wal: flush 20260727T1250

.claude/agent-memory/cicd-monitor/MEMORY.md

@@ -1,7 +1,8 @@
 # CI/CD Monitor Agent — Persistent Memory
 
-- **07-23 verify 4510cea (App: chuẩn-hóa mã dự-án normalize + PE attach-gate FE both-apps) [em-main spawn, return CLEAN]:** VERDICT **PASS 5/5** — Run **#407** (id=521) success ~5m36s (17:11:54→17:17:30+07); gate **532 EXACT từ log** (45 Domain + 487 Infra, 0 fail/skip) — **+4 vs prev run #406/8b6df0a (483I)** = 4 `ProjectCodeNormalizationTests` (delta-proof: dotnet summary KHÔNG in tên-test riêng → dùng delta prev-run + build-success + all-pass). NO-Mig: `git diff 8b6df0a..4510cea -- *Migrations*` EMPTY + prod history-top `AddPeApprovedBudgetSnapshot` (Mig 67, từ S133 KHÔNG phải push này) = repo-HEAD unchanged + sys.tables **89** — code-only no-drift by-construction. **Bundle JS rotate cả 2 app / CSS FROZEN cả 2** (đúng dự-đoán — PeDetailTabs.tsx ×2 = pure button-gating logic, no new Tailwind utility): admin js `DGPE6Nkb`→**`B2j1LQ-v`** css `CBzUlgOA` frozen · eoffice js `DlTwAgJj`→**`C3wbJegk`** css `BHsBUA8e` frozen; real-size 1.660.902/1.567.232B, LM 17:16:01/17:16:54+07 in-window; SPA-trap control fake-hash `index-ZZfakehash0.js`=900B **ct=text/html** (discriminator OK). smoke 4×200 (health/live+ready, admin, eoffice). Baseline shift: **Infra 464(S118)→483(run406)→487**, Mig-latest = **Mig 67** ("Mig 66" essentials-line STALE — updated). Pre-deploy snapshot captured WHILE running (đúng bài #242 verify-post-success). Tag `[run-407, pass-5-5, js-rotate-css-frozen, delta-proof-+4, code-only-no-mig]`
+- **07-27 verify b1bae77 (Workflow: quy-trình duyệt TẠI CHỖ + cờ F6 `AllowApproverDelete` đợt-1) [S155, MIG-BEARING deploy, CLEAN-return]:** VERDICT **PASS 6/6** — Run **#416** (id=529) success **5m31s** (12:37:18→12:42:49+07); gate **551 EXACT từ log** (45 Domain + **506** Infra, 0 fail/skip) — **+19 vs run #407 (532)**, **KHỚP CHÍNH XÁC số lead đo local (551)** = cross-check 2-nguồn. **Mig 68 `20260727033522_AddPeAllowApproverDelete` VERIFIED-APPLIED-PROD** (AddColumn `AllowApproverDelete` bit NOT NULL default `(CONVERT([bit],(0)))` trên `ApprovalWorkflowLevels`; history-TOP + `INFORMATION_SCHEMA.COLUMNS` **cả 2 cùng có ⟹ không lệch**; sys.tables **89** giữ nguyên đúng AddColumn-no-new-table). 🔑 **Reviewer FLAG F8 (mig-file rớt khỏi commit ⟹ `Invalid column name` hạ 7 module V2) LOẠI TRỪ bằng 3 lớp:** (i) pre-deploy baseline 12:38 history-top còn `AddPeApprovedBudgetSnapshot` ⟹ mig áp TRONG cửa-sổ này không phải sẵn có; (ii) smoke 8/8 HTTP 200 `Invalid column name`=0 (PE·HĐ·Đề-xuất·Nghỉ-phép·Tăng-ca·Công-tác·Đặt-xe + AwV2); (iii) **phép mạnh nhất = `GET /api/approval-workflows-v2` trả `allowApproverDelete` ×54 materialize qua EF từ DB thật** — DB thiếu cột thì chính query này đã ném. Endpoint