[CLAUDE] Docs: S118 closeout - STATUS/HANDOFF/session-log + memory reconcile (509 test / gotcha 82)

Session S118: phan quyen PRO tra.bui (Procurement exception to S92 revoke) + va lo hong
ReportsController authz. 2 prod deploy #388/#389 verified; 3 code/docs commit da push
(e88e75d docs-reconcile + c2135ba PRO-perm-seeder + c808b9a Reports-authz).

Closeout (docs/memory-only -> CI-skip per paths-ignore):
- STATUS: S118 mega-line blurb + canonical rows Tests 501->509 + Gotchas 81->82
  (governance-detector [OK] canonical matches disk 509/82).
- HANDOFF: S118 brief + NEXT anh (tra.bui re-login · binh.le decision · account-trung Le-Thanh-Binh)
  + lessons (wipe-durability / menu-flag!=API / verify-lane-garble-recover / Serilog-durability-proof).
- Session log 2026-07-14-S118-perm-pro-tra-bui-reports-authz.md.
- User memory: +feedback_permission_grant_two_layers (menu-flag grant != API-power, 2-layer verify);
  garble-recover x18->x20 (cicd VERIFY-lane x2 -> em-main-solo curl+sqlcmd).
- Agent-memory: cicd fidelity-fix (harvest-curator F1: false "CLEAN-return" label -> garble+recover,
  substance disk-verified TRUE) + tooling-auditor/harvest-curator @end diaries (H1/H2 gate PASS 5-truc).
- H22 §5.0: fold 2 trailing wal: flush commits (670c888 + e5f655f) into this closeout.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.claude/agent-memory/cicd-monitor/MEMORY.md

@@ -14,7 +14,7 @@ Read-only CI/CD + post-deploy verifier SOLUTION_ERP. Polls Gitea Actions API, ve
 
 ## ⚠️ cicd-lane return-garble tracker (#53)
 
-cicd-spawn đôi khi trả memory-curation slice ("Compressing S112/S111") thay verdict (×5/6 qua S114; cumulative ×18 all-agents → [[feedback_agent_return_garble_recover]], root-cause = curate-at-return). Recover: em-main-solo curl-verify. **S115 (#385)+S116 (#386) cicd-lane CLEAN-return no-garble ×2; S117 (#387) garble→SendMessage-resume (em-main curl cross-verify khớp, verdict disk-true) — return-mechanics garbled NHƯNG verdict-substance OK.**
+cicd-spawn đôi khi trả memory-curation slice ("Compressing S112/S111") thay verdict (×5/6 qua S114; cumulative ×18 all-agents → [[feedback_agent_return_garble_recover]], root-cause = curate-at-return). Recover: em-main-solo curl-verify. **S115 (#385)+S116 (#386) cicd-lane CLEAN-return no-garble ×2; S117 (#387) garble→SendMessage-resume (em-main curl cross-verify khớp, verdict disk-true) — return-mechanics garbled NHƯNG verdict-substance OK.** **S118 (#388+#389) cicd-lane garble ×2 → em-main-solo curl+sqlcmd recover (#388 durability tra.bui=20 seed-race "9 upgraded" · #389 Reports.Read→Admin-only+401), both verdict-substance disk-verified OK; curate-at-return root-cause persists (harvest-curator S118-end bắt nhãn "CLEAN-return" tự-dán sai → habitual pattern).**
 
 ---
 
@@ -38,7 +38,7 @@ cicd-spawn đôi khi trả memory-curation slice ("Compressing S112/S111") thay
 - **Stage 0 RAG infra:** `Get-Service Qdrant` Running + `http://localhost:6333/healthz`. Collection `proj_solution_erp`.
 - **Stage 1 Push+filter:** `git log -1 --format='%H %s'` + `git log origin/main..HEAD` empty + diff vs paths-ignore (docs-only → SKIPPED-DOCS return).
