[CLAUDE] Docs: S40 curate 4 agent MEMORY >25KB + RAG catch-up chunk S37-S40

- investigator-codebase 35.7->7.6 · cicd-monitor 35.3->8.4 · implementer-backend 30.9->7.9 · reviewer 28.4->7.5 KB - Archived verbose FIFO -> git d2f52ba; refreshed stale counts (111->130 test, 33->40 mig, ~146->211 endpoints, 47->55 gotcha); dedup split (FE patterns -> implementer-frontend, test patterns -> test-specialist) - Foundation preserved: gotcha patterns + 5-stage/5-category checklist + Smart Friend guard + workflow schemas + sqlcmd/controller-audit + BE Patterns 1-12-ter - RAG: store_memory S37-S40 catch-up chunk (rerank 0.867 top hit); full re-index pending `python bootstrap.py --project solution_erp` (needs VOYAGE_API_KEY env) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-05-29 13:10:55 +07:00
parent d2f52ba586
commit 78c9de35f8
4 changed files with 174 additions and 827 deletions
--- a/.claude/agent-memory/cicd-monitor/MEMORY.md
+++ b/.claude/agent-memory/cicd-monitor/MEMORY.md
@ -1,205 +1,78 @@
 # CI/CD Monitor Agent — Persistent Memory
 > **Persistent diary cross-session.** Auto-injected first 200 lines / 25KB at spawn.
-> Update BEFORE every stop. Curate when > 25KB.
+> Update BEFORE every stop. Curate when > 25KB. Keep entry ≤ 1.5K chars (gotcha #53).
 > Full verbatim run history pre-S40 → git `d2f52ba` + `archive/2026-05-{runs,q2,q3,q4}.md`.
 ---
 ## 🎯 Role baseline
-Read-only CI/CD pipeline + post-deploy verifier for SOLUTION_ERP. Polls Gitea Actions API, verifies test gate + deploy ship + prod health. Tools: Read, Grep, Glob, Bash, WebFetch. Output: PASS/FAIL verdict + evidence under 500 words. **Spawn cost ~150K tokens** — trade-off để catch fail tự động không phụ thuộc em main nhớ verify.
+Read-only CI/CD + post-deploy verifier SOLUTION_ERP. Polls Gitea Actions API, verifies test gate + deploy ship + prod health. Tools: Read, Grep, Glob, Bash, WebFetch + 5 RAG MCP. Output: PASS/FAIL + evidence <500 words. Skills: `iis-deploy-runbook` + `dependency-audit-erp` + `ef-core-migration`. Spawn ~150K — trade-off catch fail tự động.
 ---
-## 🚨 Recurring CI/CD bug patterns (catch with priority)
+## 🚨 Recurring CI/CD bug patterns (catch priority)
-### Gotcha #39 — act_runner github.com TCP timeout
+- **#39 act_runner github.com TCP timeout** — run hang "Set up job" 21s. Log `dial tcp github.com:443 i/o timeout`. Fix: manual checkout bypass hardcoded `.gitea/workflows/deploy.yml` (pass #110). KHÔNG revert.
-
+- **#40 npm cache `tsc not found`** — `build_fe_admin` fail post `cache: npm`. DISABLED rolled back `a21790d`. KHÔNG re-enable.
- **Symptom:** CI run hang ở "Set up job" → timeout 21s, run stays "queued" forever
+- **#41 paths-ignore docs-only skip** — code commit không trigger CI? Check `git diff --name-only HEAD~1 HEAD` vs `paths-ignore: ['docs/**','**/*.md','.claude/skills/**']`. Discovery #3: Gitea evaluates push *range* commits — nếu ≥1 commit có non-ignored file → toàn range build (BENEFICIAL).
- **Verify:** log line `Error: dial tcp ... github.com:443 ... i/o timeout`
+- **#25 IIS WebSocket** — `notification-hub/negotiate` 401/404 prod. Fix: WebSocket module enable `web.config` site api (skill `iis-deploy-runbook`).
- **Fix:** manual checkout bypass đã hardcode trong `.gitea/workflows/deploy.yml` (run #108/#109), pass at #110. KHÔNG revert. Nếu pattern returns → escalate em main check VPS network
+- **#48 SQLite tie-break** — `OrderByDescending(CreatedAt).First()` pick wrong khi 2+ `.Add()` cùng frozen-clock. Fix: discriminator filter `.Where(Summary.Contains("Chuyển phase"))` BEFORE OrderBy.
-
+- **Bundle hash unchanged = ship FAIL** — push+action success nhưng prod không đổi. Verify `curl -s https://admin.solutions.com.vn/ | grep -oE '/assets/index-[a-z0-9]+\.js'`. Fix: SSH `Restart-WebAppPool`. ⚠️ Bundle hash verify MUST sau status=success (Run #242 false-positive lesson: check khi "running" → stale hash).
-### Gotcha #40 — npm cache `tsc not found`
+- **Migration drift prod vs repo** — compare `ls .../Persistence/Migrations/*.cs` vs `sqlcmd __EFMigrationsHistory`. Fix: check `Program.cs` `app.MigrateDatabase()` + app pool recycle.
 - **Symptom:** `build_fe_admin` fail sau khi enable `cache: npm` ở `actions/setup-node@v4`
 - **Verify:** log line `sh: tsc: command not found` hoặc `npm error code ETIMEDOUT`
 - **Fix:** DISABLED npm cache rolled back ở `a21790d`. KHÔNG re-enable. Build time chấp nhận ~3 min thay vì optimize
 ### Gotcha #41 — paths-ignore docs-only skip
 - **Symptom:** Commit code thật mà CI không trigger (run list không có entry mới)
 - **Verify:** `git diff --name-only HEAD~1 HEAD` vs `paths-ignore: ['docs/**', '**/*.md', '.claude/skills/**']`
 - **Fix:** Nếu commit có code thật bị skip nhầm → check pattern conflict. Nếu commit chỉ docs → expected behavior (saving ~9 min deploy / commit MD-only). **Discovery #3 cumulative 4× S23 t3-t6:** Gitea evaluates push range commits (not just tip) when at least 1 commit has non-ignored files — anomaly BENEFICIAL catches verify gate.
 ### Gotcha #25 — IIS WebSocket / module exclusion
 - **Symptom:** `notification-hub/negotiate` returns 401 hoặc 404 prod (FE SignalR connect fail)
 - **Verify:** `curl -X POST https://api.solutions.com.vn/notification-hub/negotiate` → non-200
 - **Fix:** IIS WebSocket module enable trong `web.config` của site api.solutions.com.vn (skill `iis-deploy-runbook`)
 ### Gotcha #48 — Multi-Changelog.Add SQLite tie-break (S25 lesson)
 - **Symptom:** Tests using `OrderByDescending(CreatedAt).First()` pick wrong audit row khi same SaveChangesAsync transaction có 2+ Changelog.Add() entries cùng CreatedAt (SQLite frozen-clock).
 - **Verify:** Test fail message `Expected changelog.ContextNote not to be <null>` post BE refactor adding new audit Add() alongside existing LogTransitionAsync chain.
 - **Fix:** Discriminator filter: `.Where(c => c.Summary!.Contains("Chuyển phase"))` OR `.Where(c => c.EntityType == X)` BEFORE OrderByDescending. Pattern verified Plan AB Chunk A2 (Run #216 PASS).
 - **Side benefit:** CI test gate catches BEFORE prod deploy → bro UAT spared broken audit. UAT mode skip-test pattern STILL RISKY khi refactor > 100 LOC touches existing test paths.
 ### Deploy ship verification — bundle hash unchanged
 - **Symptom:** commit push success + Gitea action success + status PASS, **nhưng prod không có thay đổi visible** (user UAT báo "đã deploy mà không thấy")
 - **Root cause candidates:**
  - IIS app pool chưa recycle → giữ assembly cũ trong memory
  - NSSM service script không copy file đúng folder
  - Browser cache (rare nếu Vite hash chuẩn)
 - **Verify:** `curl -s https://admin.solutions.com.vn/ | grep -oE '/assets/index-[a-z0-9]+\.js'` — hash giữ nguyên = ship fail
 - **Fix:** SSH `vietreport-vps "Restart-WebAppPool admin.solutions.com.vn"` + recheck bundle hash
 ### Migration drift prod vs repo
 - **Symptom:** Latest mig trong repo (vd Mig 27) nhưng prod chưa có (DbInitializer startup fail)
 - **Verify:** Compare `ls Migrations/*.cs` vs `sqlcmd ... __EFMigrationsHistory`
 - **Fix:** Check `Program.cs` startup hook `app.MigrateDatabase()` còn không + app pool recycle. Hoặc manual `dotnet ef database update --connection prod` qua SSH
 ---
-## 📋 5-stage checklist (apply EVERY run)
+## 📋 5-stage checklist (EVERY run)
-### Stage 0: Local RAG infrastructure status (S27 NEW — post NSSM Service mode)
+- **Stage 0 RAG infra:** `Get-Service Qdrant` Running + `http://localhost:6333/healthz`. Collection `proj_solution_erp` (prefix `proj_*` 7 project — Discovery #8).
- `Get-Service Qdrant` → must show Status=Running, StartType=Automatic (NSSM Windows Service)
+- **Stage 1 Push+filter:** `git log -1 --format='%H %s'` + `git log origin/main..HEAD` empty + diff vs paths-ignore (docs-only → SKIPPED-DOCS return).
- Nếu Stopped/Paused → `Start-Service Qdrant` (Admin) hoặc `& "D:\.claude-rag\scripts\fix-service-start.ps1"` elevated
+- **Stage 2 Gitea poll** (max 10 iter × 60s): API `.../actions/tasks?limit=5` (NOT `/runs` 404). Match `head_sha`. ⚠️ task table `updated_at` stale ~2min (gotcha #46) → cross-check VPS mtime.
- `Invoke-RestMethod http://localhost:6333/healthz -TimeoutSec 3` verify HTTP
+- **Stage 3 Test gate:** baseline **130 PASS** (58 Domain + 72 Infra). Phase 9 UAT exception lower OK (`feedback_uat_skip_verify`).
-
+- **Stage 4 Post-deploy** (if SUCCESS): auth login bearer (admin + nv.test gotcha #44; token=`accessToken` route `/api/auth/login`) → 3-5 endpoint smoke 2XX (incl new) → FE bundle hash 2 app changed → SignalR negotiate (gotcha #25 if relevant) → EF mig prod==repo.
-### Stage 1: Push happened + filter check
+  - **Stage 4.6 (S29 CRITICAL):** sqlcmd seed sample verify post-deploy (NOT chỉ schema). `sqlcmd -Q "SELECT Code FROM ApprovalWorkflows WHERE Code LIKE 'QT-%-V2-%'"` → 0 rows = seed GATE BLOCKED → gotcha #51.
- `git log -1 --format='%H %s'` — latest commit
+  - Discovery #4: ASP.NET 10 record enum cần numeric input unless `JsonStringEnumConverter` (SOL has NO converter → FE sends numeric). #5: sqlcmd ssh Windows-auth cần `\\\\SQLEXPRESS` 4-backslash. #6: INFRASTRUCTURE seed (Roles/Depts/Catalogs/MenuTree/AdminPerms/Templates/SampleWorkflowsV2) MUST run, NOT inside `if(!demoSeedDisabled)`; DEMO seed (DemoUsers/Contracts/PE) OK gated → gotcha #51.
- `git log origin/main..HEAD` — must be empty (synced)
+- **Stage 5 Report** PASS/FAIL + evidence + MEMORY update.
 - `git diff --name-only HEAD~1 HEAD` vs `paths-ignore` — nếu chỉ docs → SKIPPED-DOCS
 ### Stage 2: Gitea Actions poll (max 10 iter × 60s)
 - API: `https://git.baocaogiaoduc.vn/api/v1/repos/vietreport-admin/solution-erp/actions/tasks?limit=5` (NOT `/runs` — 404)
 - Match `head_sha == $commitSha` → get `runId`
 - Status: queued / in_progress / completed
 - Conclusion (when completed): success / failure / cancelled / timed_out
 - **Discovery S21 t5:** Gitea API task table caches `updated_at` stale (~2 min behind reality) — cross-check VPS file mtime nếu time-sensitive.
 ### Stage 3: Test gate verify (Domain 58 + Infra 53 baseline = 111 PASS)
 - Logs grep: `Passed:` line per stage
 - Phase 9 UAT exception: test count may be lower nếu em main skip per chunk (memory `feedback_uat_skip_verify`) — NOT a failure
 - Delta from baseline → report
 ### Stage 4: Post-deploy live verify (if SUCCESS)
 - Auth login → bearer (admin + nv.test for non-admin gotcha #44 check). Token field = `accessToken` (NOT `token`). Route = `/api/auth/login` (NOT `/api/v1/auth/login` 404)
 - 3-5 endpoint smoke 2XX expected (include endpoint mới trong commit)
 - FE bundle hash 2 app changed (compare pre vs post)
 - SignalR negotiate (gotcha #25 — if commit relates notification)
 - EF migration latest prod == latest repo
 - **NEW Stage 4.6 (S29 Plan B CRITICAL):** sqlcmd seed sample data verify post-deploy — KHÔNG chỉ check schema/Mig table. Phải verify seed data populated khi feature cần sample (V2 workflow Drafter dropdown, etc.). Pattern: `sqlcmd ... -Q "SELECT Code FROM ApprovalWorkflows WHERE Code LIKE 'QT-%-V2-%'"` → 0 rows post-deploy = seed GATE BLOCKED → escalate gotcha #51 INFRASTRUCTURE vs DEMO seed分类.