mới `PUT /api/approval-workflows-v2/{id}` no-token → **401** + **control route bịa → 404** (discriminator sạch, 401 có nghĩa). Bundle **JS rotate CẢ 2** (admin `hHISK1Ig`→**`CiUBEEJr`** css `CBzUlgOA`→**`DX5ew0wg`** rotate; eoffice `CJeXZso2`→**`DFh7GK0t`** css `BHsBUA8e` **FROZEN** = #69-REFINE lành tính, 2 file fe-user là logic/type no-new-utility) real-size 1.670.035/1.570.257B, LM 12:41:28/12:42:22+07 **in-window**; byte-verify #77 marker `allowApproverDelete` admin ×7 / eoffice ×1 ⟹ đúng mã F6 đã ship. SPA-trap control `ct=text/html` 900/876B. health live+ready 200. Tag `[run-416, pass-6-6, mig-bearing, F8-averted-3-layer, col-materialize-x54, js-rotate-both, gate-551-khớp-local]`
 
+- _(**S135 #407 `4510cea` mã-dự-án normalize + PE attach-gate GO 5/5** — gate 532 [45+487, +4 delta-proof]; NO-Mig `git diff -- *Migrations*` EMPTY + history-top unchanged; js-rotate/css-frozen ×2 · verbatim → `archive/2026-07.md` @S155-curate)_
 - _(**S134 #399 `6664a61` PE lũy-kế tạm-tính (0-mig) GO 5/5** — gate 528 [45+483, +8 PePendingAccumulation]; js+css rotate ×2 admin `BVCukFP5`/`CBzUlgOA` eoffice `DoxyEOxh`/`BHsBUA8e`; byte-verify #77 urllib-BYTES; 🔑 **ct=text/html discriminator SẠCH HƠN size-919B** [shell size drift per-build]; `body.count(marker.encode())` bulletproof cp1252 · verbatim → `archive/2026-07.md` via `_INDEX`)_
 - _(**S133 #398 `d4fbced` PE budget-freeze + Mig 67 `AddPeApprovedBudgetSnapshot` APPLIED-PROD GO 5/5** — gate 520 [45+475]; 11-col ApprovedBudget\* + backfill 18/18 DaDuyet + 89-table; js+CSS rotate ×2 [badge utility-class → CSS content-hash đổi, benign #69]; python text=True crash cp1252 → text=False bytes+json.loads · verbatim → `archive/2026-07.md` via `_INDEX`)_
 
@@ -61,9 +62,9 @@ cicd-spawn đôi khi trả memory-curation slice ("Compressing S112/S111") thay
 - **Gitea:** `git.baocaogiaoduc.vn/vietreport-admin/solution-erp` · workflow `.gitea/workflows/deploy.yml` · paths-ignore 7-entry (D10 S111 #495): `['docs/**','**/*.md','.claude/skills/**','.claude/agent-memory/**','.claude/workflows/runs/**','.gitignore','scripts/**.md']`. Anon API works (public repo) when GITEA_TOKEN absent.
 - **Prod:** api/admin/eoffice `.solutions.com.vn` · SSH `ssh vietreport-vps` (Administrator, id_ed25519) · IIS phys paths: API `C:\inetpub\solution-erp\api` · admin `\fe-admin` · user `\fe-user`. DB `.\SQLEXPRESS`/`SolutionErp`/`vrapp` SQL-auth. **Conn key = `ConnectionStrings.Default` (NOT `DefaultConnection`)**. DB pw = `buKL3TGBkD0wDDbYVw65QeX9` (User Id=`vrapp`; ⚠️ Password field has NO `vrapp/` prefix — S89 login-failed when prefix included; read verbatim from prod `appsettings.Production.json` ConnectionStrings.Default when `$env:PROD_DB_PASSWORD` empty). ⚠️ skill-doc path `C:\inetpub\apps\SolutionErp\Api` STALE.
