[CLAUDE] Docs: correct live bundle hash + gotcha #69 (cicd Run #312 no-op verify)

cicd-monitor verified Run #312 (commit 18fced6) = true no-op (306 / Mig 53 /
sys.tables 88 / health 4x200, DB untouched). BUT bundle ROTATED
BgNCjwsG/CBvh0vtf -> fc_xkNpJ/DP-tBcg0 despite 0 FE source change.

- gotcha #69: FE bundle hash non-deterministic + deploy.yml rebuilds FE
  unconditionally every run -> bundle rotates even on BE-only/governance commits.
  Corollary: SPA-fallback 200 trap (verify bundle via index.html refs+size, not
  direct GET of hash-named asset). "BE-only => frozen" invariant overturned.
- Correct STATUS/HANDOFF live bundle to fc_xkNpJ/DP-tBcg0; my prior "bundle
  frozen" claim was wrong (cosmetic rotation, prod state/DB unchanged).
- gotcha count 68 -> 69. cicd-monitor MEMORY updated (Run #312 + bundle pattern).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/gotchas.md

@@ -1204,6 +1204,20 @@ for h in resp.points:    # ← .points không phải iterable trực tiếp
 
 ---
 
+### 69. FE bundle hash KHÔNG deterministic + `deploy.yml` rebuild FE vô-điều-kiện mỗi run → bundle ROTATE kể cả commit BE-only/governance (Session 72)
+
+**Triệu chứng:** Commit governance-only (0 FE source change, `git diff fe-*/src <range>` = 0 file) push → CI Run #312 → bundle admin+user ĐỀU ROTATE (`BgNCjwsG`/`CBvh0vtf` → `fc_xkNpJ`/`DP-tBcg0`). Suýt báo "FE thay đổi ngoài ý muốn"; STATUS/HANDOFF/commit đã claim nhầm "bundle frozen".
+
+**Cơ chế:** (1) `.gitea/workflows/deploy.yml` path-filter gate CẢ workflow (chạy/skip toàn-bộ), KHÔNG gate từng step → 1 file non-ignored (vd `.claude/workflows/hmw.js`) đủ trigger → FE rebuild + deploy CHẠY HẾT. (2) Step deploy (`deploy.yml:161-167`) `Remove-Item fe-*\* + Copy-Item dist\*` VÔ-ĐIỀU-KIỆN mỗi run. (3) Vite/rolldown emit content-hash KHÔNG deterministic từ source y-hệt → hash mới mỗi build. ⟹ "BE-only ⟹ bundle frozen" là TRÙNG-HỢP quá-khứ, KHÔNG phải cơ-chế. Bundle rotate = EXPECTED mỗi deploy.
+
+**Guard:** (1) Phát-hiện FE-ship THẬT = `git diff fe-admin/src fe-user/src <range>`, KHÔNG tin hash-delta. (2) **SPA-fallback 200 trap:** `GET /assets/index-<fake>.js` trả 200 (qua `/*`→index.html rewrite) → verify bundle = parse `index.html` refs + check size + `Last-Modified`, KHÔNG GET trực-tiếp asset hash-named. (3) Cosmetic-only, KHÔNG rollback; muốn hết false-alarm → thêm `.claude/**` vào `paths-ignore` (governance commit khỏi trigger deploy).
+
+**Credit:** cicd-monitor S72 Run #312 — flagged-then-resolved bundle rotation trên governance commit `18fced6`; lật ngược invariant "BE-only frozen".
+
+**References:** `.gitea/workflows/deploy.yml:17-30,161-167` · gotcha #41 (path-filter) · gotcha #46 (stale SHA).
+
+---
+
 ## Checklist debug bug mới
 
 1. Build pass không? → fail → check using + package version compat