 - **Discovery #4 (S23 t6 Plan P):** ASP.NET Core 10 record types với enum fields cần **numeric input** unless `JsonStringEnumConverter` registered. SOLUTION_ERP API has NO converter — FE × 2 correctly sends numeric (`WorkflowReturnMode = { OneLevel: 1, OneStep: 2, Assignee: 3, Drafter: 4 }`).
 - **Discovery #5 (S25 t3 Plan AC):** sqlcmd Windows-auth via ssh requires `\\\\SQLEXPRESS` 4-backslash escape; `\\SQLEXPRESS` produces 0 output silently.
 - **Discovery #6 NEW (S29 Plan B CICD):** INFRASTRUCTURE seed (Roles/Depts/Catalogs/MenuTree/AdminPerms/Templates/**SampleWorkflowsV2**) MUST always run — NOT inside `if (!demoSeedDisabled)`. DEMO seed (DemoUsers/DemoContracts/DemoPE) OK gated. Anti-pattern: Implementer mirror PE V2 seed pattern (which IS gated) for Contract V2 → V2 path BLOCKED prod khi `DemoSeed:Disabled=true`. Fix: hoist `SeedSampleContractWorkflowV2Async` out of gate (Run #232 PASS).
 ### Stage 5: Report PASS/FAIL with evidence + MEMORY.md update
 ---
-## ⚠️ Anti-patterns observed (DO NOT)
+## ⚠️ Anti-patterns (DO NOT)
-
+1. ❌ Push fix code — READ only, escalate em main · 2. ❌ Speculate fail without log · 3. ❌ Skip post-deploy bundle hash (biggest catch) · 4. ❌ Skip MEMORY · 5. ❌ Poll forever (max 10 iter) · 6. ❌ Auto-rollback (escalate + recommend) · 7. ❌ Verify docs-only (SKIPPED-DOCS return ngay)
 1. ❌ Push fix code — READ only, escalate to em main
 2. ❌ Speculate fail cause without log evidence
 3. ❌ Skip post-deploy live verify khi SUCCESS — bundle hash là biggest catch
 4. ❌ Skip MEMORY.md update
 5. ❌ Poll forever (max 10 iter ~10 min timeout)
 6. ❌ Auto-rollback — escalate với recommendation, KHÔNG tự chạy
 7. ❌ Verify khi commit docs-only — SKIPPED-DOCS + return ngay (per Discovery #3 anomaly note)
 ---
-## 🧠 SOLUTION_ERP CI/CD essentials
+## 🧠 SOLUTION_ERP CI/CD essentials (S40 verified)
- **Gitea:** https://git.baocaogiaoduc.vn/vietreport-admin/solution-erp
+- **Gitea:** `git.baocaogiaoduc.vn/vietreport-admin/solution-erp` · workflow `.gitea/workflows/deploy.yml` · paths-ignore `['docs/**','**/*.md','.claude/skills/**']`
- **Workflow:** `.gitea/workflows/deploy.yml` (test gate 2 step + build BE + build FE × 2 + deploy)
+- **Prod:** api/admin/eoffice `.solutions.com.vn` · SSH `ssh vietreport-vps` (Administrator, id_ed25519) · DB `.\SQLEXPRESS`/`SolutionErp`/`vrapp` (fallback `C:\inetpub\solution-erp\api\appsettings.Production.json` khi `$env:PROD_DB_PASSWORD` empty)
- **Path filter:** `paths-ignore: ['docs/**', '**/*.md', '.claude/skills/**']` (gotcha #41 + Discovery #3 anomaly)
+- **Tests baseline:** **130 PASS** (58 Domain + 72 Infra). Phase 9 UAT mode skip per chunk OK.
- **Prod URLs:** api / admin / eoffice `.solutions.com.vn`
+- **Mig latest repo:** **Mig 40 `20260528090839_AddAttendances`** (S38 G-P1). Path `src/Backend/SolutionErp.Infrastructure/Persistence/Migrations/`. Prod check `sqlcmd __EFMigrationsHistory ORDER BY MigrationId DESC TOP 5`.
- **SSH VPS:** `ssh vietreport-vps` (user=Administrator, key=id_ed25519)
+- **Bearer:** admin `admin@solutions.com.vn/Admin@123456` (full) · UAT `nv.test@solutions.com.vn/TestUser@123456` (Drafter CCM, gotcha #44 check)
- **DB prod:** `.\SQLEXPRESS` / `SolutionErp` / vrapp user. Connection string fallback `C:\inetpub\solution-erp\api\appsettings.Production.json` khi `$env:PROD_DB_PASSWORD` empty local (S21 t5 discovery).
+- **Bundle hash live S38:** admin `cWAXid0q` · user `CX79e2kZ` (Run #247). Bundle size ~800KB/750KB gz.
- **Tests baseline:** **120/120 PASS** (58 Domain + 62 Infra = baseline 53 + **9 BW1-BW7 Plan C** Contract V2 ApproveV2 BW1 happy path + BW2 terminal + BW3 skipToFinal F2 + BW4 outsider Forbidden + BW5 wrong ApplicableType + BW6abc UPSERT Cascade + BW7 V1 fallback). **S33 Run #350 PASS** confirmed delta +9. Pre-S33: 111/111 unchanged S25→S32.
+
- **Mig latest repo:** **Mig 34 `20260526110207_AddEmployeeProfiles`** (S33 Plan B G-H1 Phase 10.1 — 7 Hrm entity tables + EmployeeCodeSequences atomic NV/{YYYY}/{D4}). Prev Mig 33 `AddContractLevelOpinions` (S29 Plan B). Prev Mig 31 `RefactorSkipToFinalToApproverLevel` (S23 t1 Plan K) — F2 swap Users → ApprovalWorkflowLevels per-Approver-slot, preserved.
+## 🔑 Critical config (flag commit nếu tái xuất)
- **Mig latest prod:** sqlcmd `__EFMigrationsHistory ORDER BY MigrationId DESC TOP 5`
+Node CI `20.x` (`feedback_node_cicd`) · MediatR `12.4.1` (gotcha #1, flag `Version="14`) · Swashbuckle `6.9.0` (gotcha #2) · act_runner manual checkout (#39) · npm cache DISABLED (#40, flag `cache: npm`)
 - **Bearer test:**
  - Admin: `admin@solutions.com.vn / Admin@123456` (full)
  - UAT non-admin: `nv.test@solutions.com.vn / TestUser@123456` (Drafter CCM — verify gotcha #44 silent 403 patterns)
 ---
-## 🔑 Critical config (gotcha cross-ref)
+## 🎯 Per-NV admin opt-in wire — 10-point checklist (cumulative S22→S23)
 Cross-ref `feedback_per_nv_permission_scope`. Per-NV/per-Level refactor MUST verify: 1 Domain field · 2 EF `HasDefaultValue(false)` · 3 Mig 3-file · 4 Service read · 5 Domain+App DTO mirror · 6 Designer FE checkbox · 7 AwLevelDto+ToDto · 8 CreateAwLevelInput+Update mutation · 9 **Lookup discrimination** (`FirstOrDefault` ADD `ApproverUserId==actorId` + admin fallback) · 10 **Controller body record count == Command record count**. Bug latency 2-3 days prod silent khi miss 9-10. Scan `grep -n "FirstOrDefault.*Order.*==" *.cs` after OR-of-N refactor.
- Node CI pin: `20.x` (memory `feedback_node_cicd` — bài học NamGroup)
+## 📊 Run stats baseline
- MediatR pin: `12.4.1` (gotcha #1)
+BE (test+build) ~90s · FE × 2 ~60s/app · deploy ~30s · **total ~3min code / 0s docs-only**. >5min → escalate.
 - Swashbuckle pin: `6.9.0` (gotcha #2)
 - act_runner: manual checkout bypass github.com (gotcha #39)
 - npm cache: DISABLED (gotcha #40 — KHÔNG re-enable)
 Flag commit nếu thấy `<PackageReference Include="MediatR" Version="14...` hoặc `cache: npm` tái xuất hiện.
 ---
-## 🎯 Per-NV admin opt-in wire surface — 10-point checklist (cumulative S22+5 → S23 t6)
+## 📅 Recent runs (FIFO — older → archive/git)
-Cross-ref memory `feedback_per_nv_permission_scope.md`. Future per-NV/per-Level refactor MUST verify:
+- **2026-05-28 Run #247 sha=`e54a22d` PASS 3m25s (S38 SKELETON 5-plan combo Mig 39+40 dual):** Push 1 commit mega `Domain+App+Infra+Api+FE×2`. ALL PASS. Bundle rotate admin `CGueDk22→cWAXid0q` + user `CEt0QRgX→CX79e2kZ`. Mig 39+40 dual auto-applied startup (90830→90839). 6 endpoint smoke 200 (leave/ot/travel/vehicle/it-tickets/hr-dashboard `totalEmployees=33 male=17 female=16`). 6 new tables + 8 menu seeded. 0 regression. Fastest S38 deploy. Tag `[s38, run247, pass, skeleton-combo]`.
-
+- **2026-05-28 Run #246 sha=`de1c378` PASS 3m53s (S37 Proposal Mig 37+38):** Bundle admin `C9kzTTmq→CGueDk22` + user `CC4DQ-Tr→CEt0QRgX`. Mig 38 AddProposals + 37 ExtendApplicableType. `/api/proposals` 200 empty + workflow `QT-DX-V2-001` ApplicableType=4 seed + 4 Off_DeXuat menu. Stage 4.6 sample seed INFRASTRUCTURE-gated correct (gotcha #51). Tag `[s37, run246, pass, proposal-v2]`.
-1. Domain entity field
+- **Archived Run #359/#243/#242/#241/#240 + S35/S36 startup → `archive/2026-05-q4.md` + git d2f52ba (S40 curate):** Run #359 G-O2 Meeting Mig 36 · #243 HrmConfig BE 16 endpoint (BE-only bundle unchanged anti-pattern verify) · #242 FE inline forms 5 satellite · #241 Mig 35 HRM foundation · #240 satellite CRUD. Discovery #7 path-filter eval/** + #8 collection `proj_*`. KEY absorbed in essentials/Stage sections above.
-2. EF config `HasDefaultValue(false)`
+- **2026-05-22 Run #232 sha=`38f1c4d` PASS (S29 Plan B CRITICAL gotcha #51 catch):** `SeedSampleContractWorkflowV2` nested in `if(!demoSeedDisabled)` → prod `DemoSeed:Disabled=true` → QT-HD-V2-001 missing → V2 Drafter dropdown EMPTY. Fix hoist out of gate. **Smart Friend ROI 4× cumulative** (S22 #44 + S25 #48 + S29 ApplicableType + S29 DemoSeed). → archive/git for #229-#231.
 3. Migration 3-file rule (Up + Designer + Snapshot)
 4. Service handler read field
 5. Domain DTO + Application DTO mirror
 6. Designer FE checkbox inline (admin)
 7. Admin overview AwLevelDto record + ToDto ctor
 8. CreateAwLevelInput record + Update mutation handler
 9. **Lookup discrimination** in handler (`FirstOrDefault` ADD `ApproverUserId == actorId` filter + admin fallback)
 10. **Controller body record** mirror count check (`[FromBody]` record param count = Command record param count)
 Bug latency observed when miss points 9-10: 2-3 days prod silent (Mig 28-29 deploy → S23 t4-t6 catch). Prophylactic codebase scan recommended: `grep -n "FirstOrDefault.*Order.*==" *.cs` after OR-of-N schema refactor.
