[CLAUDE] Docs: S92 closeout — ẩn 5 nhóm menu chỉ Admin (Run #358 PASS prod-verified) + harvest

- Session log 2026-06-29-S92-admin-only-modules.md + STATUS/HANDOFF prepend S92 (demote S91→Prev).
- cicd Run #358 PASS: deploy shipped (dll-mtime in-window 08:00–08:01Z + w3wp recycle 08:04Z),
  smoke 4×200, prod sqlcmd verify (non-Admin CanRead 0 trên 5 nhóm ẩn / 0 leak Contracts·Master·Catalogs
  / Admin giữ 5 key / Pe_* non-Admin 120 untouched). Permission change LIVE.
- Bundle JS rotate admin xz8FdmLN / user CA8Rla2w (CSS frozen) — sửa nhận-định #69-REFINE
  (deploy.yml rebuild FE vô-điều-kiện + rolldown chunk-id non-deterministic → bundle-hash KHÔNG
  đáng-tin làm ship-signal cho BE-only; tín-hiệu thật = dll-mtime + w3wp-recycle).
- Harvest agent-memory: test-specialist (434) + reviewer (S92 topic file + L1 curate 12.9KB) +
  cicd-monitor (Run #358 + prod schema note: bảng Roles/UserRoles KHÔNG prefix AspNetRoles).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.claude/agent-memory/reviewer/MEMORY.md

@@ -65,18 +65,19 @@ Adversarial pre-commit reviewer SOLUTION_ERP. Read-only verify + live curl prod
 
 ## 📅 Recent activity (compressed — full verbatim → `archive/2026-06.md` via `archive/_INDEX.md`)
 
-- **S91 (2026-06-25) Adversarial PE D2 create-contract 1→N multi-winner + list winner-names (OUTWARD, FROZEN module, NOT-deployed) — PASS (genuine, 0 blocking):** This IS the fix for the dead-end I caught in S89-bis. BE handler (`CreateContractFromEvaluationFeatures.cs:45-152`) rewritten `IRequest<Guid>`→`List<Guid>`, 1 Contract per `IsWinner` supplier. The S89-bis hard-block `if(SelectedSupplierId is null) throw` REMOVED → replaced `winners=Suppliers.Where(IsWinner); if Count==0 throw` (joint ≥2 now accepted). **All 5 spec concerns verified true:** (a) **codegen mid-loop SaveChanges flushes ONLY seq-row** — loop-1 builds `contract` LOCAL (never `db.Contracts.Add`), `GenerateAsync:51 db.SaveChangesAsync` on SHARED scoped ctx flushes only the tracked `ContractCodeSequences` row; `pe` (tracked via Include) NOT mutated until `pe.ContractId=contracts[0].Id` at :148 AFTER both loops; loop-2 does the Add+changelogs+final SaveChanges :150. (b) **GiaTri**: single→`detailsSum=Details.Sum(ThanhTienNganSach)` (legacy); ≥2→per-winner `Details.SelectMany(Quotes).Where(q.PurchaseEvaluationSupplierId==w.Id).Sum(ThanhTien)` — join key is PES-row Id (Quote.PurchaseEvaluationSupplierId FK→PES.Id, entity:11 confirmed), mirrors submit-guard WorkflowService:190 + detail-bundle winnerQuoteTotal:1109-1112 byte-for-shape (all 3 layers same IsWinner+row-Id join; create sums PER-winner, guard/display sum ALL → N contracts sum to gate total, test asserts w0=140+w1=260). (c) **idempotency**: `contract.Id` from BaseEntity:5 `Guid.NewGuid()` valid pre-SaveChanges; guard `pe.ContractId is not null` :59. (d) **guards+Includes** all present (`.Include(Suppliers)`+`.Include(Details).ThenInclude(Quotes)` :48-49). (e) **no partial-create**: codegen self-commits seq per-call (Serializable tx :37/52) → later-winner throw wastes seq numbers (gap, acknowledged) but no contract Add'd, final SaveChanges not reached = clean. **Positional record arg-order (spec's #1 skeptic-ask) VERIFIED across all 3 sites** — DTO `PurchaseEvaluationListItemDto` ends `IsUrgentByPro, IsUrgentByCcm, WinnerSupplierNames` (Dtos:41-45); all 3 projections (ListPE:616, Inbox:705, ListApprovedPE:178) append the winner-names subquery as FINAL positional arg after identical-shape preceding args → no misorder. **Controller** :297 `{contractIds}` (was `{contractId}`); grep confirms ONLY 2 byte-identical PeDetailTabs read `{contractIds:string[]}`, ZERO