   - **SSH→PS quoting (S42):** nested bash→ssh→powershell mangles `$var`/`\"` → use `iconv UTF-16LE | base64` → `powershell -EncodedCommand $B64`; OR write ps1-file + `powershell -File $(cygpath -w)`. sqlcmd over SSH direct `-W -h -1` pw-inline. sys-catalog string-concat → `COLLATE DATABASE_DEFAULT` (collation conflict).
-- **Tests baseline:** **532 PASS** (45 Domain + 487 Infra · 0 fail/skip; run #407 `4510cea` 07-23; prior climb 528/520/509/505/501/495/486/458/440/421). Phase 9 UAT skip OK. 🔑 **Concrete count via web-UI log `https://git.baocaogiaoduc.vn/vietreport-admin/solution-erp/actions/runs/{run_number}/jobs/0/logs` (~18KB, NO `/api/v1/` prefix — api/v1 runs+tasks logs BOTH 404) → per-project `Passed! - Failed: 0, Passed: N, Skipped: 0`. Delta-proof new-tests = compare prev-run count (dotnet summary hides names). status=success alone ⟹ gate-passed (tests pre-deploy).**
-- **Mig latest repo: Mig 67 `AddPeApprovedBudgetSnapshot`** (`20260717032812`, S133 `d4fbced` — PE freeze-budget 11-col AddColumn + backfill 18/18, no-new-table; VERIFIED-APPLIED-PROD history-top + sys.tables **89**). Prev Mig 66 `AddPeApprovedPriceRange` / 65 backfill-invariant / 62 `ExpandSupplierFields` (full table → docs/CLAUDE.md). Path `src/Backend/SolutionErp.Infrastructure/Persistence/Migrations/` (67 `.cs` excl Designer/Snapshot). Prod check `sqlcmd __EFMigrationsHistory ORDER BY MigrationId DESC`. ⚠️ **`sys.tables`(is_ms_shipped=0)=89** — AddColumn/data-only/enum-additive don't change count; no-new-table commit ⟹ 89 correct, don't FAIL. **NO-Mig proof = history NOT-advance + empty `git diff <base>..<head> -- '*Migrations*'`.**
-- **Bundle hash live:** ship-baseline = run #407 (07-23) admin js `B2j1LQ-v`/css `CBzUlgOA` · eoffice js `C3wbJegk`/css `BHsBUA8e` (real-size 1,660,902/1,567,232b; LM 17:16:01/17:16:54+07). PER #69 TWO-MODE = SNAPSHOT-per-run NOT stable-baseline (rotate on real-src, freeze byte-id on 0-src) — ALWAYS re-snapshot LIVE post-success; **ship-proof = LM-in-window + real-size (vs 900b `ct=text/html` SPA-trap) + marker-grep, NOT hash-delta**. js-rotate/css-frozen = FE-logic-no-style fingerprint (S134-refine: `ct=text/html` cleaner discriminator than 919b, shell size drifts per-build). ⚠️ id≠run_number (head_sha-keyed).
+- **Tests baseline:** **551 PASS** (45 Domain + 506 Infra · 0 fail/skip; run #416 `b1bae77` 07-27; prior climb 532/528/520/509/505/501/495/486/458/440/421). Phase 9 UAT skip OK. 🔑 **Concrete count via web-UI log `https://git.baocaogiaoduc.vn/vietreport-admin/solution-erp/actions/runs/{run_number}/jobs/0/logs` (~18KB, NO `/api/v1/` prefix — api/v1 runs+tasks logs BOTH 404) → per-project `Passed! - Failed: 0, Passed: N, Skipped: 0`. Delta-proof new-tests = compare prev-run count (dotnet summary hides names). status=success alone ⟹ gate-passed (tests pre-deploy).**