 - **Stage 2 Gitea poll** (max 10 iter × 60s): API `.../actions/tasks?limit=5` (NOT `/runs` 404). Match `head_sha` (NOT run_number — cancelled runs shift numbering). ⚠️ `updated_at` stale ~2min (gotcha #46) → cross-check VPS mtime. Foreground-sleep BLOCKED Windows → Monitor-style busy-wait-curl-spin ~30s/iter.
-- **Stage 3 Test gate:** baseline **505 PASS** (45 Domain + 460 Infra; S118 #388 `c2135ba` — 501+4 `ProcurementMasterAccessSeedTests` scope-isolation; Infra 456→460, Domain frozen 45; prior 501 [S117 #387 `316a82f` PE approved-price-range], 495, 486, 477, 458, 440, 436, 434, 421). CI runs both proj BEFORE build/deploy → status=success ⟹ test gate passed (`tasks` terminal=`status:success`, `conclusion` NOT populated — trust success NOT log-numeric). Local grep undercounts (Theory/InlineData). Phase 9 UAT skip OK.
+- **Stage 3 Test gate:** baseline **509 PASS** (45 Domain + 464 Infra; S118 #389 `c808b9a` — 505+4 `AuthorizePolicyRegressionTests` ReportsController Reports.Read gate; Infra 460→464, Domain frozen 45; prior 505 [#388 `c2135ba` ProcurementMasterAccessSeed], 501, 495, 486, 458, 440, 421). CI runs both proj BEFORE build/deploy → status=success ⟹ test gate passed (`tasks` terminal=`status:success`, `conclusion` NOT populated — trust success NOT log-numeric). Local grep undercounts (Theory/InlineData). Phase 9 UAT skip OK.
 - **Stage 4 Post-deploy** (if SUCCESS): auth login bearer (admin + nv.test gotcha #44; token=`accessToken` route `/api/auth/login`) → 3-5 endpoint smoke 2XX (incl new — NEW-endpoint bodyless-POST returns **411 IIS Length-Required pre-auth NOT 404**; re-probe WITH body → 401 confirms wired) → FE bundle hash 2 app (per #69 = real-size-vs-fake not hash-delta) → SignalR negotiate (gotcha #25) → EF mig prod==repo.
   - **Stage 4.6 (S29 CRITICAL):** sqlcmd seed sample verify post-deploy (NOT chỉ schema). Seed=runtime-row-insert (no history/tables advance) → verify via DB-query (e.g. Permissions count), NOT bundle-frozen-alone.
   - Discovery: ASP.NET 10 record enum needs numeric input unless `JsonStringEnumConverter` (SOL has NO converter → FE sends numeric). sqlcmd ssh Windows-auth `\\\\SQLEXPRESS` 4-backslash. INFRASTRUCTURE seed MUST run (NOT inside `if(!demoSeedDisabled)`); DEMO seed gated → gotcha #51.
@@ -56,7 +56,7 @@ cicd-spawn đôi khi trả memory-curation slice ("Compressing S112/S111") thay
 - **Gitea:** `git.baocaogiaoduc.vn/vietreport-admin/solution-erp` · workflow `.gitea/workflows/deploy.yml` · paths-ignore 7-entry (D10 S111 #495): `['docs/**','**/*.md','.claude/skills/**','.claude/agent-memory/**','.claude/workflows/runs/**','.gitignore','scripts/**.md']`. Anon API works (public repo) when GITEA_TOKEN absent.
 - **Prod:** api/admin/eoffice `.solutions.com.vn` · SSH `ssh vietreport-vps` (Administrator, id_ed25519) · IIS phys paths: API `C:\inetpub\solution-erp\api` · admin `\fe-admin` · user `\fe-user`. DB `.\SQLEXPRESS`/`SolutionErp`/`vrapp` SQL-auth. **Conn key = `ConnectionStrings.Default` (NOT `DefaultConnection`)**. DB pw = `buKL3TGBkD0wDDbYVw65QeX9` (User Id=`vrapp`; ⚠️ Password field has NO `vrapp/` prefix — S89 login-failed when prefix included; read verbatim from prod `appsettings.Production.json` ConnectionStrings.Default when `$env:PROD_DB_PASSWORD` empty). ⚠️ skill-doc path `C:\inetpub\apps\SolutionErp\Api` STALE.