stale `.data.contractId` readers. **FE mirror**: PeDetailTabs+PeListPanel SHA-256 byte-identical both apps; `PeListItem` type block diff=0 (winnerSupplierNames:string[] identical, only pre-existing PHASE_BADGE color/comment drift remains = documented intentional). `winnerSupplierNames?.length>0` optional-chain safe (undefined>0=false). **S89-bis loop CLOSED**: CreateContractDialog now renders `suppliers.filter(isWinner).map(supplierName).join(', ')||selectedSupplierName` (no blank); approved-pending-contract endpoint has ZERO FE consumer (picker dead → joint-blank moot). Verify: build slnx **0-err** · fe-admin+fe-user tsc exit 0 · full suite **45+374=419 PASS** 0-skip (S90 413 +6) · 2 new test classes 6/6 PASS via REAL ContractCodeGenerator Serializable-on-SQLite + REAL SQLite collection-subquery translation (NoOp-vacuous explicitly avoided: single-winner test asserts GiaTri=800 budget NOT 140 quote; 2-winner asserts 140/260 with budget 800 DIFFERENT) · mock-grep clean · no migration in diff (Mig 58 pre-committed S87) · agent-memory diff .md-only. **Anti-pattern positive-validation: cardinality single→multi conversion now propagated through ALL layers consistently (FE visibility predicate `isWinner` + BE action precondition `winners.Count` + 3 financial-total sites + dialog render) — the exact FE-shows/BE-blocks mismatch I flagged S89-bis resolved by aligning the BE action on the same IsWinner source-of-truth, not by hiding the button.**
-- **S90 (2026-06-25) Adversarial PE stability-fix batch D1 (5 changes + 11 tests, FROZEN module, NOT-deployed) — PASS (genuine, 0 blocking):** Closes my own S89/S89-bis flagged latent bugs. (1) **Block B financials re-key** `SelectedSupplierId`→`Suppliers.Where(IsWinner)` (PurchaseEvaluationFeatures.cs:840/855): single-winner UNCHANGED proven — sole writer `PurchaseEvaluationDetailFeatures.cs:427/431` sets `IsWinner=selectedIds.Contains(SupplierId)` AND `SelectedSupplierId=Count==1?First():null` in same action ⇒ for 1 winner both predicates select identical row-set (even survives duplicate-SupplierId-rows since :427 flags all). ≥2 → sums all (approved fix). EF-safe: `peers` is IQueryable (`db.PE.AsNoTracking().Where`) so `Any(s=>IsWinner)`+`CountAsync`/`SumAsync` translate server-side; `currentProposalTotal` uses already-Included `e.Suppliers` in-mem + 1 SumAsync = no N+1. Matches submit-guard WorkflowService:189-191 byte-for-shape + winnerQuoteTotal:1093 (Quote→Detail FK mandatory so in-mem `e.Details.SelectMany(Quotes)` == direct query set). (2) **CEO-notify SaveChanges** (UrgentFeatures.cs:100): NotificationService confirmed Add-only (no internal SaveChanges) → pre-fix Director rows Add'd-but-never-flushed (only :75 flush BEFORE notify block) → silent drop + no SignalR; new SaveChanges inside try/catch = best-effort, gate :80 `!wasUrgent` snapshot@:52 = no double-notify. (3) **HoSoLink null-safe+clear-via-empty** (:280-281): contract coherent — BOTH UpdatePeDraft FE forms OMIT hoSoLink (PeHeaderForm.tsx:112-120 + InfoTab.save PeDetailTabs:817) → preserve; ONLY HoSoLinkRow:2023 sends `.trim()` ("" clears, value sets); PeWorkspaceCreateView `||null` is CREATE (api.post) not Update; NO other UpdatePeDraft caller sends null-as-clear. (4) **Setter relocation** PeSuggestedPrice→PeWorkItemBudget byte-identical (only comment header added), same namespace ⇒ MediatR resolves, controller:125 unchanged, source file ends clean. (5) **FE #70 guard** `||peFetching` added to the EXACT 2 PRO cells (1548/1649) that lacked it — now consistent w/ all siblings; `peFetching` in scope @1268; PeDetailTabs.tsx sha256 byte-identical both apps. **Tests RED-pre-fix (logic-proven all): joint-winner Current=200/Prev=100 (pre-fix 0/0 via null gate); HoSoLink null→PRESERVE (old test asserted BeNull — assertion flipped); CEO-notify asserts db.Notifications has Director row via REAL Add-only service (NoOp would pass vacuously — explicitly avoided).