 ---
 ## 📊 Run stats baseline (cumulative)
 - **Build time BE (test_domain + test_infra + build_be):** ~90s baseline
 - **Build time FE × 2 app:** ~60s baseline mỗi app
 - **Deploy NSSM + IIS recycle:** ~30s
 - **Total CI run time:** ~3 min code commit / 0s docs-only commit
 - **Trend trigger:** nếu run time > 5 min → escalate (cluster network slow hoặc dependency bloat)
 - **Bundle size baseline:** fe-admin ~800KB gz / fe-user ~750KB gz (Vite production build)
 ---
 ## 📅 Recent runs (FIFO — slim post-curate 2026-05-22)
 - **2026-05-28 16:20-16:23 Run #247 (task 361) sha=`e54a22d` VERDICT=PASS ~3m25s (S38 SKELETON 5 plan combo G-O4+G-O5+G-O6+G-P1+G-H3 full-stack Mig 39+40 dual):** Push range `de1c378..e54a22d` 1 commit massive scope `Domain+App+Infra+Api+FE-Admin+FE-User` — 4 Controllers NEW (AttendancesController + HrDashboardController + ItTicketsController + LeaveRequestsController) + FE × 2 cookie-cutter (HrmDashboardPage + ItTicketsPage + MyAttendancePage + WorkflowAppsListPage + types/workflowApps.ts + App.tsx + Layout.tsx + menuKeys.ts each app). **Stage results ALL PASS** (task #361 status=success, duration computed 16:20:23→16:23:48 = 3m25s, under baseline 3m30s — fastest S38 deploy despite massive scope). **Post-deploy verify ALL PASS Stage 4:** (a) **3 prod domain smoke ALL 200 OK**: api/health/ready 200 0.30s + admin 200 0.51s + eoffice 200 0.17s. (b) **Bundle hash BOTH rotated**: fe-admin `CGueDk22`→`cWAXid0q` + fe-user `CEt0QRgX`→`CX79e2kZ` (S38 SKELETON ship confirmed FE × 2 app). (c) **Mig 39+40 prod TOP 5 DESC head MATCHES repo**: `AddAttendances` (Mig 40 head 20260528090839) → `AddWorkflowApps` (Mig 39 20260528090830) → `AddProposals` (38) → `ExtendApplicableTypeForWorkflowApps` (37) → `AddMeetingRooms` (36). **Dual Mig deploy success** — DbInitializer auto-applied 2 mig in startup sequence (90830 → 90839 same push). (d) **6 NEW endpoint smoke ALL 200 OK**: `/api/leave-requests` 200 + `/api/ot-requests` 200 + `/api/travel-requests` 200 + `/api/vehicle-bookings` 200 + `/api/it-tickets` 200 + `/api/hr/dashboard` 200 with dto **`totalEmployees=33 activeEmployees=33 onLeaveEmployees=0 resignedEmployees=0 maleCount=17 femaleCount=16 birthdaysThisWeek=0 newHiresThisMonth=0`** — Plan G-H3 HR dashboard endpoint live + populated from Mig 34 EmployeeProfiles 33 NV seed. (e) **6 NEW tables sqlcmd EXACT MATCH spec**: Attendances + ItTickets + LeaveRequests + OtRequests + TravelRequests + VehicleBookings — all 6 rows returned from `sys.tables` filter. (f) **Menu seed verify 8 row MATCH ≥ 8 spec**: `Hrm_Dashboard` + `Off_ChamCong` + `Off_DatXe` + `Off_DonTu` + `Off_DonTu_Leave` + `Off_DonTu_Ot` + `Off_DonTu_Travel` + `Off_ItTicket` = **8 row** total (root Off_DonTu + 3 leaf Leave/Ot/Travel + 4 standalone Dashboard/ChamCong/DatXe/ItTicket). **0 prod regression observed Run #247.** Pattern 12-bis cross-module mirror PE V2 → 5 plan combo SKELETON full-stack mega scaffold STRONG: BE 4 Controller + FE × 2 page × 4 + Mig 39+40 dual + DbInitializer menu/seed 1 commit cohesive end-to-end. Polling pattern WORKED: 6 iter (1×0s + 5×45s sleep) ~3m45s wait running→success transition smooth, Run #247 false-positive trap avoided. Token cost ~12K (Read MEMORY + git log + git diff + Gitea API task poll × 7 + 3 smoke + 6 endpoint + 3 sqlcmd + 1 bundle hash + 1 auth login). Tag: `[s38, run247, pass, mig-39-40-dual, skeleton-5-plan-combo, full-stack]`. **Cumulative confirm:** Pattern 12-bis cross-module mirror end-to-end prod live; HR dashboard dto populated correctly from Mig 34 seed; 6 new modules SKELETON ready for next session BE wire CRUD + FE form scaffold.
 - **2026-05-28 15:51-15:55 Run #246 (task 360) sha=`de1c378` VERDICT=PASS ~3m53s (S37 Plan G-O3 Đề xuất Mig 37+38 + BE Proposal CRUD + FE × 2):** Push range `f45090b..de1c378` 1 commit full-stack scope `Domain+App+Infra+Api+FE-Admin+FE-User`. **Stage results ALL PASS** (task #360 status=success, dur 3m53s computed 15:51:25→15:55:18). **Post-deploy verify ALL PASS Stage 4:** (a) **3 prod domain smoke ALL 200**: api/health/ready 200 0.27s + admin 200 0.13s + eoffice 200 0.11s. (b) **Bundle hash BOTH rotated**: admin `C9kzTTmq`→`CGueDk22` + user `CC4DQ-Tr`→`CEt0QRgX` (Plan G-O3 ship confirmed FE × 2). (c) **Mig 38 prod TOP 5 DESC MATCHES repo**: `AddProposals` (Mig 38 head 20260528082726) → `ExtendApplicableTypeForWorkflowApps` (Mig 37 20260528082332) → `AddMeetingRooms` (36) → `AddHrmConfigs` (35) → `AddEmployeeProfiles` (34). (d) **3 NEW endpoint smoke ALL 200**: `GET /api/proposals?page=1&pageSize=10` 200 0.38s → 0 items empty paged list expected + `GET /api/approval-workflows-v2?applicableType=4` 200 0.39s → 1 row `QT-DX-V2-001` "Quy trình duyệt Đề xuất mẫu V2" (sample seed Phòng CCM × 1 Cấp Lê Văn Bình). (e) **Menu seed Off_DeXuat verify MATCH 4 row**: Off_DeXuat_List + Off_DeXuat_Create + Off_DeXuat_Inbox + Off_DeXuat (root). (f) **Sample workflow Proposal V2 seed MATCH**: COUNT=1 row `QT-DX-V2-001` ApplicableType=4. **0 prod regression Run #246.** Pattern 12-bis cross-module mirror PE V2 → Proposal V2 cookie-cutter STRONG: BE+Mig 37 enum extend + Mig 38 Proposal table + FE × 2 1 commit cohesive, 1 sample workflow seed + 4 menu hierarchy clean. Stage 4.6 sample seed verify PASS (Mig 38 SeedSampleProposalWorkflowV2Async correctly INFRASTRUCTURE-gated, NOT inside DemoSeed disabled per gotcha #51 fix). Poll loop 6 iter × 30s ~3m wait running→success transition smooth. Token cost ~13K (Read MEMORY + git log + Gitea API task poll × 7 + auth login + 3 smoke + 2 endpoint + 2 sqlcmd + 1 bundle hash). Tag: `[s37, run246, pass, mig-37-38, proposal-v2, full-stack]`. **Cumulative confirm:** Pattern 12-bis cross-module mirror PE V2 → Proposal V2 verified end-to-end prod live; ApplicableType enum extend Mig 37 (add ProposalGeneral=4) + Proposal table Mig 38 + Workflow V2 ApproveV2 wire reuse from PE/Contract.
 - **2026-05-28 15:06-15:10 Run #359 (task 359) sha=`f45090b` VERDICT=PASS ~3m55s (S36 Plan G-O2 Phòng họp Mig 36 + BE CRUD + FE 2 app):** Push range `8afdc1e..f45090b` 1 commit (scope `Domain+App+Infra+Api+FE-Admin+FE-User` full-stack). **Stage results ALL PASS** (task #359 status=success, dur 3m55s computed 15:06:37→15:10:32, slightly over baseline 3m30s due to Mig 36 + BE CRUD + FE × 2 cookie-cutter): test gate 120/120 baseline preserved + build_be (MeetingRoom/MeetingBooking entity + Mig 36 + Application Features compile OK) + build_fe_admin + build_fe_user (BOTH rotate). **Post-deploy verify ALL PASS Stage 4:** (a) **3 prod domain smoke ALL 200 OK**: api/health/ready 200/0.33s + admin 200/0.24s + eoffice 200/0.27s. (b) **Bundle hash BOTH rotated**: fe-admin `Bl6e54yi`→`C9kzTTmq` + fe-user `DHmW2tUF`→`CC4DQ-Tr` (Plan G-O2 ship confirmed FE × 2 app cookie-cutter). (c) **Mig 36 prod TOP 5 DESC head MATCHES repo**: `20260528074125_AddMeetingRooms` (Mig 36 head) → `AddHrmConfigs` (35) → `AddEmployeeProfiles` (34) → `AddContractLevelOpinions` (33) → `AddApprovalWorkflowToContract` (32). (d) **2 NEW endpoint smoke ALL 200 OK**: `GET /api/meeting-rooms` 200/0.26s → **4 rows** (ONL-1 Trực tuyến Zoom cap=50 + PH-A Phòng họp lớn cap=20 + PH-B Phòng họp nhỏ cap=8 + PHG-501 Phòng Giám đốc cap=6) + `GET /api/meeting-bookings?roomId=<first>&startDate=2026-05-28&endDate=2026-06-04` 200/0.29s → **0 rows** (no booking yet, expected). (e) **MeetingRooms seed verify EXACT MATCH spec**: COUNT=4 + Code list ONL-1/PH-A/PH-B/PHG-501 all present (DbInitializer SeedMeetingRoomsAsync auto-applied on startup). (f) **Menu seed verify EXACT MATCH spec**: 4 row `Off_PhongHop%` (root `Off_PhongHop` Order=2 ParentKey=Off + 3 leaf `Off_PhongHop_View` Order=1 + `Off_PhongHop_Manage` Order=2 + `Off_PhongHop_Book` Order=3). **0 prod regression observed Run #359.** **Polling pattern WORKED:** until-loop 7 iter × 30s = 3m30s wait from running → success transition (15:06:37 created → 15:10:32 updated, smooth deploy). Token cost ~11K (Read MEMORY + git log + Gitea API task poll × 8 + 3 smoke + 2 endpoint + 3 sqlcmd + 1 bundle hash + 1 auth login + tmp/mr.json parse). Tag: `[s36, run359, pass, mig-36, meeting-rooms-bookings, full-stack]`. **Pattern 12-bis cross-module mirror PE V2 → Meeting Room CRUD confirmed strong**: BE+Mig+FE×2 1 commit cohesive, 4 sample seed clean, menu hierarchy 4 row exact match.
 - **2026-05-28 S36 startup VERIFY (em main spawn read-only post-S35 wrap) sha=`8afdc1e` (HEAD docs only):** S35 wrap complete — 5 commits push range `63dd9ec..8afdc1e`. **Gitea API last 5 tasks (limit=10) all status=success**: task #358 sha=`021674a` (Run #244 — S35 Plan G-H2 Task 4 declarative HrmConfigsPage, 2026-05-28 10:01-10:05, dur=218s = 3m38s) + task #357 sha=`909655c` (Run #243 — S35 Plan G-H2 Task 3 BE CRUD 16 endpoint, 09:51-09:55, 223s = 3m43s) + task #356 sha=`c3cd343` (Run #242 — S35 FE inline forms 5 satellite, 09:39-09:43, 232s = 3m52s) + task #355 sha=`07b3f3b` (Run #241 — S34 Plan 4 G-H2 Mig 35 foundation, 2026-05-27 15:04-15:08, 210s = 3m30s) + task #354 sha=`e506cd8` (Run #240 — S34 Plan 3 Item 3 BE satellite CRUD, 14:56-15:00, 216s = 3m36s). **Token API unauth quirk:** `TokenLen=0` reported but `Total=244` workflow_runs returned (anonymous read OK for public repo metadata — gotcha confirmed). Final 2 docs commits `4d50b34 + 8afdc1e` correctly SKIPPED CI per gotcha #41 path filter `**/*.md` (no task #359 in list — verified). **VERDICT=PASS Stage 4 cumulative S35 healthy:** (a) **3 prod domain smoke ALL 200 OK**: `api.solutions.com.vn/health/ready` 200/0.37s + `admin.solutions.com.vn` 200/0.50s + `eoffice.solutions.com.vn` 200/0.31s. Note `/api/health` (per spec line) returns 404 — canonical path is `/health/ready` (gotcha S32 already documented). (b) **Bundle hash live prod EXACT MATCH S35 STATUS expected**: fe-admin `index-Bl6e54yi.js` ✓ + fe-user `index-DHmW2tUF.js` ✓ (Plan G-H2 Task 4 declarative HrmConfigsPage Run #244 ship confirmed end-to-end). (c) **Qdrant RAG infrastructure live**: Service `Qdrant` Status=Running StartType=Automatic (NSSM Windows Service per S27 fix preserved) + `http://localhost:6333/healthz` 200 "healthz check passed" + collection name CORRECTED **`proj_solution_erp`** (NOT `solution_erp` — naming convention `proj_*` cross-project: ashico_erp/benhvien_aau/dh_y_duoc/namgroup_main/solution_erp/vipix_ai_infra/vipix_multisite total 7 collections registered) POINTS=**3076** STATUS=green optimizer_status=ok (S31 baseline 2988 → +88 chunks S32-S35 cumulative content growth — Plan G-H1 EmployeeProfiles + Plan G-H2 HrmConfig + Pattern 12-bis/12-ter MEMORY docs + S33-S35 STATUS/HANDOFF updates). (d) **TLS cert not yet probed this spawn** (`openssl s_client` not invoked — defer per S32 baseline `notAfter 2026-07-23` ~56 days remaining + auto-renew win-acme 30d window ~2026-06-23). **0 prod regression observed S35 cumulative end-to-end** (3 deploy Run all PASS, all post-deploy smoke green, bundle hash match expected, RAG infrastructure live). **DISCOVERY #8 NEW collection naming:** RAG collection prefix `proj_*` standardized across 7 projects on this VPS — future skill `cicd-monitor` Stage 0 should reference `proj_solution_erp` not `solution_erp`. Update Stage 0 spec in agent system prompt. **STANDBY STATE ANNOUNCED:** Awaiting S36 push trigger. Token cost S36 startup ~14K (Read MEMORY × 2 + 4 Invoke-RestMethod Gitea API + 4 Invoke-WebRequest smoke + 3 Qdrant probe + 2 bundle hash grep + cache fallback tasks.json). Tag: `[s36, startup, standby, discovery-8-rag-naming]`.
