[CLAUDE] Docs: S51 session-end closeout — error-ledger §L + monitor spawn-records + root counts

§L.a/b: E-002 RESOLVED (gotcha #57 LeaveType/Shift/OtPolicy filtered Mig 45) + NEW E-007/AS-11 (parallel-fan-out FE<->BE contract mismatch, reviewer-caught pre-commit) + Active-Guards (#57 guard 2->3 verified + reviewer cross-stack guard). H2 GATE PASS 5/5 + H1 CHOT 4-mat spawn-records appended (both wrote 0 files - E-006 backstop held). CLAUDE.md root counts 43->45 mig / 91->92 tables / 181->186 test. HANDOFF: database-agent /adap-apply recommend next-session + doc-drift backlog coords. CI-skip (docs/.md only).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/governance/error-ledger.md

@@ -29,6 +29,7 @@ Detect by **action-signature** (NOT "AI tự phán có vi phạm không"). Scan
 | AS-8 | session-end memory `.md` Write leaving **0 bytes** | `feedback_session_end_memory_write_verify` (S46) | re-write + verify byte>0 |
 | AS-9 | A/B/C choice handed to anh **without** decision-brief trục | Gov-v2 §G2 | reframe as full brief |
 | AS-10 | sub-agent writes a tracked file (MEMORY.md / code) despite **R1 return-only** (Write/Bash residual) | R1 return-only (HMW) — prompt-rule, NOT mechanized (G-015) | git-diff post-P2 catch → lead VERIFY benign+accurate+placement → keep or revert (NOT a bug if correct; chunk-count for RAG-write) |
+| AS-11 | cross-stack feature: BE validator/nullability ≠ FE required-marker for the SAME field | em-main shared-contract consistency (E-007) | RCA + align FE↔BE + reviewer-gate (held S51) |
 
 ## 🛡️ Active-Guards index (2-strike promote: episodic → procedural)
 
@@ -38,7 +39,8 @@ Detect by **action-signature** (NOT "AI tự phán có vi phạm không"). Scan
 |---|---|---|---|---|---|
 | CI `paths-ignore` docs-only skip | gotcha #41 (AS-6) | procedural | 2 | ✅ (every docs commit 0s) | +++ |
 | em-main verify-on-disk + proxy-append after agent return | gotcha #53 truncation | procedural | 5× (S35-S42) | ✅ | +++ |
-| test-before bug-fix + soft-delete-UNIQUE `.HasFilter` | gotcha #57 (AS-4) | procedural | 2 (Holiday S45 + latent LeaveType/Shift) | ✅ Mig 43 | ++ |
+| test-before bug-fix + soft-delete-UNIQUE `.HasFilter` | gotcha #57 (AS-4) | procedural | 3 (Holiday S45 · LeaveType/Shift/OtPolicy S51) | ✅ Mig 43 + Mig 45 (5 test RED→GREEN) | ++ |
+| reviewer pre-commit on cross-stack / wire-BE-CRUD (contract-mismatch net) | E-007 (AS-11) | procedural | 1 (S51 Driver FE↔BE) | ✅ S51 (caught pre-commit, fixed before deploy) | ++ |
 | authz regression test per-action policy | gotcha #44 silent-403 | procedural | 1 (promoted S45 +10 test) | ✅ | ++ |
 | agent frontmatter `model: inherit` (not `[1m]`) | gotcha #37 | procedural | — | ✅ (FD agent loaded S48) | ++ |
 | **lead = sole RAG-writer** (`store_memory` stripped, mechanized) | store_memory rebootstrap-loss (S41) + AS-3 | procedural | 2 (NamGroup + SE S41) | ✅ runtime S48 (0/8 subs) | +++ (failure-safe) |
@@ -51,6 +53,14 @@ Detect by **action-signature** (NOT "AI tự phán có vi phạm không"). Scan
 
 > Format: `E-NNN | date | rule | what | 5-why root | fix (prod-bug = 2-fix: code + guard) | prevention | tags[TYPE/ACTOR/COMPONENT]`
 