** Verify: build slnx 0-err/0-warn · full suite **45+368=413 PASS** 0-skip · 3 affected classes 52 PASS · fe-admin+fe-user tsc exit 0 · mock-grep clean · agent-memory diff .md-only. Joint-winner number change is the approved frozen-spec exception (soft-warning `proposalOver`:1380 now fires correctly for joint, no hard-gate keys off it). **Anti-pattern positive-validation: the impl chose the behavior-PRESERVING fix shape I prescribed in S89 — HoSoLink option(b)-equivalent (null-safe + "" clear) keeps HoSoLinkRow-clear working WITHOUT touching its FE send, resolving the option(a)-breaks-clear nuance I flagged; and Block B re-key picks `IsWinner` (the new source-of-truth) over `SelectedSupplierId` consistently across all 3 winner-total sites.**
-- **S89-bis (2026-06-25) Adversarial AREA-6 FE-consumers (PE FROZEN audit, investigator verify) — 4/4 finding confirmed + 1 NEW miss:** All 4 investigator findings hold under independent Read. #1 (list-panel `PeListPanel.tsx:168` blank winner label when ≥2 joint winners) CONFIRMED — list DTO carries only `selectedSupplierName` projected from `SelectedSupplierId` (PurchaseEvaluationFeatures.cs:615/706), BE nulls it for ≥2 (`PurchaseEvaluationDetailFeatures.cs:431 selectedIds.Count==1?First():null`); detail-side fully converted to `isWinner` (verified 14 call-sites grep). do-not-touch (DTO-extend + render = behavior). #2 (#70 stale-echo asymmetry) CONFIRMED PRECISE — ONLY lines 1548+1649 (PRO `adjustMut` absolute-set pair echoing un-edited sibling from `ev.budgetPeriodAmount`/`ev.expectedRemainingAmount` 1551/1652) gate bare `{adjustMut.isPending}`; CCM sibling 1563 + suggested-price 1736 + notes all add `|| peFetching`. Adding `||peFetching` = behavior-preserving (gates Save btn during refetch only) = SAFE fix. #3 (stale `AddItemDialog giữ (dead)` comment line 2507, fn deleted grep=0) CONFIRMED safe drop. #4 (mirror clean) CONFIRMED ACCURATE — 6 PE components SHA-256 byte-identical both apps (verified), type-file diff is LINE-NUMBER-only on structural fields (`isWinner`/`ccmBudgetPeriodAmount`/`winnerQuoteTotal`/`allowApproverFinalize` content-identical, fe-user shifted by extra comment lines). **NEW catch investigator MISSED (same null-when-≥2 class, HARDER consequence): create-contract joint-winner DEAD-END.** FE `canCreateContract` gate (`PeDetailTabs.tsx:1900`) shows "Tạo HĐ từ phiếu" button on `suppliers.some(isWinner)` (≥1 incl joint ≥2) + dialog header 2171 even renders joint names; but BE `CreateContractFromEvaluationCommandHandler` (CreateContractFromEvaluationFeatures.cs:52) hard-blocks `if (pe.SelectedSupplierId is null) throw ConflictException("Phiếu chưa chọn NCC thắng")` = EXACTLY joint-winner case. Submit-guard (WorkflowService:180 IsWinner ≥1) lets ≥2-winner reach DaDuyet → user clicks Tạo → 409 despite chosen winners. ListApprovedPE picker join (CreateContractFromEvaluationFeatures.cs:137) also blanks supplier for joint. **Anti-pattern: cardinality single→multi conversion stops at the DETAIL display layer — the FE button-VISIBILITY predicate was migrated to `isWinner` but the BE ACTION it triggers + its precondition still resolve single `SelectedSupplierId` → FE-shows/BE-blocks mismatch.** Fix = behavior decision (block earlier / pick-winner / multi-contract) → do-not-touch in this area, flag em-main. Mirror byte-identical so fe-user has IDENTICAL bug.