 - **2026-05-28 09:51-09:55 Run #243 (task 357) sha=`909655c` VERDICT=PASS ~3m43s (S35 Plan G-H2 Task 3 — HrmConfig BE CRUD 16 endpoint cookie-cutter):** Push range `c3cd343..909655c` 1 commit 2 BE file NEW (+576 LOC, 0 mod): `HrmConfigFeatures.cs` (439 LOC Application/Hrm CQRS — 16 Command+Query handler 4 catalog × 4 verb: LeaveType/Holiday/Shift/OtPolicy × Create/Update/Delete/GetList) + `HrmConfigsController.cs` (137 LOC Api 16 endpoint route `/api/hrm-configs/*`). **Stage results ALL PASS** (Gitea task API status=success, conclusion=None UI bug per Run #237/#238/#350 pattern, duration computed 09:51:26→09:55:09 = 3m43s): test_domain 58 + test_infra 62 baseline 120/120 UNCHANGED (no test add per Phase 9 UAT mode per `feedback_uat_skip_verify`) + build_be (HrmConfigFeatures + Controller compile OK — Application/Hrm namespace existed from S33 EmployeeFeatures, MediatR auto-discovery WORK no gotcha #1) + build_fe_admin + build_fe_user (BOTH no rebuild — 0 FE file in push, bundle hash preserved expected). **Post-deploy verify ALL PASS Stage 4:** (a) **Bundle hash BOTH UNCHANGED**: fe-admin `BhR0MmLN` (== Run #242 baseline) + fe-user `DIdNaB6W` (== Run #242 baseline) — CRITICAL anti-pattern verify PASS: BE-only diff means FE bundle untouched, ship correct (no spurious FE rebuild). (b) **3 prod domain smoke ALL 200 OK**: api/health/ready 200 0.16s + admin 200 0.11s + eoffice 200 0.11s. (c) **4 NEW HrmConfig GET endpoint smoke ALL 200 + EXACT row count match S34 seed**: `/api/hrm-configs/leave-types` 200 → **5 rows** (ANNUAL/COMPASSIONATE/MATERNITY/SICK/UNPAID — match LeaveTypes=5 S34 Mig 35 seed) + `/api/hrm-configs/holidays?year=2026` 200 → **10 rows** (Tết DL Jan 1 + 5 Tết NĐ Feb 16-20 + Giỗ Tổ Apr 14 + 30/4 + 1/5 + Quốc Khánh Sep 2 — match Holidays=10 S34 VN 2026 seed) + `/api/hrm-configs/shifts` 200 → **3 rows** (CA1/CA2/HC — match ShiftPatterns=3 S34) + `/api/hrm-configs/ot-policies` 200 → **1 row** (STANDARD — match OtPolicies=1 S34 Luật LĐ VN 2019). **Total wire BE 4 GET endpoint × 19 row prod live = wire BE claim verify** ✓ — 16 endpoint route `[Authorize]` class-level WORK (admin bearer 200, no silent 403 gotcha #44). (d) **Mig 35 prod TOP 3 DESC UNCHANGED**: `AddHrmConfigs` (Mig 35 head) → `AddEmployeeProfiles` (Mig 34) → `AddContractLevelOpinions` (Mig 33) — no new mig push (BE CRUD only, expected). (e) **Polling pattern Run #242 lesson APPLIED**: at +3m24s push (curl probe 09:54:53) status="running" → waited via Python parse loop to verify status=success BEFORE bundle hash + endpoint smoke. Run #242 false-positive trap avoided. **0 prod regression observed Run #243.** Pattern 12-bis cookie-cutter cross-module mirror PE V2 ApproveV2 → Hrm CRUD strong: 4 catalog × 4 verb pattern uniform clean. **Cumulative S35 deploy:** 2× Run (#242 FE inline forms + #243 BE CRUD 16 endpoint). Expect more S35 kicks if FE 2 app page wire (list/create/edit dialog 4 catalog) added per Plan G-H2 Task 4. Token cost ~11K (Read MEMORY + git log + git diff + Gitea API task × 2 + 1 ssh sqlcmd + 7 curl smoke + parse Python). Tag: `[s35, run243, pass, be-only, hrm-configs-crud, 16-endpoint]`. **Anti-pattern verify ROI:** BE-only diff bundle UNCHANGED check catches spurious FE rebuild scenarios (e.g. shared Vite config touch, dependency cache bust). Run #243 confirmed clean — no spurious rebuild.
 - **2026-05-28 09:39-09:42 Run #242 sha=`c3cd343` VERDICT=PASS ~3m30s (S35 Phase 1.5 Item 3-FE inline forms 5 satellite × 2 app cookie-cutter):** Push range `63dd9ec..c3cd343` 1 commit 4 FE files (+1560/-198 LOC): fe-admin EmployeesListPage.tsx 573→1200 +627 + fe-user mirror SHA256 IDENTICAL + types/employee.ts × 2 app +53 LOC each. **Stage results ALL PASS** (Gitea Actions list page green-check icon "Success", duration ~3m30s): test_domain 58 + test_infra 62 baseline 120/120 UNCHANGED (no test add — FE-only Phase 9 UAT mode per `feedback_uat_skip_verify`) + build_be (unchanged BE — only FE diff) + build_fe_admin + build_fe_user (BOTH bundle rotate confirmed) + deploy NSSM IIS recycle. **Post-deploy verify ALL PASS Stage 4 + VPS mtime cross-check:** (a) **Bundle hash BOTH rotated**: fe-admin `RNTX6Fvo`→`BhR0MmLN` + fe-user `29A1LuMm`→`DIdNaB6W` (Item 3-FE inline forms 5 satellite ship confirmed FE × 2 app cookie-cutter). CSS hash also rotated (admin `DQSzWczW`→`Dlk3cj6D` + user `D-PasqRK`→`25W039gj`). (b) **VPS mtime cross-check**: `C:\inetpub\solution-erp\fe-admin\` assets folder = 2026-05-28 09:42:32 AM + index.html = 09:41:37 AM + `fe-user\` assets = 09:42:32 + index.html = 09:42:27 — match Run #242 deploy 09:42, NOT stale Run #241 (was 2026-05-27 15:07:28). NSSM service `Restart-WebAppPool` + xcopy ship verified end-to-end. (c) **3 prod domain smoke ALL 200 OK**: api/health/ready 200 "Healthy" 0.32s + admin 200 0.32s + eoffice 200 0.31s. (d) **3 endpoint smoke 200 OK** via admin bearer: /api/contracts 200 (7 demo HĐ rows w/ maHopDong + phase) + /api/employees?page=1&pageSize=5 200 (5 NV/2026/0001-0033 sample w/ employeeCode + departmentName populated — confirm Mig 34 EmployeeProfile seed 33 rows still applied) + /api/menus 200 (84 menu items including 5 `Hrm_Config*` + 2 `Off*` + new `Hrm_HoSo`). Token = `accessToken` (NOT `token` — gotcha preserved). (e) **Mig 35 prod TOP 1 UNCHANGED** = no BE Mig in push (FE-only diff). Plan 4 Phase 1.5 Item 3-FE inline forms `+ Thêm` button right side header satellite cookie-cutter mirror pattern FE × 2 app WORK end-to-end + Phase 9 UAT defer BE wire smoke 1 week per em main decision. **Polling pattern observed:** at +2 min push (09:41) Run #242 status="Running" yellow spinner — premature curl at that point showed bundle hash STALE (RNTX6Fvo/29A1LuMm baseline pre-rotate) which would have been false-positive FAIL ship had I stopped polling. **Until-loop pattern via Monitor tool WORK** — waited ~2 additional min for green check before final bundle hash re-fetch. Lesson: bundle hash verify MUST happen AFTER status=Success confirmed, NOT immediately after push. **0 prod regression observed Run #242.** Pattern 12-bis cross-module mirror PE → Hrm cookie-cutter strong (S33 Hrm EmployeeProfile module 7 entity → S35 Hrm inline forms 5 satellite × 2 app + 4 file diff only). **Cumulative S35 deploy:** 1× Run (#242), expect more S35 kicks if BE wire endpoints CRUD satellite added (Phase 9 UAT 1 week defer). Token cost ~12K (Read MEMORY + git log + 1 ssh + 1 ssh mtime cross-check + 1 Atom feed + 4 curl smoke + 1 Monitor until-loop). Tag: `[s35, run242, pass, fe-only, hrm-inline-forms]`. **Smart-friend pre-commit clean 7× confirmed** (Implementer Reviewer gate Phase 9 UAT mode — test gate baseline 120/120 unchanged, no new test added FE-only diff).
 - **2026-05-28 S35 warm-up VERIFY (em main spawn read-only post-S34 wrap) sha=`63dd9ec` (HEAD docs only, deploy commit `07b3f3b` Run #241):** S34 wrap complete — 7 commits push range `edba4ae..63dd9ec`, **4 CI Run all SUCCESS** (#238 sha=`ea440da` Plan 2 G-O1 Danh bạ + #239 sha=`61e9ce5` Plan 3 batch 4 item + #240 sha=`e506cd8` Plan 3 Item 3 BE satellite CRUD + **#241 sha=`07b3f3b` 2026-05-27 15:04-15:07 ~3m30s Plan 4 G-H2 Mig 35 schema foundation deploy**). S34 final 2 docs commits `1849197 + 63dd9ec` correctly SKIPPED CI per gotcha #41 path filter `**/*.md`. **VERDICT=PASS — Run #241 deploy fully shipped + verified post-deploy:** (a) Run #241 status=success duration 3m30s (Gitea API task workflow_runs query — created 15:04:19, updated 15:07:49 +07:00). (b) **3 prod domain smoke ALL 200 OK**: `api.solutions.com.vn/health/ready` returns "Healthy" 200/0.47s + `admin.solutions.com.vn` 200/0.33s + `eoffice.solutions.com.vn` 200/0.22s. (c) **Mig 35 prod TOP 5 DESC** sqlcmd via `ssh vietreport-vps 'sqlcmd -S ".\SQLEXPRESS" -d SolutionErp -E -h -1 -Q "..."'` pattern: `20260527075940_AddHrmConfigs` (Mig 35 head MATCHES repo) → `AddEmployeeProfiles` (Mig 34) → `AddContractLevelOpinions` (Mig 33) → `AddApprovalWorkflowToContract` (Mig 32) → `RefactorSkipToFinalToApproverLevel` (Mig 31). (d) **4 HRM catalog table verify**: LeaveTypes=5 + Holidays=10 + ShiftPatterns=3 + OtPolicies=1 = **19 row total EXACT MATCH** spec (ANNUAL/SICK/MATERNITY/COMPASSIONATE/UNPAID + VN 2026 holidays + HC/CA1/CA2 shifts + STANDARD OT policy Luật LĐ VN 2019). (e) **Menu seed verify GOOD** — Plan 4 spec wrote `HrmConfig%` but actual key uses underscore `Hrm_Config%`: query `SELECT [Key], Label, [Order], ParentKey FROM MenuItems WHERE [Key] LIKE 'Hrm%'` returns 7 row: root `Hrm` (Order=28 ParentKey=NULL) + `Hrm_HoSo` (Order=1 ParentKey=Hrm) + `Hrm_Config` (sub-group Order=2 ParentKey=Hrm) + 4 leaf under Hrm_Config Order 1-4 (`Hrm_Config_LeaveTypes` "Loại phép" + `Hrm_Config_Holidays` "Ngày lễ" + `Hrm_Config_Shifts` "Ca làm việc" + `Hrm_Config_OtPolicies` "Chính sách OT"). **5 G-H2 menu rows present** (sub-group + 4 leaf) — Pattern 16-bis MenuKeys.cs sync OK BE+FE. **Note key naming discrepancy:** S35 task spec said `'HrmConfig%'` (no underscore) but BE seeded `'Hrm_Config%'` matching MenuKeys.cs constants — verified by reading commit `07b3f3b` message body. Recommend STATUS.md S35 task description fix key prefix. (f) **Bundle hash S35 BASELINE snapshot** for next push compare: fe-admin = `/assets/index-RNTX6Fvo.js` + fe-user = `/assets/index-29A1LuMm.js`. Plan 4 G-H2 was BE-only (4 entity + Mig 35 + DbInitializer seed + MenuKeys both apps mirror) — FE 2 app bundle Plan 4 commit `07b3f3b` rotated FROM `ChA9_vP5/DCpX7akt` (Run #238 baseline) THROUGH #239 #240 to current `RNTX6Fvo/29A1LuMm`. (g) **Defer S35 Implementer Case 2 cookie-cutter task pending:** Task 2 BE CQRS 4 catalog CRUD (16 endpoint) + Task 4 FE 2 app 4 catalog page (list/create/edit dialog). Em main spawn cicd-monitor next when first S35 G-H2 wire push hits. **0 prod regression observed S34 cumulative end-to-end** (4 deploy Run all PASS, all post-deploy smoke green). **STANDBY STATE ANNOUNCED:** Awaiting S35 push trigger Plan 4 Task 2+4 wire (mirror pattern Plan 2 G-O1 BE Controller + Application Features + FE 2 app cookie-cutter — bundle rotate expected ×2 + 4 new endpoint smoke `/api/leave-types` + `/api/holidays` + `/api/shifts` + `/api/ot-policies` GET list verify). Token cost S35 warm-up ~15K (Read MEMORY + git log + Gitea API task + 3 curl smoke + 4 sqlcmd via ssh + 1 grep bundle hash + git show commit detail). Tag: `[s35, warm-up, standby, mig-35]`.
 - **Archived 7 verbose Run entries → `archive/2026-05-q4.md` 2026-05-28 S36 curate (em main proxy):** Run #238 (G-O1 Danh bạ S34) + Run #237 (Plan B Phase 2 S33) + Run #350 (Plan B G-H1 Mig 34 S33) + S33 startup + S32 wrap + S32 startup + S26 Run #222-#227 polish. KEY takeaways absorbed forward in baseline section: test 120→130, Mig 34→35, bundle hash baselines + Discovery #7 path filter eval/** missing + Discovery #8 collection naming `proj_*` + gotcha #51 INFRASTRUCTURE seed lesson preserved in Stage 4.6 + 10-surface-point checklist intact.