   - **SSH→PS quoting (S42):** nested bash→ssh→powershell mangles `$var`/`\"` → use `iconv UTF-16LE | base64` → `powershell -EncodedCommand $B64`; OR write ps1-file + `powershell -File $(cygpath -w)`. sqlcmd over SSH direct `-W -h -1` pw-inline. sys-catalog string-concat → `COLLATE DATABASE_DEFAULT` (collation conflict).
-- **Tests baseline:** **501 PASS** (45 Domain + 456 Infra · 0 fail/skip; S117 #387 `316a82f`; prior 495/486/477/458/440/436/434/421). Phase 9 UAT skip OK. 🔑 **Concrete count via web-UI log path `https://git.baocaogiaoduc.vn/vietreport-admin/solution-erp/actions/runs/{run_number}/jobs/0/logs` (~18KB, NO `/api/v1/` prefix) → per-project `Passed!  - Failed: 0, Passed: N, Skipped: 0`. ⚠️ S117 REFINE: `/api/v1/…/actions/runs/{n}/jobs/0/logs` AND `/api/v1/…/tasks/{id}/logs` BOTH now 404 (Gitea) — ONLY the bare web-UI runs path (no api/v1) returns log body; status=success alone still ⟹ gate-passed (tests run pre-deploy).**
+- **Tests baseline:** **509 PASS** (45 Domain + 464 Infra · 0 fail/skip; S118 #389 `c808b9a`; prior 505/501/495/486/458/440/421). Phase 9 UAT skip OK. 🔑 **Concrete count via web-UI log path `https://git.baocaogiaoduc.vn/vietreport-admin/solution-erp/actions/runs/{run_number}/jobs/0/logs` (~18KB, NO `/api/v1/` prefix) → per-project `Passed!  - Failed: 0, Passed: N, Skipped: 0`. ⚠️ S117 REFINE: `/api/v1/…/actions/runs/{n}/jobs/0/logs` AND `/api/v1/…/tasks/{id}/logs` BOTH now 404 (Gitea) — ONLY the bare web-UI runs path (no api/v1) returns log body; status=success alone still ⟹ gate-passed (tests run pre-deploy).**
 - **Mig latest repo: Mig 66 `AddPeApprovedPriceRange`** (`20260714035636`, S117 `316a82f`; single AddColumn `PurchaseEvaluations.ApprovedPriceMaxAmount decimal(18,2) nullable` — cột giá-chốt MAX của "duyệt theo khoảng Min–Max" src ProMinMax; VERIFIED-APPLIED-PROD `COL_LENGTH=9` + history-top `20260714035636_AddPeApprovedPriceRange` + sys.tables **89 giữ** [AddColumn no-new-table]). Prev Mig 65 `BackfillPeQuoteIsSelectedAndWinnerInvariant` / 64 `AddSupplierPublishState` / 62 `ExpandSupplierFields` (see docs/CLAUDE.md migration table). Path `src/Backend/SolutionErp.Infrastructure/Persistence/Migrations/`. Prod check `sqlcmd __EFMigrationsHistory ORDER BY MigrationId DESC`. ⚠️ **`sys.tables`(is_ms_shipped=0)=89** — AddColumn/data-only don't change count; commit touching no new table ⟹ 89 correct, don't FAIL. enum-additive = int NO-mig (history NOT-advance + empty `git diff -- '*Migrations*'`).
 - **Bundle hash live:** current ship-baseline = S117 #387 (admin js `cFI7ih4a`/css `CfunQHbd` · user js `MxgooVZw`/css `DGqqHQXS`; size 1,656,696/1,563,044b; LM 04:18:21/04:19:16 GMT = 11:18/11:19+07 07-14) — JS-rotate ×2/CSS-frozen from S116 (Dd55jBpj/DVDr1UQ4). See S117 recent-run entry for markers. ⚠️ id≠run_number (head_sha-keyed). PER #69 TWO-MODE hash is SNAPSHOT-per-run NOT stable-baseline (rotate on real-src OR benign-0-src; freeze on 0-src) — ALWAYS re-snapshot LIVE post-success; ship-proof = LM-in-window + real-size (vs 919b SPA-trap) + marker-grep, NOT hash-delta. js-rotate/css-frozen = FE-logic-no-style fingerprint.