-- **S89 (2026-06-25) Adversarial AREA-4 workflow-edit (PE FROZEN audit, investigator verify) — 3 confirm / 1 confirm-but-do-not-touch:** Investigator finding #1 (HoSoLink #73-class clear-on-partial-edit) CONFIRMED real high-sev latent bug: `UpdatePeDraftHandler` PurchaseEvaluationFeatures.cs:280 absolute-set `entity.HoSoLink=request.HoSoLink` (record default null line 222) while header-edit forms OMIT hoSoLink → set link via HoSoLinkRow then edit header = silent wipe. **NEW catch investigator MISSED: a 2nd destructive call-site** — `PeDetailTabs.tsx:817` InfoTab.save (Panel-1 pencil inline-edit, both fe-admin+fe-user) PUTs `{tenGoiThau,diaDiem,moTa,paymentTerms,budgetPeriodAmount,expectedRemainingAmount}` NO hoSoLink. Team comment 823-825 "echo … để PUT update không xóa nhầm" PROVES they knew absolute-set hazard + defended budget but missed hoSoLink. **fixRisk nuance: investigator's option(a) (make HoSoLink null-safe) BREAKS HoSoLinkRow clear** — HoSoLinkRow sends `hoSoLink||null` (empty→null to clear) line 2020; null-safe guard would ignore the clear. Spec FROZEN → behavior-preserving fix = option(b) only (echo hoSoLink in both header forms), option(a) needs HoSoLinkRow→empty-string change = behavior touch. Anti-pattern: **"echo-all-siblings" mitigation convention silently rots when a NEW absolute-set field (Mig 52 HoSoLink) is added but not back-filled into every sibling-echo call-site.** Finding #3 (SetPeCcmBudgetPeriod misplaced in PeSuggestedPriceFeatures.cs:153 not PeWorkItemBudgetFeatures) CONFIRMED low-sev org-debt, functional+tested (PeCcmBudgetPeriodSetterAuthzTests). Finding #4 (require-workflow NON-dup: CREATE-validator NotEmpty line 48 + submit-guard WorkflowService:237 + UPDATE-validator-omit = 3 distinct lifecycle, intentional defense-in-depth) CONFIRMED accurate verification, no patchwork. Finding #2 (no HoSoLink preserve test) CONFIRMED gap but test-before only AFTER picking the behavior-safe fix.
-- **S86 (2026-06-24) PE Section B THỰC HIỆN tách 3 cột Dự án|PRO|CCM (Mig 59 `CcmBudgetPeriodAmount`) — lane [authz] PASS:** role-gate đúng — handler `SetPeCcmBudgetPeriod` byte-mirror `UpdatePeSuggestedPriceCcm` (NotFound→Forbidden order; fail-closed `!Admin && !CostControl`→`ForbiddenException`→403 via GlobalExceptionMiddleware TRƯỚC mọi set/changelog). FE gate `bs.canEditCcm` (BE-computed `PurchaseEvaluationFeatures.cs:812 isAdmin||CostControl`) KHỚP BIT-EXACT BE endpoint gate → no FE-show-BE-block mismatch + no FE-hide-BE-allow hole. PRO cột giữ `drafterEditable` (/budget-adjust unchanged) · Dự-án cột hardcode `—` (chưa wire, an toàn). Budget=0 hợp-lệ (`GTE(0).When(HasValue)`, test `ZeroValue_IsValid`). **Submit-guard PROOF untouched:** `grep CcmBudgetPeriod` trong Infrastructure/Services = ZERO; `missingForApproval` chỉ build trên `BudgetPeriodAmount`(PRO)+ProInitial fallback (Mig 58 "0 valid only null block"). Class `[Authorize]` any-auth controller (gotcha #44 N-A: write-endpoint fine-grained Forbidden). 