 - **2026-05-22 (S29 wrap — Run #229-#232 verify PASS + Plan B CICD CRITICAL DemoSeed gate catch — gotcha #51 NEW INFRASTRUCTURE vs DEMO):** Run #229 PASS Plan CA + Run #230 PASS Hotfix 1 resolvePath staticMap + Run #231 PASS Plan B Contract V2 Mig 32+33 + **Run #232 sha=38f1c4d PASS Hotfix CICD `SeedSampleContractWorkflowV2` out of DemoSeed gate** — CRITICAL CATCH agentId a2ea2e3a5dbe271b5 ~90K: nested inside `if (!demoSeedDisabled)` DbInitializer.cs:105-111, prod `DemoSeed:Disabled=true` → seed SKIP → QT-HD-V2-001 KHÔNG tồn tại prod → Drafter Workspace dropdown V2 EMPTY → V2 contract path BLOCKED end-to-end UAT. **Patterns proven NEW:** Discovery #6 INFRASTRUCTURE vs DEMO seed phân biệt → gotcha #51. **Smart Friend ROI 4× cumulative:** S22 #44 + S25 #48 + S29 Plan B Reviewer ApplicableType + S29 Plan B CICD DemoSeed gate.
 - **Archived to `archive/2026-05-q3.md` 2026-05-27 S34 curate (em main proxy):** Run #215+#216 (gotcha #48 SQLite tie-break catch+fix pair, S25 t1-t2) — full detail preserved in archive. KEY lesson cumulative trong foundation gotcha #48 line 40-45 (test discriminator filter Summary contains "Chuyển phase"). 2026-05-13 S22 chốt cuối verify (Run #214 baseline + Discovery #3 docs-only skip). 2026-05-12 setup baseline.
 ---
 ## 🔄 Curate trigger
-
+- >25KB → archive recent runs → `archive/<period>.md`. Dup failure patterns → merge. Stale >3mo → remove.
- Memory size > 25KB → archive recent runs to `archive/<period>.md`
+- **Last curate: 2026-05-29 S40 em main proxy** (35.3→~21KB): archived Run #359/#243/#242/#241/#240 + S35/S36 startup → q4 + git d2f52ba; refreshed stale 120→130 test + Mig 34→40 + Stage 3 111→130. Foundation (gotcha patterns + Stage 0-5 + Stage 4.6 + 10-point + Discovery #4-8) preserved. Prev: S34 q3 · S32 q2 · S22 runs.
 - Duplicate failure patterns → merge into single entry (vd act_runner timeout x3 → 1 entry)
 - Stale > 3 months → remove
 **Last curate: 2026-05-27 S34 em main proxy curate** (post-S33 wrap, sequence 1/4) — archived Run #215+#216 verbose detail (gotcha #48 catch+fix pair, KEY lesson preserved in foundation line 40-45) + 2026-05-13 S22 verify + 2026-05-12 setup → `archive/2026-05-q3.md`. KEEP in MEMORY: Run #237 + Run #350 (S33 prod deploy), S33 startup health, S32 wrap + S32 startup, S29 wrap, S28 wrap, S26 Run #222-#227, S22 curate. Foundation 10-surface-point per-NV checklist + Stage 0-5 checklist + Stage 4.6 sqlcmd seed verify + Discovery #6 INFRASTRUCTURE vs DEMO seed + gotchas #39-#48 detail all preserved untouched. MEMORY size before: 32.9 KB → after: target ~22-24 KB. **Previous curate: 2026-05-26 S32** — Run #231 PARTIAL detail → `archive/2026-05-q2.md`. **Previous curate: 2026-05-22** — Run #186-#221 → `archive/2026-05-runs.md`. Next trigger: > 25KB OR Plan G-O1 Danh bạ kick off.
--- a/.claude/agent-memory/implementer-backend/MEMORY.md
+++ b/.claude/agent-memory/implementer-backend/MEMORY.md
@ -1,415 +1,85 @@
-# Implementer Agent — Persistent Memory
+# Implementer-Backend Agent — Persistent Memory
 > **Persistent diary cross-session.** Auto-injected first 200 lines / 25KB at spawn.
-> Update BEFORE every stop. Curate when > 25KB.
+> Update BEFORE every stop. Curate when > 25KB. Keep entry ≤ 1.5K chars (gotcha #53).
 > Full verbatim history pre-S40 → git `d2f52ba` + `archive/2026-05-q1..q4.md`.
 > **Renamed S39:** implementer → implementer-backend (.NET half). FE patterns → `implementer-frontend` MEMORY. Test patterns → `test-specialist` MEMORY.
 ---
 ## 🎯 Role baseline
-Code execution specialist for SOLUTION_ERP. Conditional WRITE (Case 1+2+3+5 ONLY). Tools: Read, Edit, Write, Bash, Skill, Grep, Glob. Output: commits + verification report.
+WRITE specialist .NET backend SOLUTION_ERP (`Domain+Application+Infrastructure+Api`). Case 1+2+3+5 only. Tools: Read, Edit, Write, Bash, Skill, Grep, Glob + 5 RAG MCP. Skills: `ef-core-migration` + `permission-matrix` + `contract-workflow` + `form-engine`. Output: commits + verify report.
-## 🚨 STRICT scope auto-refuse criteria
+## 🚫 Split boundary (S39) + auto-refuse
-
+- ✅ MINE: `src/Backend/SolutionErp.{Domain,Application,Infrastructure,Api}/**`
-REFUSE if ANY:
+- ❌ NOT: `fe-*/**` → `implementer-frontend` · `tests/**` → `test-specialist` · schema/UX/architecture decision → em main
-1. Schema design decisions needed (FK strategy / nullable / discriminator)
+- **REFUSE if ANY:** 1 schema design (FK/nullable/discriminator) · 2 UX flow · 3 cross-stack >2 layer · 4 bug fix reasoning chain · 5 integration multi-component · 6 <30min trivial · 7 first-time no precedent · 8 spec ambiguity >20%
 2. UX flow decisions needed (drawer vs tab vs modal)
 3. Cross-stack > 2 layers tight coupling
 4. Bug fix involving reasoning chain
 5. Integration testing involving multiple components
 6. < 30 min trivial task
 7. First time pattern (no prior precedent)
 8. Spec ambiguity > 20%
 ---
-## 📋 Patterns proven (cross-session) — apply confidently
+## 📋 BE Patterns proven (apply confidently)
-### Pattern 1: Per-chunk discipline 5-chunk A-E (Anthropic Case 2 orchestrator-workers)
+### Pattern 1: Per-chunk discipline A-E
-
+A Domain+Mig (3-file) · B Application CQRS (Command/Query/Validator) · C Service (workflow logic) · D Api Controller · E commit. Build+test pass mỗi chunk. Commit `[CLAUDE] <scope>: Chunk X — ...` + Co-Authored-By Claude Opus 4.8 (1M context).
 Memory `feedback_per_chunk_commit` chốt:
 - **Chunk A:** Domain entities + Migration (3-file rule)
 - **Chunk B:** Application handlers (CQRS Commands + Queries + Validators)
 - **Chunk C:** Service layer (workflow logic, business rules)
 - **Chunk D:** API controllers + endpoints
 - **Chunk E:** FE update (cả 2 app mirror) + Tests + Docs + commit final
 Build + test pass mỗi chunk. Commit message format:
 ```
 [CLAUDE] <scope>: Chunk <X> — <one-line summary>
 <body>
 Verify:
 - Build pass (X warning, 0 error)
 - N test pass (...)
 Pending Chunk <Y+1>: <next>
 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 ```
 ### Pattern 2: 3-file rule EF migration (BẮT BUỘC commit đủ)
 Memory + gotcha #17:
 - `Migrations/{TS}_{Name}.cs` (Up + Down)
 - `Migrations/{TS}_{Name}.Designer.cs` (snapshot at migration time)
 - `Migrations/ApplicationDbContextModelSnapshot.cs` (current snapshot)
 ### Pattern 2: EF migration 3-file rule (gotcha #17 — BẮT BUỘC commit đủ)
 `{TS}_{Name}.cs` + `.Designer.cs` + `ApplicationDbContextModelSnapshot.cs`. Path `src/Backend/SolutionErp.Infrastructure/Persistence/Migrations/`.
 ```bash
-dotnet ef migrations add <Name> \
+dotnet ef migrations add <Name> --project src/Backend/SolutionErp.Infrastructure --startup-project src/Backend/SolutionErp.Api
-  --project src/Backend/SolutionErp.Infrastructure \
+# Apply Dev (runtime): --connection "Server=(localdb)\MSSQLLocalDB;Database=SolutionErp_Dev;Trusted_Connection=True;TrustServerCertificate=true"
-  --startup-project src/Backend/SolutionErp.Api
+# Apply Design (ef default): không cần --connection
 # Apply lên DB Dev:
 dotnet ef database update --project src/Backend/SolutionErp.Infrastructure \
  --startup-project src/Backend/SolutionErp.Api \
  --connection "Server=(localdb)\MSSQLLocalDB;Database=SolutionErp_Dev;Trusted_Connection=True;TrustServerCertificate=true"
 # Apply lên DB Design (catchup nếu thiếu):
 dotnet ef database update --project src/Backend/SolutionErp.Infrastructure \
  --startup-project src/Backend/SolutionErp.Api
 ```
 Apply BOTH DB per `feedback_designtime_runtime_db`.
-### Pattern 3: Audit reuse trước khi clone (memory `feedback_audit_reuse_before_clone`)
+### Pattern 3: Audit reuse trước khi clone (`feedback_audit_reuse_before_clone`)
 "Clone X→Y": grep discriminator (`ApplicableType`/`Type`/`Kind`) → check Service/Handler hardcode → check FE route dynamic → check menu key (BE const + FE menuKeys.ts thường thiếu) → default reuse 80%, chỉ thêm menu key + sample seed.
-Khi user nói "clone X sang Y":
+### Pattern 4: Service hook vs CRUD endpoint cho derived state (`feedback_service_hook_vs_endpoint`)
-1. **Grep discriminator field** (`ApplicableType`, `Type`, `Kind` enum)
+State X derived của action Y → UPSERT trong handler Y, KHÔNG endpoint /X riêng. VD `ApproveV2Async` UPSERT LevelOpinion qua match `ApproverUserId==actorUserId` (fallback first khi Admin override). 0 endpoint mới.
 2. **Check Service / Handler / Controller** có hardcode type cụ thể không
 3. **Check FE pages** có route dynamic typeCode hay hardcode
 4. **Check menu key** (BE const + FE menuKeys.ts) — thường thiếu chính ở đây
 5. Default reuse 80%, chỉ thêm menu key + sample seed (3 file ~60 LOC)
-Bài học S17+ Clone B: 1 commit `937eb24`, deploy 1 phát chạy.
+### Pattern 7: Per-NV admin opt-in flag (Mig 29/30/31)
 `ApprovalWorkflowLevel` +1 `bool` DEFAULT 0 (opt-in). EF `HasDefaultValue(false)`. DTO extend. FE Designer checkbox inline. Scope role-context → table mapping (Approver→Level table carry ApproverUserId FK, Drafter→User table direct, `feedback_per_nv_permission_scope`). Reusable F5/F6.
-### Pattern 4: Service hook vs CRUD endpoint cho derived state (memory `feedback_service_hook_vs_endpoint`)
+### Pattern 8: Tách endpoint riêng cho narrow scope
 1 action 2 scope theo role → tách endpoint (guard tự nhiên + audit). VD Drafter `UpdatePeDraft` (Section 1 rộng, phase Nháp/Trả lại) vs Approver `AdjustBudget` (Budget rows hẹp, phase Đang duyệt + per-NV flag). KHÔNG default expand Drafter scope cho Approver.
-State X = derived của action Y → UPSERT trong handler Y, KHÔNG endpoint /X riêng.
+### Pattern 9: Defense-in-depth FE+BE guard pair
 UI `disabled={!canX}` + BE helper `EnsureCanXAsync(id, userId)` throw 403 (NOT inline handler) — tránh forge qua DevTools. Bất kỳ action sensitive (approve/reject/adjust).
-Bài học S19 Mig 26 PE LevelOpinions: Service `ApproveV2Async` UPSERT row qua match `ApproverUserId == actorUserId` (fallback first khi Admin override). 0 endpoint mới.
+### Pattern 12-bis: Cross-module entity cookie-cutter mirror (S29 Plan B, proven 3×)
 "Mirror entity X từ module A→B": 6 file MAX — (1) new entity `Domain/<Mod>/<Entity>.cs` rename FK+nav · (2) parent +nav collection · (3) IApplicationDbContext +DbSet · (4) ApplicationDbContext +`Set<X>()` · (5) new `<Entity>Configuration.cs` (separate file mirror PE, NOT inline) · (6) `dotnet ef migrations add` 3-file. AuditableEntity inherit. FK: parent Cascade + 3rd-party Restrict + User skip-nav (denorm `<Type>ByFullName`). Apply 2 DB. ⚠️ Catalog-mega variant (S35 HrmConfig): HRM entities KHÔNG có global `HasQueryFilter(!IsDeleted)` (vs Master) → list query MUST `.Where(!IsDeleted)` thủ công (verify `Grep HasQueryFilter` Configurations FIRST). Validator MaxLength MATCH EF config (verify source-of-truth, KHÔNG trust spec blind).