+- **Mig latest repo: Mig 68 `AddPeAllowApproverDelete`** (`20260727033522`, S155 `b1bae77` — AddColumn `AllowApproverDelete` bit NOT NULL def-0 trên **`ApprovalWorkflowLevels`**, no-new-table; VERIFIED-APPLIED-PROD history-top + col-present + sys.tables **89**). Prev Mig 67 `AddPeApprovedBudgetSnapshot` / 66 `AddPeApprovedPriceRange` / 65 backfill-invariant / 62 `ExpandSupplierFields` (full table → docs/CLAUDE.md). Path `src/Backend/SolutionErp.Infrastructure/Persistence/Migrations/` (68 `.cs` excl Designer/Snapshot). Prod check `sqlcmd __EFMigrationsHistory ORDER BY MigrationId DESC`. ⚠️ **`sys.tables`(is_ms_shipped=0)=89** — AddColumn/data-only/enum-additive don't change count; no-new-table commit ⟹ 89 correct, don't FAIL. **NO-Mig proof = history NOT-advance + empty `git diff <base>..<head> -- '*Migrations*'`.**
+- **Bundle hash live:** ship-baseline = run #416 (07-27) admin js `CiUBEEJr`/css `DX5ew0wg` · eoffice js `DFh7GK0t`/css `BHsBUA8e` (real-size 1,670,035/1,570,257b; LM 12:41:28/12:42:22+07). PER #69 TWO-MODE = SNAPSHOT-per-run NOT stable-baseline (rotate on real-src, freeze byte-id on 0-src) — ALWAYS re-snapshot LIVE post-success; **ship-proof = LM-in-window + real-size (vs 900b `ct=text/html` SPA-trap) + marker-grep, NOT hash-delta**. js-rotate/css-frozen = FE-logic-no-style fingerprint (S134-refine: `ct=text/html` cleaner discriminator than 919b, shell size drifts per-build). ⚠️ id≠run_number (head_sha-keyed).
 - **Bearer:** admin `admin@solutions.com.vn/Admin@123456` (full) · UAT `nv.test@solutions.com.vn/TestUser@123456` (Drafter CCM, gotcha #44 check).
 - **API Serilog log (S118 correction):** real sink = `C:\inetpub\solution-erp\api\logs\solution-erp-YYYYMMDD.log` (lowercase `logs`, rolling daily). ⚠️ skill-runbook path `…\Logs\log-YYYYMMDD.txt` STALE → empty grep. MinimumLevel Default=Information (DbInitializer `LogInformation` seed/revoke lines DO persist) — Microsoft/System overridden Warning (no "Now listening" INFO). **Startup seed-race audit pattern (durability deploys):** grep this log for revoke-line THEN seeder-line same-second → "N added + M upgraded" proves seeder actively flipped rows revoke knocked down (0-upgraded = seeder no-op = FAIL flag).
 

.claude/agent-memory/cicd-monitor/archive/2026-07.md

@@ -38,3 +38,8 @@
 - **S133 (07-17) verify d4fbced PE budget-freeze [wf_4eadbcf6-c25, return sạch — verdict landed SAU khi lead /pause; harvest-liền lúc notification, lead CHƯA re-verify độc lập]:** VERDICT **GO 5/5** — Run **#398** success ~5.5m (gate **520** = 45D+475I, 0 fail/skip); Mig 67 prod: history-top + **11 cột ApprovedBudget\* exact** + backfill **18/18 phiếu DaDuyet chua=0** + sys.tables **89** no-new-table; bundle rotate ×2: admin js `yCkX-2Bp`→**`3NCdyODe`** css `CXD7q9xH`→**`B--dUHcm`** · eoffice js `DKSD4p9k`→**`CKsoiNCI`** css `CjwZwYJo`→**`BuntB63r`**, real-size 1.657.025/1.563.373B, LM 11:18:42/11:19:36+07 in-window; byte-verify #77: `budgetFrozen`=1 + `Ngân sách chốt tại thời điểm duyệt`=1 cả 2 js mới, old-hash control = 900B SPA-trap 0-hit; smoke 4×200 + PE 401-secured. **Surprise: CSS CŨNG rotate cả 2 app** (spec đoán "CSS có thể frozen") — PeDetailTabs badge sinh utility-class mới → content-hash đổi theo content, benign #69; phá streak bundle-FROZEN S129-S132. Lesson tool: python `capture_output text=True` crash cp1252 trên title CI tiếng Việt → dùng `text=False` bytes + `json.loads(bytes)`; foreground sleep bị chặn → `python time.sleep` poll-loop OK. Tag `[s133, run-398, go-5-5, css-rotate-benign, mig67-backfill-18]`
 