7/7 new authz test PASS (Admin/CCM allow · Drafter/Procurement deny · null-clear absolute-set · NotFound-before-authz). Full suite 45+357=**402 PASS** (395+7). fe-admin+fe-user tsc 0 + 2-app byte-identical (§3.9) + Mig 3-file OK. **Lane [math] (sibling, kept):** per-cột độc-lập đúng — `colCalc(periodAmount,colFull,remaining)` đóng-gói r3/r5/r7/r8/r9+3 cmp KHÔNG cross-cột (`pro=colCalc(draftRow3,proFull,draftRow8)` · `ccm=colCalc(draftCcmRow3,ccmFull,null)`); số chung row1/2/4/6 KHÔNG nhân per-cột (r5=row1+r3 cột, cmpPeriod=r3-row4 chung, cmp56=r5-row6 chung). **Div-by-0 safe:** `fmtPct(num,denom)=denom>0?...:null` + consumer `{pct&&...}` guard → cột full=0/null KHÔNG NaN/Infinity; Dự-án cột hardcode "—" KHÔNG vào colCalc. CCM r8=default(r7) đúng spec (chưa có field CCM-remaining). **#70 note:** new ccmPeriodMut single-field body (no sibling echo) + thêm `||peFetching` gate = clean; PRO adjustMut 2-field-echo KHÔNG peFetching-gate = PRE-EXISTING (base HEAD unchanged, spec "PRO giữ luồng hiện có") không phải regression. Authz mirror byte-exact `UpdatePeSuggestedPriceCcm` (NotFound→Forbidden order, fail-closed Admin|CostControl). Build slnx 0-err + test-proj rebuild 0-err (MSB3030/3026 = Dropbox bin-lock flake, benign) + 7/7 new authz test PASS + fe-admin tsc 0 + 2 app byte-identical (mirror §3.9). Mig 3-file OK. DTO positional slot line-up OK.
-- **S82 (2026-06-21) Harness-15-v2 adopt review (governance delta, 0 code) — 3/3 lane PASS:** floor-completeness + faithfulness + honesty-regression, all clean ("genuine PASS not courtesy"). Caught 3 MINOR (đã fix): volume "~42K" stale trong mark · mark What-cell mang nội-dung S82 mà status ghi "anh-confirm S81" → flag pending-confirm · `_index` pending. **Memory-note (chống false-alarm):** `broadcasts/_index.md` sha = notify's **self-declared `content_sha256`** (frontmatter), KHÔNG recompute full-file/body → đừng flag index-vs-file "mismatch" trước khi đọc frontmatter field. **Stamped-mark mid-session edit OK** khi chỉ refresh What-cell content của decision đã-confirm + status flag pending (KHÔNG mint RC-sig mới, KHÔNG đổi tier) = accuracy-keeping, không phải frozen-record breach.
-- **S76 (2026-06-19) PE budget ma-trận 3 cột Mig 56 + badge display-only — PASS:** MAJOR race = 2 PRO cell cùng-cột share mutation + echo sibling từ `bs` + fire-and-forget `invalidate()` → data-loss window (fixed **gotcha #70** useIsFetching gate). Badge role-set MUST mirror gate bit-for-bit (đảo-chiều set-lookup = forward Roles.Contains). **SURPRISE:** spec "KHÔNG migration" FALSE (diff bundle Part1+2+3) — đừng tin scope-framing em-main, đọc changed-set thật. → _INDEX S76 Part1/Part2+3.
-- **S72/S72bis/S72ter/Q2 (2026-06-18) Mig 54 PE giá-đề-xuất + CCM-finalize OPT-IN — financial go-live PASS:** fail-closed guard ORDER = throw TRƯỚC mọi set `Phase=DaDuyet`; no-deadlock proof = submit-guard invariant (`winnerQuoteTotal>0`) forward-trace tới finalize candidate-set (FE `length===0` branch unreachable); finalize-bypass = 3 gate trực-giao (approver-match ∩ role=CostControl ∩ amount<threshold) + server-recompute amount KHÔNG trust-client; isSystem-exempt = dead-branch single-caller-proof. → _INDEX S72*.