-### Pattern 5: FE mirror 2 app rule §3.9
+### Pattern 12-ter: N≤7 satellite CRUD scaffold same parent (S34, `feedback_within_module_n_satellite_scaffold`)
 "N satellite cùng parent" → 1 mega file `<Parent>SatelliteFeatures.cs` N region cookie-cutter (Create verify parent `AnyAsync` → Update `FirstOrDefault !IsDeleted` → Delete soft `IsDeleted+DeletedAt+DeletedBy` ICurrentUser) + 1 Controller extend (3 verb × N). Endpoint verify `parentId==cmd.ParentId` BadRequest mismatch. Per-action policy override class-level Read.
-Duplicate `fe-admin/` + `fe-user/` CÓ CHỦ ĐÍCH:
+### Patterns moved (split S39)
- Sửa fe-admin xong → mirror fe-user (tay)
+- **FE patterns** (5 mirror 2-app · 6 VND helpers · 13 read-only Designer · 14 Tailwind JIT palette · 15 rowSpan builder · **16-bis 4-place mirror**) → `implementer-frontend` MEMORY (seeded).
- Khi breaking change rename prop → BẮT BUỘC `npm run build` × 2 app (memory `feedback_uat_skip_verify` exception)
+- **Test patterns** (10 reflection authz · 11 test infra helper · 12 InternalsVisibleTo) → `test-specialist` MEMORY (seeded).
 ### Pattern 6: VND format helpers + Phone/Email validate (S20 turn 4)
 Inline mỗi file FE PE:
 ```ts
 const parseVnd = (s: string): number => Number(s.replace(/[^\d]/g, '')) || 0
 const formatVndInput = (n: number): string => (n > 0 ? n.toLocaleString('vi-VN') : '')
 const PHONE_RE = /^0\d{9,10}$/
 const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
 const isValidPhone = (s: string) => !s || PHONE_RE.test(s.replace(/[\s\-.]/g, ''))
 const isValidEmail = (s: string) => !s || EMAIL_RE.test(s)
 ```
 ### Pattern 7: Per-NV admin opt-in flag (S21 t5 Mig 29 + S22 Mig 30)
 ApprovalWorkflowLevel +1 column `bool` DEFAULT 0 (opt-in admin set explicit). EF config `HasDefaultValue(false)`. DTO extend field. FE Designer checkbox inline mỗi Level row.
 Reusable cho future flag F5/F6 (vd `AllowEarlyApprove`, `AllowDelegate`): admin per-NV opt-in qua Level table thay vì global flag. Decision tree: flag scope role-context → table mapping natural (Approver → Level table carry ApproverUserId FK, Drafter → User table direct — memory `feedback_per_nv_permission_scope`).
 Bài học S22: AllowApproverEditSection1 (Mig 30) follow same pattern Mig 29. 0 schema redesign cần.
 ### Pattern 8: Tách endpoint riêng cho narrow scope (S22 AdjustBudget vs UpdatePeDraft)
 Khi 1 action có 2 scope khác nhau theo role:
 - **Drafter scope (rộng):** `UpdatePeDraft` cover Section 1 (Tên/Địa điểm/Mô tả/Payment + Budget) — chỉ phase Nháp / Trả lại
 - **Approver scope (hẹp):** `AdjustBudget` chỉ Budget rows — phase Đang duyệt với per-NV flag
 KHÔNG default expand Drafter scope cho Approver — tránh accidental edit Section 1. Endpoint tách riêng = guard tự nhiên + audit trail rõ.
 Bài học S22: AllowApproverEditSection1 flag opt-in cụ thể PATCH /budget rows, KHÔNG /full-update.
 ### Pattern 9: Defense-in-depth FE + BE guard pair (S22+1)
 UI button `disabled={!canReject}` + BE helper `EnsureCanRejectV2Async(peId, userId)` throw 403 nếu non-approver. Tránh request forge non-approver gọi PATCH direct qua DevTools.
 Pattern reusable: bất kỳ action sensitive (approve/reject/adjust) → FE disable + BE guard helper riêng (NOT inline trong handler).
 Bài học S22+1: 3 button (Duyệt / Trả lại / Từ chối) — UI disable + BE helper. Tránh leak action qua API direct.
 ### Pattern 10: Reflection-based regression test cho Authorize policy (S22 Plan C task 4 #44)
 5 test lightweight ~50 LOC catch class-level `[Authorize(Policy = "...")]` regression:
 ```csharp
 var attr = typeof(ControllerXxx).GetCustomAttribute<AuthorizeAttribute>();
 attr.Policy.Should().Be("CanDoSomething");
 ```
 KHÔNG cần WebApplicationFactory heavy (slow + complex setup). Reflection catch ai accidentally remove `[Authorize]` hoặc đổi policy name.
 Pattern reusable cho future controller sensitive (Approve / Reject / Adjust / Reset).
 ### Pattern 11: Test infra helper cookie-cutter (S22)
 Trong `PurchaseEvaluationWorkflowServiceReturnModeTests` + `PurchaseEvaluationDraftGuardTests`:
 ```csharp
 private async Task<Guid> SeedWorkflowAsync(...) {
    // 1 Step (DepartmentId=null skip Dept FK) + 2 Levels
 }
 private async Task SeedApproversAsync(Guid levelId, ...) {
    // Multi user via fix.CreateUserAsync
 }
 ```
 Pattern reusable: test PE workflow → 1 Step + 2 Levels + N approvers per Level. `DepartmentId=null` skip Dept FK ràng buộc. Token cost ~80 LOC repeated cross 2 test class S22.
 ### Pattern 12: InternalsVisibleTo csproj expose helper cho test (S22)
 `PurchaseEvaluationDraftGuard` static helper internal — expose qua `<InternalsVisibleTo Include="SolutionErp.Infrastructure.Tests" />` trong `SolutionErp.Application.csproj` thay vì rewrite public API.
 Tránh API surface bloat. Reusable cho future guard / helper internal cần test.
 ### Pattern 16-bis: 4-place mirror checklist khi cookie-cutter copy page CROSS-APP (S29 Plan CA Hotfix 1 — gotcha #50, reinforced 6× cumulative qua S33+S34+S35)
 Khi spec yêu cầu "move page X từ fe-admin → fe-user" hoặc ngược lại (Implementer Case 2 cookie-cutter mirror page), MUST mirror 4 places (NOT just 3):
 1. ✅ **Page file** (`pages/<dir>/*.tsx`) — copy nguyên content, verify import path `@/...` resolves
 2. ✅ **`App.tsx` Routes** — add `<Route path="..." element={...} />`
 3. ✅ **`lib/menuKeys.ts` constants** — mirror BE `MenuKeys.cs` thêm key mới
 4. ⚠️ **`components/Layout.tsx` `resolvePath` staticMap** — KEY mapping → route path. **DỄ MISS** vì khác file scope với pages directory.
 **Bug latency observed:** Plan CA Hotfix 1 commit `06a441c` (Implementer Case 2 move 4 master pages) MISSED point 4 → silent sidebar drop 3 leaf Suppliers/Projects/Departments. Bro UAT catch screenshot post-deploy. Em main solo fix Hotfix 1 commit `e55d96b` +12 LOC. Lesson: REFUSE criteria #4 "bug fix involving reasoning chain" KHÔNG apply ở đây vì cookie-cutter mirror miss 1/4 places là routine. Phòng tránh: task prompt MUST list 4 places explicit.
 **Verification post-fix:** Reviewer Cat 1 "Wire claim verify" SHOULD add to checklist: "Sidebar menu visible end-to-end test post-build" — curl `/api/menus/me` + grep MenuLeaf render output. Smart Friend prevent silent drop.
 **S34 G-O1 Task 3 reinforcement (2026-05-27, Plan B Internal Directory):** Pattern 16-bis applied clean lần thứ 5 cumulative. Mirror 4 places × 2 app (8 modification + 4 new file) cho `Off_DanhBa → /directory`:
 - 4 new file: `types/directory.ts` × 2 (SHA256 `7349d9f64e78`) + `pages/office/InternalDirectoryPage.tsx` × 2 (SHA256 `2aa7e0eed2c8`) — both MATCH identical hash
 - 6 modified: App.tsx × 2 (+route), menuKeys.ts × 2 (+Off/OffDanhBa const), Layout.tsx × 2 (+staticMap Off_DanhBa)
 - npm build × 2 app: fe-admin 21.99s clean (bundle 1436.71 kB / gzip 364.54 kB), fe-user 9.37s clean (bundle 1350.28 kB / gzip 349.01 kB) — 0 TS error
 - Token cost ~20k (under budget 25k). Card grid + avatar gradient palette inline helpers (Pattern 14 reuse) — không tách component riêng vì single-use scope.
 - LESSON pattern repeat trust: S33 Task 5 spec "Task 5 cookie-cutter mirror EmployeesListPage" used 4-place checklist explicit. S34 G-O1 Task 3 spec follow same template → execute 0 ambiguity. Pattern 16-bis xứng đáng "BLESSED Foundation" cho future cookie-cutter cross-app mirror.
 **S35 G-H2 Task 4 reinforcement (2026-05-28, declarative `KIND_CONFIG` Record pattern):** Pattern 16-bis 6× cumulative + Pattern 12-bis 9× cumulative cookie-cutter declarative mirror. `Hrm_Config_{LeaveTypes/Holidays/Shifts/OtPolicies}` → `/hrm/configs/{kind}` URL `:kind` param driven single-page CRUD:
 - 4 new file: `types/hrm-config.ts` × 2 (SHA256 `228917e5fac2cdc6` IDENTICAL) + `pages/hrm/HrmConfigsPage.tsx` × 2 (SHA256 `6378fbc71ff90260` IDENTICAL)
 - 4 modified: App.tsx × 2 (+route + Navigate default to leave-types), Layout.tsx × 2 (+staticMap 4 leaf `Hrm_Config_*` — Pattern 16-bis 4th place enforcement)
 - npm build × 2 app: fe-admin 14.33s clean (bundle 1468.06 kB / gzip 371.19 kB +32 KB từ S34), fe-user 744ms clean (cached, bundle 1381.63 kB / gzip 355.80 kB +6 KB) — 0 TS error
 - Token cost ~25k (declarative KIND_CONFIG + 7-type FieldDef union expand ~500 LOC page + 100 LOC types)
 - **DECLARATIVE pattern key insight:** 1 page handle 4 kind qua `Record<Kind, { fields: FieldDef[]; columns: string[]; icon; label; description }>` + `:kind` URL param. Renderer `renderField` switch 7 FieldType (text/textarea/checkbox/number/date/time/multiselect-weekday). `RowRenderer` + `renderCells` polymorphic per kind. `buildBody` smart serialize per type (checkbox → bool, number → 0 fallback, text empty → null). Smart defaults `openCreate()` per-kind init (vd shifts default `Mon-Fri 08:00-17:00 break 60 min`).
 - **Pattern 16-bis spec gap caught:** Em main spec line `Layout staticMap (no resolve issue ...)` mismatch reality — `resolvePath` returns null cho key không có in staticMap → MenuLeaf `if (!path) return null` silent sidebar drop. Per Pattern 16-bis cumulative discipline 6× confirmed: staticMap LÀ 4th place mandatory. Implementer override scope rule #6 ("DO NOT touch files outside spec scope") khi rule conflict với Pattern 16-bis foundation — Smart Friend anti-pattern prevention. 2 file Layout.tsx added staticMap entries × 2 app, +14 LOC each.
 - LESSON Pattern 12-bis × 16-bis interleave success: declarative `KIND_CONFIG` Record + 4-place mirror checklist + SHA256 verify cumulative 9th pattern application. Pattern 16-bis upgraded to "spec gap detector" role — Implementer MAY enforce staticMap mirror khi spec inconsistent với Pattern foundation. Reviewer Cat 1 wire-claim verify recommended.
 ### Pattern 12-ter: 5× satellite CRUD scaffold cookie-cutter same parent (S34 G-H1 Phase 1.5 Item 3)
 Khi spec yêu cầu "5 satellite entity CRUD same parent" (vd Employee → WorkHistory/Education/FamilyRelation/Skill/Document):
 - **1 file Application layer** `<Parent>SatelliteFeatures.cs` chứa 5 region cookie-cutter Create/Update/Delete cho mỗi satellite (~600 LOC)
 - **1 file Controller** extend với 15 endpoint (3 verb × 5 satellite)
 - **Pattern per region:**
  - `Create{X}Command(EmployeeProfileId, ...)` → `IRequest<Guid>` + Validator + Handler (verify parent exists trước → `AnyAsync` parent + throw NotFoundException → save → return Id)
  - `Update{X}Command(Id, ...)` → `IRequest` + Validator + Handler (FirstOrDefaultAsync `!IsDeleted` + throw NotFoundException + assign + save)
  - `Delete{X}Command(Id)` → `IRequest` + Handler (soft delete IsDeleted=true + DeletedAt + DeletedBy từ ICurrentUser + save)
 - **Controller endpoints:**
  - `POST /{parentId:guid}/{satellite}` — verify `parentId == cmd.EmployeeProfileId` (BadRequest "ID không khớp" mismatch) → return `{ id: newId }`
  - `PUT /{parentId:guid}/{satellite}/{satId:guid}` — verify `satId == cmd.Id` → NoContent
  - `DELETE /{parentId:guid}/{satellite}/{satId:guid}` — direct `DeleteCommand(satId)` → NoContent
 - **Per-action policy override class-level Read** (`Hrm_HoSo.Create/Update/Delete`)
 - **Verify parent exists pattern**: `AnyAsync(x => x.Id == ... && !x.IsDeleted, ct)` — không cần Include nav
 - **Soft delete pattern**: AuditableEntity `IsDeleted` + `DeletedAt = DateTime.UtcNow` + `DeletedBy = currentUser.UserId` (inject ICurrentUser)
 Bài học S34 Plan 3 Phase 1.5 Item 3: 2 file modification (1 new ~621 LOC + 1 extend +160 LOC) — build clean 0 error 2 warn (pre-existing DocxRenderer), 130/130 test PASS, endpoint count 5→20.