 - **S134 (07-17) verify 6664a61 PE lũy-kế tạm-tính [wf_f366f38d-498 · return CLEAN no-garble] `[engine: opus-worker]`:** VERDICT **GO 5/5** — Run **#399** (id=513) success 5m27s (14:27:29→14:32:56+07); gate **528 EXACT từ log** (45D+483I, +8 PePendingAccumulationTests); Mig 67 top FROZEN + sys.tables 89 (0-mig by-construction, `git diff -- *Migrations*` empty); bundle rotate ×2 admin js `3NCdyODe`→**`BVCukFP5`** css `B--dUHcm`→**`CBzUlgOA`** · eoffice js `CKsoiNCI`→**`DoxyEOxh`** css `BuntB63r`→**`BHsBUA8e`** (FE-src đổi 6 file ⇒ rotate expected; CSS = amber utilities benign #69), real-size 1.659.037/1.565.367B + LM in-window; **byte-verify #77 qua python urllib BYTES**: `pendingPriorPes`=2 + `Tạm tính`=3 + `phiếu trước cùng gói thầu CHƯA duyệt`=2 cả 2 js, control old-hash 900B **ct=text/html** 0-hit; smoke 4×200 + PE 401. Learned: (1) **urllib bytes + `body.count(marker.encode())` = bulletproof cp1252** cho marker tiếng Việt (khác subprocess text=True crash S133); (2) **ct=text/html là SPA-trap discriminator SẠCH HƠN size-919B** (shell size drift per build — 900B lượt này); (3) tasks-API có thể blip empty-200 transient → poll-loop absorb. Poll held-off verify khi running (iter 0-2) đúng bài #242. Tag `[s134, run-399, go-5-5, ct-html-discriminator, urllib-bytes-marker]`
+
+
+## Run #407 `4510cea` (2026-07-23) — moved from L1 @S155 curate, byte-exact
+
+- **07-23 verify 4510cea (App: chuẩn-hóa mã dự-án normalize + PE attach-gate FE both-apps) [em-main spawn, return CLEAN]:** VERDICT **PASS 5/5** — Run **#407** (id=521) success ~5m36s (17:11:54→17:17:30+07); gate **532 EXACT từ log** (45 Domain + 487 Infra, 0 fail/skip) — **+4 vs prev run #406/8b6df0a (483I)** = 4 `ProjectCodeNormalizationTests` (delta-proof: dotnet summary KHÔNG in tên-test riêng → dùng delta prev-run + build-success + all-pass). NO-Mig: `git diff 8b6df0a..4510cea -- *Migrations*` EMPTY + prod history-top `AddPeApprovedBudgetSnapshot` (Mig 67, từ S133 KHÔNG phải push này) = repo-HEAD unchanged + sys.tables **89** — code-only no-drift by-construction. **Bundle JS rotate cả 2 app / CSS FROZEN cả 2** (đúng dự-đoán — PeDetailTabs.tsx ×2 = pure button-gating logic, no new Tailwind utility): admin js `DGPE6Nkb`→**`B2j1LQ-v`** css `CBzUlgOA` frozen · eoffice js `DlTwAgJj`→**`C3wbJegk`** css `BHsBUA8e` frozen; real-size 1.660.902/1.567.232B, LM 17:16:01/17:16:54+07 in-window; SPA-trap control fake-hash `index-ZZfakehash0.js`=900B **ct=text/html** (discriminator OK). smoke 4×200 (health/live+ready, admin, eoffice). Baseline shift: **Infra 464(S118)→483(run406)→487**, Mig-latest = **Mig 67** ("Mig 66" essentials-line STALE — updated). Pre-deploy snapshot captured WHILE running (đúng bài #242 verify-post-success). Tag `[run-407, pass-5-5, js-rotate-css-frozen, delta-proof-+4, code-only-no-mig]`