-- **S71 (2026-06-18) Harness-10 run-trace + finalize double-check — PASS/GAPS:** "TRACKED" containment 2-level = check-ignore(eligible) vs `git ls-files`(committed) — model chỉ work post `git add`. "Hoàn chỉnh toàn bộ" audit phải check `budget.json` measured-bytes vs DISK (over-cap re-accumulate mỗi session). → _INDEX S71*.
-- **S69 (2026-06-17) Office re-skin + golive authz — PASS:** re-skin logic-preservation proof = `grep api-call + queryKey sorted -u` byte-equal OLD-vs-NEW (nhanh+rigorous hơn đọc từng hunk); public-grant security = granted root NOT inherit-root (no sibling cascade gotcha#44-family) + menu-key KHÔNG dùng làm controller `[Authorize(Policy=)]` (Office=class-`[Authorize]`+Roles=Admin → CanCreate FE-only, không escalate API write). color-trap: accent thiếu -800 stop = silent no-class Tailwind v4. → _INDEX S69*.
-- **S65 (2026-06-16) public HRM Hồ sơ + PE mục E — PASS:** upgrade-path phải MUTATE row (`if(!row.CanRead){...}`) KHÔNG skip-existing khi prior revoke pre-set flag false (fix S58-class); menu-hide ≠ API-lock (class-`[Authorize]` controller data reachable direct-URL bất kể menu). hyperlink free-text = no server-side XSS. → _INDEX S65*.
-- **S88 (2026-06-25) Fidelity-gate `/sleep-recovery-memory-l2` gist distill (test-specialist L2) — FAIL (1 fabrication-by-merge):** gist MERGE 2 episode gotcha#57 (S51-HRM + S52-Master) vào C-A cluster, KẾT-LUẬN span cả 2 Code-list `{Departments|Projects|Suppliers|LeaveTypes|ShiftPatterns}.Code` NHƯNG gán **"in Mig 45"** cho TOÀN cluster. Verbatim chỉ tie Mig 45→2 HRM config; S52-Master record CỐ Ý ghi "migration" KHÔNG số (vì fix ở mig riêng sau). Canonical CLAUDE.md xác nhận Master filtered-unique = **Mig 47** không phải 45 → gán SAI affirmatively cho Master half. **Anti-pattern: merge-distill fabricates false specificity — gán 1 token dùng-chung (`Mig 45`) cho cluster span N episode khi chỉ 1 episode mang số đó.** Phase-3a deterministic token-PRESENCE pass (ratio 92%, 30 token present, mojibake-clean) BLIND tới cross-episode mis-attribution — đúng lý do QUALITY gate đứng SAU presence gate. Mọi thứ khác faithful: 2 episode-distinct fact (S51 2-GREEN-Vehicle/Driver-Mig44 + S52 3-ALL-RED) giữ riêng, HRM-ref correction `active-count plain DbSet / all-count IgnoreQueryFilters()` không embellish, FIFO caveat (185/191/200 flag episode-local), 4 back-resolve substring count=1 unique, OtWeighted=12.0m + SLA 4/8/24/72h + Serializable-SQLite-NON-ISSUE khớp. Fix hẹp = đừng gán Mig-number cho Master half (giữ vagueness verbatim hoặc split per-episode).
+- **S92 (2026-06-29) Adversarial PROD-security hide 5 menu-groups admin-only on eoffice (uncommitted) — PASS (0 blocking, 1 awareness note):** A-E all upheld; CatalogManager Danh-mục access stripped (intended-by-spec, role assigned to 0 users post-S89, flag em-main only). Detail + per-attack file:line → [project_s92_admin_only_modules_revoke.md](project_s92_admin_only_modules_revoke.md).
+- **S91 (2026-06-25) PE D2 create-contract 1→N multi-winner + winner-names (FROZEN, NOT-deployed) — PASS:** fix for S89-bis dead-end; codegen mid-loop SaveChanges flushes ONLY seq-row (contract built LOCAL); GiaTri per-winner Quote-sum join PES.Id; positional DTO arg-order verified 3 sites; FE mirror byte-identical; 419 PASS. Detail → `archive/2026-06.md`.