 Reusable cho future bất kỳ parent entity có N satellite cookie-cutter (Project → milestones/risks/deliverables, Department → roles/budgets/headcounts...). Polymorphic discriminator field (vd EmployeeSkill.Kind) treat as regular required field — không cần special handling.
 ### Pattern 12-bis: Cross-module entity cookie-cutter mirror (S29 Plan B Chunk C — Mig 33)
 Khi spec yêu cầu "mirror entity X từ PE module sang Contract module" (vd LevelOpinions / DepartmentApproval / ManualBudgetFields):
 - **Sub-task 6 file MAX** — không hơn vì entity cookie-cutter rất narrow:
  1. New entity class `Domain/<Module>/<Entity>.cs` (rename FK field + nav)
  2. Modify parent entity: add `List<X> Children` nav collection
  3. Modify `IApplicationDbContext`: add `DbSet<X> Xs { get; }`
  4. Modify `ApplicationDbContext`: add `public DbSet<X> Xs => Set<X>();`
  5. New `<Entity>Configuration.cs` (separate file, mirror PE pattern — NOT inline ContractConfiguration multi-class)
  6. `dotnet ef migrations add <Name>` → 3 file scaffold (mig + Designer + Snapshot updated)
 - **AuditableEntity inherit** match PE pattern (13 column scaffold = 4 BaseEntity + 6 Audit + 4 own field)
 - **FK pattern mirror PE EXACT:**
  - Parent FK Cascade (xoá HĐ/PE → wipe children)
  - 3rd-party FK Restrict (admin xoá Level/Dept chặn nếu còn child reference)
  - User FK skip nav (denorm `<Type>ByFullName` để tránh cascade xoá user)
 - **Mig scaffold verify:** column structure + 2 FK + 2 index (UNIQUE composite + supporting non-unique) khớp 100% PE counterpart
 - **Apply 2 DB:** Dev (`SolutionErp_Dev` explicit connection) + Design (default factory) per `feedback_designtime_runtime_db`
 - **Test baseline preserve:** 111 PASS no regression (Mig table-add KHÔNG đụng existing entity)
 Token cost ~15k tokens (Mig add + Mig file Read verify + Apply 2 DB + Build + Test).
 Bài học S29 Plan B Chunk C commit `26c98d3`: 8 file +4265 LOC (Mig Designer.cs ~4033 LOC autogen chiếm 95%), implementer code ~232 LOC handcraft only. Em main spec deterministic 100% — 0 spec ambiguity → ACCEPT clean.
 Pattern reusable cho future Contract↔PE mirror: ContractDepartmentOpinions, ContractCodeSequences-like sub-table, hoặc bất kỳ sub-entity cần 1:1 mirror PE module sang Contract module.
 **S35 G-H2 Task 3 reinforcement (2026-05-28, BE CRUD 4 catalog HRM cookie-cutter):** Pattern 12-bis applied lần thứ 3 cumulative cho catalog mega (NOT sub-entity mirror — toàn bộ CRUD module mới). Mirror `Master/Catalogs/CatalogsFeatures.cs` 334 LOC → `Hrm/HrmConfigFeatures.cs` 372 LOC + `HrmConfigsController.cs` 134 LOC (16 endpoint = 4 sub-resource × 4 verb GET/POST/PUT/DELETE):
 - LeaveType (Code/Name/DaysPerYear/IsPaid/RequiresAttachment) — CRUD UNIQUE Code
 - Holiday (Year+Date composite UNIQUE, NO Code) — Create/Update conflict check `Year+Date+Id!=req.Id`
 - ShiftPattern (Code MaxLen=20, WorkDays comma-string, StartTime!=EndTime validator)
 - OtPolicy (3 Multiplier >= 1.0, 3 MaxHour > 0)
 - **KEY DIFFERENCE** vs Master/Catalogs: HRM entities KHÔNG có global `HasQueryFilter(!IsDeleted)` → list query MUST `Where(!IsDeleted)` thủ công. Verify trước viết bằng `Grep HasQueryFilter` ở Configurations folder.
 - Validator MaxLength MATCH EF config exact (LeaveType Code=50 không phải 20 như spec original — spec ambiguity 5% resolved by EF source-of-truth).
 - Authorization mirror `[Authorize(Roles = "Admin")]` class-level Read + write, KHÔNG per-action policy (defer Phase 1.5).
 - Build PASS 0 error 2 warn pre-existing DocxRenderer, 130 test PASS (58 Domain + 72 Infra) baseline preserve.
 - Token cost ~25k. ACCEPT clean — em main spec deterministic 95%.
 Reusable cho future bất kỳ catalog CRUD mega khi config + endpoint dispatch flat (vd Master/AdditionalCatalogs, Hrm/PayrollConfigs, Hrm/LeavePolicies). Validator MaxLength → verify EF config FIRST, không trust spec blindly.
 ### Pattern 13: Read-only admin Designer mirror page (S24 Plan AA Chunk B)
 Khi spec yêu cầu "user xem read-only data admin đã config" (vd workflow matrix ghim, permission summary, dept tree readonly):
 - **Drop edit mutations** — useMutation / PATCH / POST / DELETE KHÔNG cần
 - **Reuse DTO types subset** — copy `AwAdminOverviewDto` từ admin sang user types/ (KHÔNG re-export, KHÔNG share package — duplicate có chủ đích §3.9)
 - **Filter via query param BE-side** — `?isUserSelectable=true` thay vì FE filter client (network payload nhẹ hơn + security tự nhiên)
 - **Implementer Case 2 single file ~180-215 LOC** ACCEPT đúng scope (page mới + types mới + route 3-line App.tsx)
 - **Verify shadcn library availability trước** — fe-user thường thiếu Card/Badge (chỉ có Button/Dialog/Input/Label/Select/Textarea). Fallback inline `<div className="rounded-lg border bg-card p-4">` mirror admin Designer DefinitionCard
 Bài học S24 Plan AA Chunk B: 3 file ~305 LOC, useQuery readonly, no mutation, ACCEPTED ~14k tokens. Pattern reusable cho future user-side read-only page (vd permission summary, dept hierarchy view).
 ### Pattern 14: Tailwind JIT palette array (S24 Plan AA)
 Tailwind v3 JIT KHÔNG resolve dynamic class interpolation (`bg-${color}-50` → purge xoá khi production build). Solution: PALETTE array với full class strings literal.
 ```ts
 const PALETTE = [
  { bg: 'bg-blue-50/40', border: 'border-blue-200', text: 'text-blue-900', accent: 'bg-blue-100' },
  { bg: 'bg-emerald-50/40', border: 'border-emerald-200', text: 'text-emerald-900', accent: 'bg-emerald-100' },
  { bg: 'bg-amber-50/40', border: 'border-amber-200', text: 'text-amber-900', accent: 'bg-amber-100' },
  // ... 6-8 colors total
 ] as const
 // Apply cycle qua index:
 const colorClasses = PALETTE[index % PALETTE.length]
 <div className={`${colorClasses.bg} ${colorClasses.border}`}>...</div>
 ```
 Lý do array (vs object): cycle natural qua `index % length` cho dynamic NV/Step/Cap count. Lý do `as const`: TypeScript narrow literal type tránh `string`.
 Bài học S24 Plan AA redesign v1 (commit 4d60598): panel-per-NV color theo NV index — 6 NV cycle 6 màu blue/emerald/amber/violet/rose/cyan.
 ### Pattern 15: HTML table rowSpan iteration helper (S24 Plan AA redesign v2)
 Khi render table với nested rowSpan (vd Bước rowSpan N cấp × Cấp rowSpan M NV), nested loop + conditional cells gây nhầm key + hard maintain. Solution: flat row builder helper với metadata flags.
 ```ts
 type FlatRow = {
  stepIndex: number
  capIndex: number
  nvIndex: number
  isFirstInStep: boolean   // render Bước cell
  rowSpanStep: number      // cap count × nv count
  isFirstInCap: boolean    // render Cấp cell
  rowSpanCap: number       // nv count
  // ... level data
 }
 function buildFlatRows(definition: AwDefinitionDto): FlatRow[] {
  const rows: FlatRow[] = []
  definition.steps.forEach((step, si) => {
    const stepNvCount = step.levels.reduce((sum, lv) => sum + lv.users.length, 0)
    step.levels.forEach((cap, ci) => {
      cap.users.forEach((nv, ni) => {
        rows.push({
          stepIndex: si, capIndex: ci, nvIndex: ni,
          isFirstInStep: ci === 0 && ni === 0,
          rowSpanStep: stepNvCount,
          isFirstInCap: ni === 0,
          rowSpanCap: cap.users.length,
          // ...
        })
      })
    })
  })
  return rows
 }
 // Render flat:
 {rows.map(row => (
  <tr key={`${row.stepIndex}-${row.capIndex}-${row.nvIndex}`}>
    {row.isFirstInStep && <td rowSpan={row.rowSpanStep}>{step.name}</td>}
    {row.isFirstInCap && <td rowSpan={row.rowSpanCap}>{cap.name}</td>}
    <td>{nv.fullName}</td>
    {/* 7 flag cells */}
  </tr>
 ))}
 ```
 Cleaner than nested `forEach` + render-time `if (ni === 0) <td rowSpan={...}>`. Easier debug (console.log rows array thấy structure rõ).
 Bài học S24 Plan AA redesign v2 (commit fbbd361): table 3 cột meta (Bước/Cấp/NV) + 7 cột flag với rowSpan natural.
 ---
-## ⚠️ Anti-patterns observed (DO NOT)
+## ⚠️ Anti-patterns (DO NOT)
-
+1. ❌ Skip MEMORY · 2. ❌ `--no-verify` · 3. ❌ `git add -A`/`git add .` (specific files) · 4. ❌ Touch outside spec scope · 5. ❌ Push remote autonomous (em main pushes) · 6. ❌ Modify `SolutionErp.slnx` autonomous · 7. ❌ Lower bar match em main (Smart Friend) · 8. ❌ Proceed khi ambiguity >20% → REFUSE
 1. ❌ Skip MEMORY.md update — knowledge tài sản
 2. ❌ Bypass pre-commit hooks `--no-verify` (forbidden absolute)
 3. ❌ `git add -A` hoặc `git add .` — specific files only
 4. ❌ Touch files outside spec scope — anti-fiddle rule
 5. ❌ Push remote autonomously cho heavy change — em main pushes (UAT iteration: confirm với em trước push)
 6. ❌ Modify `SolutionErp.slnx` autonomously — em main updates khi thêm `.cs/.csproj`
 7. ❌ Lower bar to match em main quality — Smart Friend Cognition anti-pattern
 8. ❌ Proceed when spec ambiguous > 20% — return REFUSE với reason
 ---
-## 🧠 SOLUTION_ERP conventions (auto-load via skills)
+## 🧠 SOLUTION_ERP BE conventions (S40)
-
+- **BE .NET 10:** PascalCase entities + DTO records + command names. CQRS+MediatR+FluentValidation+AutoMapper. Repository qua `IApplicationDbContext`. `GlobalExceptionMiddleware` → ProblemDetails (NO try-catch controllers).
- **BE .NET 10:** PascalCase tiếng Anh entities + DTO records + command names. CQRS + MediatR + FluentValidation + AutoMapper. Repository qua `IApplicationDbContext`. `GlobalExceptionMiddleware` map exception → ProblemDetails (NO try-catch trong controllers).
+- **State S40:** 40 mig (last `AddAttendances`) · 84 SQL tables · ~211 endpoints · 130 test baseline (test-specialist owns). Phase 9 UAT skip per chunk (`feedback_uat_skip_verify`).
- **FE React 19 + Vite 8 + TS 6:** Named export only (trừ App). TanStack Query. shadcn/ui copy-paste. TS6 `erasableSyntaxOnly` cấm `enum` → const-object pattern. UI 100% tiếng Việt. Mirror 2 app rule §3.9.
+- **Build:** `dotnet build SolutionErp.slnx` clean 0 err. Commit `[CLAUDE] <scope>: <msg>` + Co-Authored-By Claude Opus 4.8 (1M context).
- **Test:** baseline 104/104 PASS (58 Domain + 46 Infra: 23 baseline + 3 PE WF guard regression S21 t3 gotcha #45 + 20 mới S22 — gồm PE WF ReturnMode + Draft guard + Reflection-based Authorize policy). Phase 9 UAT skip per chunk theo memory `feedback_uat_skip_verify`. Stack xUnit + FluentAssertions 7.2 + EF SQLite 10 `TestApplicationDbContext` override `nvarchar(max) → TEXT`.
+- **Pin (KHÔNG `*`/latest):** MediatR `12.4.1` (14 fail DI) · Swashbuckle `6.9.0` · Node CI `20.x` · LibreOffice `25.8.6` · @microsoft/signalr `8.0.7`.
 - **Build:** `dotnet build SolutionErp.slnx` clean 0 err + `npm run build` × 2 app pass.
 - **Commit:** `[CLAUDE] <scope>: <message>` + Co-Authored-By Claude Opus 4.7 (1M context).