 - **Bearer:** admin `admin@solutions.com.vn/Admin@123456` (full) · UAT `nv.test@solutions.com.vn/TestUser@123456` (Drafter CCM, gotcha #44 check).
@@ -77,8 +77,9 @@ BE (test+build) ~90s · FE × 2 ~60s/app · deploy ~30s · **total ~3min code /
 
 ## 📅 Recent runs (compressed — verbatim → archive via `_INDEX.md`)
 
-- **🟢 S117 #387 (rn 387, id 501) `316a82f` PE endsBeforeCeo-pointer-aware + duyệt-theo-khoảng-Min–Max + Mig 66 `AddPeApprovedPriceRange` APPLIED-PROD GO 5m36s (11:14:09→11:19:45+07 2026-07-14; 19-file: BE 7 [Domain/Config/Features/Service/IService/Dtos/Controller] + FE 6 [PeDetailTabs+PeWorkflowPanel+types ×2-app] + Mig 3 + test 2 [NEW PeApprovedPriceFinalizeTests + PeFinalizeProjectionTests mod]):** status=success · **gate CONCRETE web-UI-path `runs/387/jobs/0/logs` (NO /api/v1/): Domain 45 + Infra 456 = 501** (+6 vs S116 495; Infra 450→456, Domain frozen 45; 0-fail/0-skip) · **Mig 66 APPLIED-PROD** sqlcmd `COL_LENGTH('PurchaseEvaluations','ApprovedPriceMaxAmount')=9` + history-top `20260714035636_AddPeApprovedPriceRange` + sys.tables **89 giữ** (AddColumn decimal(18,2) no-new-table) · **FE JS-ROTATE ×2/CSS-frozen** admin js `Dd55jBpj`→`cFI7ih4a` (css `CfunQHbd` frozen) · user js `DVDr1UQ4`→`MxgooVZw` (css `DGqqHQXS` frozen) = FE-logic-no-style fingerprint · byte-verify #77 BOTH-app NEW bundle: `cả Min và Max`=1 + `duyệt theo khoảng`=1 + `ProMinMax`=2 + `Min–Max`(en-dash)=1 PRESENT (all=0 in OLD DVDr1UQ4 captured pre-deploy — NEW-code ship proof; ⚠️ `PRO Min`=1 in OLD = pre-existing label `ProMin:'PRO Min'` = FALSE-discriminator) · size real 1,656,696/1,563,044b (vs 919b SPA-trap) · LM admin 04:18:21/user 04:19:16 GMT = 11:18/11:19+07 IN-window · smoke ALL 200 (api ready+live, admin, eoffice) · PE 401-secured: GET-list no-token+bogus→401, POST /transitions bogus+no-token→401, /select-winner bogus→401 (no 500) · 🔑 pre-deploy bundle-snapshot BEFORE poll-success (captured OLD-hash+OLD-feature=0) → post-success re-snapshot = clean rotation proof. cicd-lane CLEAN-return.