+- **S90 (2026-06-25) PE stability-fix batch D1 (5 chg+11 test, FROZEN) — PASS:** Block B re-key SelectedSupplierId→IsWinner (single unchanged proven); CEO-notify SaveChanges (was Add-but-never-flush); HoSoLink null-safe+clear-via-empty option(b); #70 ||peFetching 2 PRO cells; 413 PASS. Detail → `archive/2026-06.md`.
+- **S89-bis (2026-06-25) AREA-6 FE-consumers (PE FROZEN, investigator verify) — 4/4 confirm + 1 NEW miss:** all 4 hold; NEW catch = create-contract joint-winner DEAD-END (FE shows button on `some(isWinner)` but BE hard-blocks `SelectedSupplierId is null`). Anti-pattern: single→multi conversion stops at detail-display layer. Detail → `archive/2026-06.md`.
+- **S89 (2026-06-25) AREA-4 workflow-edit (PE FROZEN, investigator verify) — 3 confirm/1 do-not-touch:** HoSoLink #73-class clear-on-partial-edit CONFIRMED + NEW 2nd destructive call-site (PeDetailTabs:817 InfoTab.save omits hoSoLink). Anti-pattern: echo-all-siblings convention rots when NEW absolute-set field added. Detail → `archive/2026-06.md`.
+- **S86 (2026-06-24) PE Section B 3-cột Dự-án|PRO|CCM (Mig 59) — PASS:** authz byte-mirror UpdatePeSuggestedPriceCcm (NotFound→Forbidden, fail-closed); FE `canEditCcm` KHỚP BIT-EXACT BE gate; submit-guard untouched (grep CcmBudgetPeriod in Services=ZERO); div-by-0 safe; 402 PASS. Detail → `archive/2026-06.md`.
+- **S82 (2026-06-21) Harness-15-v2 adopt review (0 code) — 3/3 lane PASS:** caught 3 MINOR. Memory-note: `broadcasts/_index.md` sha = notify self-declared `content_sha256` frontmatter NOT recompute → don't flag index-vs-file mismatch before reading frontmatter. Stamped-mark mid-session edit OK if only refresh confirmed-decision What-cell.
+- **S76 (2026-06-19) PE budget 3-cột Mig 56 + badge — PASS:** MAJOR race fixed gotcha #70 (useIsFetching gate). Badge role-set MUST mirror gate bit-for-bit. SURPRISE: spec "KHÔNG migration" FALSE — đọc changed-set thật, đừng tin scope-framing em-main. → _INDEX S76.
+- **S72* (2026-06-18) Mig 54 PE giá-đề-xuất + CCM-finalize OPT-IN — financial go-live PASS:** fail-closed guard throw BEFORE set Phase=DaDuyet; finalize-bypass = 3 orthogonal gate + server-recompute amount no-trust-client. → _INDEX S72*.
+- **S71 (2026-06-18) Harness-10 run-trace — PASS/GAPS:** "TRACKED" 2-level = check-ignore(eligible) vs git-ls-files(committed), model only post `git add`. → _INDEX S71*.
+- **S69 (2026-06-17) Office re-skin + golive authz — PASS:** re-skin proof = grep api-call+queryKey sorted -u byte-equal; public-grant = granted root NOT inherit-root (no sibling cascade); accent missing -800 stop = silent no-class Tailwind v4. → _INDEX S69*.
+- **S65 (2026-06-16) public HRM Hồ sơ + PE mục E — PASS:** upgrade-path MUST MUTATE row (`if(!row.CanRead){...}`) NOT skip-existing when prior revoke pre-set false (S58-class); menu-hide ≠ API-lock. → _INDEX S65*.
+- **S88 (2026-06-25) Fidelity-gate L2 gist distill (test-specialist) — FAIL (1 fabrication-by-merge):** gist gán "Mig 45" cho cluster span 2 episode khi chỉ 1 mang số đó (Master = Mig 47). Anti-pattern: merge-distill fabricates false specificity; token-PRESENCE pass BLIND to cross-episode mis-attribution → QUALITY gate after presence gate. Detail → `archive/2026-06.md`.
 
 ---