+### E-007 — AS-11 parallel-fan-out shared-contract mismatch (S51, reviewer-caught pre-commit)
+- **rule (AS-11 NEW):** cross-stack feature fan-out where BE field nullability/validator ≠ FE required-marker for the SAME field → contract mismatch (empty submit → 400/500). Em-main shared-contract must spec required/optional consistently BOTH sides.
+- **what:** P11-C BE∥FE parallel (file-disjoint) spawn. Driver `phoneNumber/licenseNumber/licenseClass`: BE `NotEmpty()` validator + EF `.IsRequired()` NOT NULL, but FE KIND_CONFIG rendered them OPTIONAL (no `required:true`) → `buildBody` empty→null → 400/500. 186 tests GREEN (no test hit empty-optional path).
+- **5-why:** em-main BE brief said "mirror Vehicle (all-required)" but FE brief omitted `required:true` on those 3 → each implementer faithful to its half → inconsistency invisible until integration (file-disjoint parallel = no cross-talk) → green tests ≠ correct contract.
+- **fix:** (code) FE +`required:true` on the 3 fields (align to BE all-required, like Vehicle — `HrmConfigsPage.tsx:132-134` ×2 app). (guard) reviewer pre-commit on cross-stack = the net that caught it (HELD).
+- **prevention/guard:** Active-Guard "reviewer pre-commit on cross-stack/wire-BE-CRUD" (fired correctly) + NEW discipline: em-main cross-stack brief MUST state required/optional explicitly for EACH shared field (BE validator+nullability AND FE required-marker). AS-11 added to §L.a.
+- **tags:** [contract-mismatch / em-main-brief+implementer-be+fe / HrmConfigsPage,HrmConfigFeatures]
+
 ### E-006 — AS-10 autonomous monitor write at session-end (S50, git-diff-caught)
 - **rule (AS-10):** sub writes a tracked file despite propose-only / R1-return-only (Write/Bash residual) → git-diff catch → lead VERIFY benign+accurate+placement → keep-if-correct or revert.
 - **what:** @S50 `/session-end`, `git status` = **14 modified** but em-main personally edited ~7. Non-em-main writes: `error-ledger.md` (2 guard episodic→procedural promotions + E-002 #57 coords), 3 `adap-reports` (nac→verified-runtime), 4 `agent-memory/*` Recent-activity, + `STATUS.md` (Recently-Done-S50 block / In-Progress flip / RAG-line 2406↔2415 reconcile). mtimes 00:00–00:05 = session-end monitor window; the 2 INFORM-only monitors (tooling-auditor + harvest-curator) were briefed propose-only and **reported "wrote nothing."**
@@ -88,8 +98,8 @@ Detect by **action-signature** (NOT "AI tự phán có vi phạm không"). Scan
 - **what:** `Holidays` DB UNIQUE (Year,Date) unfiltered vs handler `!IsDeleted` → admin delete + re-add same-date holiday = reachable 500.
 - **5-why:** UNIQUE created unfiltered → soft-deleted row keeps the slot → handler allows logical re-create → INSERT hits dead UNIQUE → 500.
 - **fix:** (code) Mig 43 `.HasFilter("[IsDeleted]=0")` (matches 13× existing pattern). (guard) Gap1 test-before reproduced the 500 first.
-- **prevention/guard:** Active-Guard AS-4 + test-before. ⚠️ **OPEN latent (wave-verified S50, exact coords):** `LeaveTypeConfiguration.cs:19` + `ShiftPatternConfiguration.cs:19` bare `.IsUnique()` (no filter) vs fixed `HolidayConfiguration.cs:18 .HasFilter("[IsDeleted] = 0")`; test template = `HrmConfigHolidayTests.cs:180-197` (Case 7). Backlog test-before (2nd strike of this guard).
-- **tags:** [soft-delete-invariant / em-main+test-specialist / Holidays,LeaveType,ShiftPattern]
+- **prevention/guard:** Active-Guard AS-4 + test-before. ✅ **RESOLVED S51 (Mig 45 `FilterHrmCatalogUniqueIndexesByIsDeleted`):** LeaveType + ShiftPattern + **OtPolicy** (OtPolicy was MISSED in "2 catalog" backlog → caught via grep-all-config) now `.HasFilter("[IsDeleted]=0")`; test-before +5 `HrmConfigFilteredUniqueTests` RED→GREEN (guard 2nd strike → now verified). ⚠️ **EXT OPEN (worktree session S51, Mig 46):** Department/Supplier/Project (Master — GLOBAL query-filter quirk auto-hides soft-deleted → recreate reachable); ContractClause/MeetingRoom/EmployeeProfile = audit-SKIP (not-reachable, investigator S51).
+- **tags:** [soft-delete-invariant / em-main+test-specialist / Holidays,LeaveType,ShiftPattern,OtPolicy,(ext)Master]
 
 ### E-001 — S46 user-memory 0-byte (close-out truncation)
 - **rule (AS-8):** memory `.md` writes must persist (byte>0); index must not be empty.