-- _(**S116 #386 `88368fd`** PE-nhập-giá-ÂM ô-báo-giá + submit-guard all-zero [gate 495=45+450, js-rotate×2 D51OYyGV→Dd55jBpj/BVdssm5S→DVDr1UQ4 css-frozen, byte-verify 4-str PRESENT, 🔑 poll-til-success TRƯỚC re-snapshot tránh frozen-trap] **+ S115 #385 `81b59f0`** GOVERNANCE hmw.js+.ps1 non-ignored [gate 486 frozen, bundle FROZEN×4 fresh-LM+identical-size = #69-REFINE 0-src proof, #41 non-.md-in-.claude STILL triggers] **+ S114 #384 `d436af2`** PE multi-NCC per-hạng-mục + Mig 65 backfill-invariant APPLIED-PROD [gate 486, js-rotate×2 acprMqfB→D51OYyGV/Ck3BTDdA→BVdssm5S, byte `trúng thầu theo từng hạng mục`, select-winner 401] — all GO ~5m, FE real-ship, smoke ALL 200 · full verbatim → `archive/2026-07.md` via `_INDEX`)_
+- **🟢 S118 #389 (rn 389, id 503) `c808b9a` SECURITY-AUTHZ gate ReportsController→Reports.Read GO 5m34s (15:55→16:00:57+07 2026-07-14; 3-file: ReportsController.cs [+2 `[Authorize(Policy="Reports.Read")]` on `dashboard`+`contracts/export`; `my-dashboard` kept-open scope-currentUser] + AuthorizePolicyRegressionTests.cs [+4 reflection] + gotchas.md):** status=success · **gate `runs/389/jobs/0/logs`: Domain 45 + Infra 464 = 509** (+4 vs #388 505; Infra 460→464 = +4 authz reflection; 0-fail/skip) · **dll NEW** 15:58:21+07 (was 15:33:21 = app restarted in-window) · **🎯 DB `Reports.Read`→Admin-ONLY** sqlcmd prod (scp .sql→`-i`, cleaned): 1 role CanRead=1 (`Admin`); `Procurement` row CanRead=0 → non-admin dashboard/export=**403 by-construction** (4-attr-test + policy-Admin-only-DB) · smoke: health/live 200, admin 200, eoffice 200, dashboard/export/my-dashboard no-token=**401** (class-level `[Authorize]` intact) · **NO-FE** (0 fe-src → bundle=S117 `cFI7ih4a`/`MxgooVZw` frozen) · **NO-Mig**. Password-free per task (403 by-construction not curl-proven). **cicd-lane return GARBLED #53** (memory-curation slice, NOT verdict) → **em-main-solo curl+sqlcmd recovered**; verdict-substance disk-verified TRUE (509-gate + `Reports.Read`→Admin-only + 401 no-token all git/prod-corroborated). [harvest-curator S118-end F1: nhãn "CLEAN-return" cũ SAI, đã sửa.]
+- _(**S117 #387 `316a82f`** PE duyệt-khoảng Min–Max + Mig 66 `AddPeApprovedPriceRange` APPLIED-PROD GO 5m36s [gate 501=45+456; js-rotate×2 `Dd55jBpj`→`cFI7ih4a`/`DVDr1UQ4`→`MxgooVZw` css-frozen `CfunQHbd`/`DGqqHQXS`; byte-verify #77 `cả Min và Max`/`duyệt theo khoảng`/`ProMinMax`/`Min–Max` PRESENT (=0 OLD); Mig66 `COL_LENGTH=9` + history-top + sys.tables 89; 🔑 pre-deploy snapshot BEFORE poll-success = clean-rotation-proof; PE 401-secured] · full verbatim → `archive/2026-07.md` via `_INDEX`)_
+- _(**S114-S116 #384-#386** PE multi-NCC per-hạng-mục (Mig 65 backfill-invariant APPLIED-PROD) + nhập-giá-ÂM + submit-guard + S115 GOVERNANCE-hmw GO ×3 [gate 486→495; js-rotate×2 `acprMqfB`→`D51OYyGV`→`Dd55jBpj`/css-frozen; S115 FROZEN×4 #69-REFINE 0-src proof + #41 non-.md-in-.claude STILL triggers; byte-verify str-PRESENT; 🔑 poll-til-success TRƯỚC re-snapshot tránh frozen-trap] — FE real-ship, smoke ALL 200 · verbatim → `archive/2026-07.md` via `_INDEX`)_
