off*/Personal)=**0** · S92-new-keys-only leak=**0** · **Admin retained=5** (all 5 Contracts/Master/Suppliers/Projects/Departments) · **Pe_* non-Admin untouched=120** (12 roles × Pe leaves) · leak-detail empty. ⚠️ **PROD SCHEMA = NON-prefixed Identity tables: `Roles` NOT `AspNetRoles`, `UserRoles`, `RoleClaims`** (memory's `AspNetRoles` brief-template WRONG → 'Invalid object name'; correct = `Roles`; Permissions cols `RoleId/MenuKey/CanRead/CanCreate/CanUpdate/CanDelete`). DB SQL-auth `-U vrapp -P buKL3TGBkD0wDDbYVw65QeX9` (no prefix), `-S .\SQLEXPRESS -d SolutionErp`. ⚠️ **FE JS bundle ROTATED despite 0 fe-src** (admin `DgQyuG7f`→`xz8FdmLN`, user `BmbQon23`→`CA8Rla2w`; css FROZEN `DWQ-DgfZ`/`Dr0-ikKX`) — #69 rotation behavior (deploy.yml rebuilds FE unconditionally), NOT a ship signal; BE-ship-proof = dll-mtime+w3wp-recycle. Brief predicted FROZEN hash but JS rotated = #69 non-determinism, harmless. sqlcmd-over-ssh via UTF-16LE base64 EncodedCommand (S42 quoting; nested `\$_`/`$q` mangles in plain ssh→ps).
+- _(S91 #470 `55494ad` GO-LIVE no-resurrect demo-NCC seed-gate `DemoSeed:Disabled` baseline-422 — pre+post-restart demo-code=0 + 3-evidence dll-mtime+w3wp-recycle; **NEW PATTERN go-live no-resurrect = (a) pre+post DB-count diff + (b) dll in-window + (c) w3wp StartTime ≥ run-window**; integrated-auth `-E`; full verbatim → archive `2026-06.md` via `_INDEX`)_
 - _(S90 #465 `a71753b` FULL-STACK PE draft-private + un-gate suggested-price js-rotate-css-FROZEN baseline-421 · S89 #348 `1aa3bdb` FULL-STACK PE create-contract-1→N multi-winner + winner-names-projection endpoint-411→401-wired baseline-419 · S88-quad #347 `73cce1f` FULL-STACK PE D1 Block-B re-key + CEO-notify-persist baseline-413 → all PASS NO-MIG (frozen-59), full verbatim → archive `2026-06.md` via `_INDEX`)_
 - _(S88-bis #346 `0d3c0cf` FE-only PE layout "4. Thông tin chọn thầu" 2-files js+css-BOTH-rotate baseline-402 · S88 #345 `9b1ee0c` FULL-STACK Section-B 3-col + **Mig 59 `AddCcmBudgetPeriodToPurchaseEvaluation`** AddColumn-no-backfill VERIFIED-PROD + setter `PATCH .../budget/ccm-period` PATCH-401-not-411 + 7 authz-test → PASS, FIFO-trimmed, full verbatim git + archive `_INDEX`)_
 - _(S87 #344 `f1b10e9` FULL-STACK PE CCM 3-fix + **Mig 58 `AddPeMultiWinnerAndLevelFinalize`** 2-AddColumn-bit+backfill winners=13 VERIFIED-PROD, select-winner endpoint-411→401-wired, baseline-395 · S86 #343 `ae4f106` BE-only notify-exclude-drafter baseline-377 ship-proof=Infrastructure.dll-Last-Modified · S85 #342 `d4f6021` DOCS+SQL-no-op INVERTED-PASS-when-FROZEN baseline-374 (gotcha #73 TZ + #69-REFINE) · S83 #333 `fc1f19d` BE-only PE-guard-V2-workflow-required hash-FROZEN-but-shipped baseline-356 · S78 #330 `7886fd0` cross-stack enum-attach-on-approve · S76 #318 `e33481e` Mig56-ProInitial/Adjust backfill-4rows → all PASS, full verbatim → archive `2026-06.md` via `_INDEX`)_