 - _(**S111 #495 `8aa3869` H22-WAL-adopt** [deploy.yml SELF-change +2 paths-ignore, run parsed+ran-full = workflow-self-change PASS; bundle FROZEN ×6-streak; 🔑 **AS-6 baseline-shift**: post-#495 memory-push (budget.json/agent-memory/run-trace) HẾT trigger CI, phân-loại giờ soi file ngoài 7-glob] **+ S112 #496 `e100ef0`** PE-workflow+Supplier-import-Phase-B+Mig63 `AddSupplierImportSourceFields` [gate 458, 🔑 411-refine: bodyless-POST→411 ANY-route → re-probe WITH-body → 401/415-matched vs 404-missing] **+ S113 #383 `5fa11b5`** Supplier-import-v2+Mig64 `AddSupplierPublishState`-APPLIED-PROD [IsPublic 37/37, gate 477] — all GO ~5m, FE real-ship, Mig-applied-prod, smoke ALL 200 · full verbatim → `archive/2026-07.md` via `_INDEX`)_
 - _(**S107-closeout→S110-spot #490-#494** GOVERNANCE/MEMORY-push GO ×5 [`d74f67f`·`69957fd`·`f5a5c3e`·`6ee60cd`·`ac3f122` — trigger #41 non-.md-in-push: budget.json ×2 + hmw.js ×3, pattern DEAD từ D10 #495] — bundle FROZEN-streak ×5 sau ROTATE #489 [#69 TWO-MODE; LM-in-window + real-size 1,644,931/1,551,280b = signal duy nhất] · Mig 62 + sys.tables 89 frozen · gate 440 · smoke 3×200 ALL · 🔑 #494 spot-detection: LM-prod-newer-than-last-verified-window = missed-run detector · full verbatim → `archive/2026-07.md` via `_INDEX`)_
 - _(**S107 #489 `21387cd` GOVERNANCE-ONLY (+office-document 12th sub) GO 5m33s** — JS ROTATED-benign `ChSNAJBK`→`BVyH-FY7` / `Bn2w1znH`→`EDsZebvn` CSS-frozen, 🔑 #69 TWO-MODE CONFIRMED (0-fe-src ROTATE #312/#489 hoặc FROZEN #333/#485-487 — ship-proof = LM-in-window + real-size, hash-delta phụ) · **S104 #488 `778fc98` FULL-STACK Supplier 9→27 + Mig 62 `ExpandSupplierFields` APPLIED-PROD** — AddColumn×18-exact + sys.tables-89-invariant + un-cram 4-NCC Note=NULL/Pkg/Bank/LegalRep-populated-EXACT + DTO-18-new-keys-live + JS-rotate-real-src + 🔑 FULL-STACK-SCHEMA-ADD+DATA-UN-CRAM PASS-pattern — full verbatim → `archive/2026-07.md` via `_INDEX`)_
@@ -93,5 +94,5 @@ BE (test+build) ~90s · FE × 2 ~60s/app · deploy ~30s · **total ~3min code /
 
 ## 🔄 Curate trigger
 - >~30KB → archive recent runs → L2 `archive/<period>.md` (byte-exact append) + `_INDEX.md` substring pointer. Dup failure patterns → merge. Stale >3mo → remove.
-- **Last curate: 2026-07-13 S115 (self, PostToolUse 21.6→<17KB)**: #384/#383/#496/#495 (S114/S113/S112/S111) verbatim → `archive/2026-07.md` + `_INDEX` +4 pointers → S114 compact-stub + S111-113 merged-stub; top S114 garble-block → 1-line tracker.
+- **Last curate: 2026-07-14 S118 (self #389-run: S117 #387 verbatim→`archive/2026-07.md` moved-not-cut byte-id, baselines 505→509; prev S115 self 21.6→<17KB)**: #384/#383/#496/#495 (S114/S113/S112/S111) verbatim → `archive/2026-07.md` + `_INDEX` +4 pointers → S114 compact-stub + S111-113 merged-stub; top S114 garble-block → 1-line tracker.
 - **Prev: S111 07-12 self 20.5→17 (#490-#494→archive) · S107 07-10 self 20.4→16.9 (#489/#488→archive) · S104 07-06 self 20.5→17.9 · S98 07-02 em-main 19.9→17.06 (`2026-07.md` NEW) · S80 06-20 em-main 38.8→16 · S70 06-17 Harness-9 65.2→23.2 · earlier S66 · S40.**