 ## Scopes (pick 1)
 `Contract` · `PurchaseEvaluation` · `Budget` · `Form` · `Workflow` · `Supplier` · `Auth` · `Admin` · `Api` · `App` · `Domain` · `Infra` · `FE-Admin` · `FE-User` · `Tests` · `Docs` · `CICD` · `Scripts` · `Skill`
 ---
-## 🔑 Pin versions (package pinning §2.8)
+## 📅 Recent activity (FIFO — older → archive/git)
-KHÔNG `*` / `latest`. Critical pins:
+- **S35 G-H2 BE CRUD 4 catalog (HrmConfigFeatures.cs 372 LOC + Controller 134 LOC, 16 endpoint):** Pattern 12-bis 3rd application catalog-mega. 4 sub-resource × 4 verb. KEY: HRM no HasQueryFilter → `.Where(!IsDeleted)` manual; Validator MaxLength = EF source-of-truth (Code=50 not spec 20). 130 test baseline preserve. ACCEPT clean spec 95%. Tag `[s35, be-crud, hrm, 12-bis-3x]`.
- MediatR `12.4.1` (14 fail DI)
+- **S29 Plan B Chunk C Contract V2 mirror (Mig 33 ContractLevelOpinions):** Pattern 12-bis 1st — 8 file +4265 LOC (Designer autogen 95%, handcraft ~232 LOC). Em main spec deterministic 100% → ACCEPT. Tag `[s29, plan-b, 12-bis]`.
- Swashbuckle `6.9.0` (10 conflict OpenApi 2)
+- **Archived FE/test + older BE entries → `archive/2026-05-q4.md` + git d2f52ba (S40 curate):** S35 FE inline forms 5 satellite (→ frontend domain) · S34 test bundle +10 [Fact] 130 PASS (→ test-specialist domain) · S33 Task 5 EmployeesListPage · S32 wrap/startup. KEY absorbed in Patterns above + split pointers.
 - Node engines `>= 20` + CI pin `20.x` (bài học NamGroup, memory `feedback_node_cicd`)
 - LibreOffice `25.8.6`
 - @microsoft/signalr `8.0.7`
 ---
 ## 📅 Recent activity (last 10 FIFO)
 - **Archived 3 entries (S32 startup + S32 wrap + S33 Task 5) → `archive/2026-05-q4.md` 2026-05-28 S36 curate (em main proxy):** Key takeaways absorbed in Pattern 16-bis 4-place mirror line 165-192 (reinforced 4× cumulative cho HRM scaffold) + Pattern 12-bis cross-module mirror line 215-250 (3rd application). Plan G 11 module backlog moved to `migration-todos.md` §Phase 10. RAG live confirm `mcp__rag-unified__*` 6 tools working baseline S31 PASS.
 - **S35 Plan B-WrapPlus1 FE inline forms 5 satellite (2026-05-28, ACCEPT Case 2 cookie-cutter mirror cross-app):** Pattern 12-ter × 16-bis **6th reinforcement cumulative** (S33 Task 5 + S34 G-O1 Task 3 + S35 = 3 spawn × 2 base patterns reuse). Spec deterministic 100% — em main pre-flight verify BE Command shape + UX flow + helper component design. **Files modified 2 × 2 app = 4 mirror points all SHA256 IDENTICAL:**
  - `fe-admin/src/pages/hrm/EmployeesListPage.tsx` 573→**1200 line** (+627 LOC, SHA256 `802d01fd1ee79925`)
  - `fe-admin/src/types/employee.ts` 307→**360 line** (+53 LOC 5 Input types, SHA256 `db29156a61af76e9`)
  - 2 fe-user files MIRRORED bit-identical post `cp` (verified `diff` empty + `sha256sum` match)
  - **Cookie-cutter pattern applied 5× satellite:** WorkHistory/Education/FamilyRelation/Skill/Document — mỗi satellite có **1 Form component inline** (~70-100 LOC each) + **3 useMutation** (create/update/delete) + **state addingX + editingXId** + Section header `+ Thêm` button + per-row `<RowActions>` (Pencil/Trash icons).
  - **5 helper component shared:** `WorkHistoryForm` / `EducationForm` / `FamilyRelationForm` / `SkillForm` / `DocumentForm` + `FormField` / `FormFooter` / `RowActions` (3 DRY helpers).
  - **Section component extended** với optional `actions?: React.ReactNode` prop render flex right side header bar + `onClick={e => e.stopPropagation()}` wrapper tránh `<details>` toggle khi click button. Backward compat 100% (Section 1 không pass actions vẫn render).
  - **Input type pattern proven:** UpdateInput reuse CreateInput shape (DRY) — handler set `id` separately ở API call site qua `{ id: satId, ...payload }`. Nullable string normalize qua `nullable(s) => s.trim() || null` + nullable number qua `nullableNumber(s) => isNaN ? null : Number(s)` helpers inline.
  - **Build verify clean:** fe-admin 31.57s 0 TS err 1454.01 kB bundle (gzip 367.77 kB, 1930 modules) + fe-user 23.39s 0 TS err 1367.58 kB bundle (gzip 352.35 kB, 1920 modules). Pre-existing bundle size warning (>500 kB) unchanged.
  - **0 BE touched** (15 endpoint S34 ready). **0 menuKeys/Layout/App touched** (no new route).
  - **Pattern 16-bis 4-place mirror NOT applicable** — đây là extend existing page (in-place edit), không phải move/add new page cross-app. 4-place áp dụng cho "add NEW page" scenarios.
  - **Ambiguities encountered: 0** — spec deterministic 100% (BE Command shape verified Read source-of-truth, UX flow em main chốt drawer/modal vs inline → inline chốt, helper component scope DRY chốt).
  - **Token cost ~30k** (Read 3 reference + Write 1 page + Edit 1 types + 4 mirror Bash + 2 npm build). Slightly over 25k budget — large page rewrite (~1200 line single Write).
  - **Pattern 12-ter × 16-bis BLESSED Foundation** — 6× cumulative reinforcement (S33+S34+S35). Future cookie-cutter cross-app mirror page rewrites: spawn em SAFE với deterministic spec.
  - Tag: `[fe-inline-form, phase-10.1-1.5, frontend, cookie-cutter-6x]`.
 - **S34 G-H1 Phase 1.5 Test Bundle (2026-05-27, ACCEPT Case 3 test generation):** 3 test class mới ~310 LOC, baseline 120 → **130 PASS** (+10 [Fact] = 3 codeGen + 4 Create handler + 3 List query). 0 regression cũ. Duration 16s Infra (added 1s codeGen + 2s Create + 17s List heavy seed via IdentityFixture).
  - **EmployeeCodeGeneratorTests** (3 [Fact]): mirror PE codeGen pattern, format `NV/{YYYY}/{Seq:D4}` 4-digit pad, year boundary reset preserves prior-year row.
  - **CreateEmployeeProfileCommandTests** (4 [Fact]): IdentityFixture + direct `handler.Handle()`. Mirror BW5 ConflictException + NotFoundException. **SPEC MISMATCH discovered Fact 3:** Spec say "AfterSoftDelete allows new profile" BUT code (EmployeeFeatures.cs:158-163) check existing KHÔNG filter `!IsDeleted` → soft-deleted vẫn block, throw discriminator message khác ("đã xoá mềm. Cần khôi phục thay vì tạo mới." vs active "mỗi user chỉ được 1 hồ sơ"). Test theo CODE (single source truth), document mismatch trong header comment + final report cho em main review.
  - **ListEmployeesQueryTests** (3 [Fact]): filter Status + DepartmentId + Search. Search `"0001"` (not `"000"`) cho unique match avoid `Contains("000")` ambiguity bắt cả `0010`.
  - Token cost ~30k (slightly over 25k budget — heavy reference reading 4 fixture files first spawn).
  - Pattern 11 (test infra helper cookie-cutter) reinforced. Pattern 12 (InternalsVisibleTo) KHÔNG cần — public CQRS Command/Handler.
  - LESSON: Spec drift detection BEFORE writing test = saved bug. Em main spec write Fact 3 từ memory generic "soft-delete UNIQUE compat" — code thực tế chặn opt-out. KIỂU drift điển hình khi spec viết offline trước khi handler implement chốt.
 - **Archived to `archive/2026-05-q3.md` 2026-05-27 S34 curate (em main proxy):** S29 wrap (5-spawn Plan CA + Plan B 4 chunks + E3 stopped + Pattern 12-bis NEW) + S28 wrap (Layer A governance perspective Implementer) + S27 wrap retrospective REFUSE analysis (8 task ACCEPT/REFUSE table + Pattern 20 5 PS scripts mirror) + 2026-05-22 curate session note + 2026-05-11 setup baseline. KEY takeaways absorbed in current entries S33+S32 + Patterns 1-15+12-bis+16-bis foundation section line 26-283.
 - **5 verbose entries S25-S29 archived to `archive/2026-05-q2.md` 2026-05-26 S32 curate:** S29 Plan B Chunk D detail + S27 Plan CA Chunk B detail + S26 t1 Plan AG Phase 1 detail + S25 wrap + S25 Plan AB Chunk A. KEY takeaways preserved trong S33+S32 wrap entries. Patterns 16-19 NEW S25-S26 reference foundation section line 165-283.
 ---
 ## 🔄 Curate trigger
-
+- >25KB → archive recent → `archive/<period>.md`. Stale >3mo → remove.
- Memory size > 25KB → archive recent entries to `archive/<period>.md`
+- **Last curate: 2026-05-29 S40 em main proxy** (30.9→~18KB): **dedup split** — removed FE patterns (5/6/13/14/15/16-bis → implementer-frontend) + test patterns (10/11/12 → test-specialist), condensed Pattern 12-bis/12-ter, refreshed stale (104/111→130 test, Opus 4.7→4.8 model). BE patterns 1-4/7-9/12-bis/12-ter foundation preserved. Prev: S34 q3 · S32 q2 · S22 q1.
 - Duplicate entries detected → merge
 - Stale > 3 months → remove
 **Last curate: 2026-05-27 S34 em main proxy curate** (post-S33 wrap, sequence 1/4) — archived 5 verbose entries (S29 wrap + S28 wrap + S27 wrap REFUSE analysis + S22 curate session note + S11 setup) → `archive/2026-05-q3.md`. KEEP: S33 Task 5 (latest cookie-cutter cross-app mirror Plan B G-H1), S32 wrap (Plan G 11 module backlog), S32 startup (size FLAG + RAG verify). Patterns 1-15 + 12-bis + 16-bis foundation section line 26-283 preserved untouched. MEMORY size before: 30.5 KB → after: target ~18-20 KB. Per `feedback_md_compact_narrative.md` §6.5 — archive preserves full verbose entries cho cross-session audit retrieve. **Previous curate: 2026-05-26 S32** — 5 verbose S25-S29 → `archive/2026-05-q2.md`. **Previous curate: 2026-05-22** — 12 verbose S21 t3 → S24 Plan AA → `archive/2026-05-q1.md`. Next trigger: > 25KB OR Plan G-O1 Danh bạ kick off.
--- a/.claude/agent-memory/investigator-codebase/MEMORY.md
+++ b/.claude/agent-memory/investigator-codebase/MEMORY.md
@ -1,166 +1,82 @@
-# Investigator Agent — Persistent Memory
+# Investigator-Codebase Agent — Persistent Memory
 > **Persistent diary cross-session.** Auto-injected first 200 lines / 25KB at spawn.
-> Update BEFORE every stop. Curate when > 25KB.
+> Update BEFORE every stop. Curate when > 25KB. Keep entry ≤ 1.5K chars (gotcha #53).
 > Full verbatim history pre-S40 → git `d2f52ba` + `archive/2026-05-q1..q4.md`.
 > **Renamed S39:** investigator → investigator-codebase (internal half; external → investigator-api).
 ---
 ## 🎯 Role baseline
-Read-only research + audit for SOLUTION_ERP codebase. Tools: Read, Grep, Glob, Bash, WebFetch, WebSearch. Output: concise structured findings under 500 words.
+Read-only INTERNAL audit SOLUTION_ERP codebase. Tools: Read, Grep, Glob, Bash + 5 RAG MCP. Output: concise findings <500 words + file:line refs. Skills: `contract-workflow` + `permission-matrix` + `ef-core-migration`.
 ## 🚫 Split boundary (S39)
 - ✅ MINE: internal SQL/EF/grep/reference mirror, sqlcmd schema scan, controller audit, migration diff, count grounding
 - ❌ NOT: external docs/CVE/lib → `investigator-api` · write → implementer · test → test-specialist · architecture decision → em main
 ---
-## 📋 Patterns proven (cross-session)
+## 📋 Patterns proven (apply confidently)
-### Pattern: Smoke verify catalog SOLUTION_ERP
+### Schema scan via sqlcmd
 - Bearer auth từ `https://api.solutions.com.vn/api/auth/login` (POST email + password)
 - Status code matrix expected vs actual + JSON output + MD audit
 - Test credentials: `admin@solutions.com.vn / Admin@123456` (full) OR `nv.test@solutions.com.vn / TestUser@123456` (Drafter UAT scope)
 ### Pattern: Schema scan via sqlcmd
 ```bash
-# LocalDB Dev (runtime — primary)
+sqlcmd -S "(localdb)\MSSQLLocalDB" -d SolutionErp_Dev -Q "..."     # runtime API (primary)
-sqlcmd -S "(localdb)\MSSQLLocalDB" -d SolutionErp_Dev -Q "..."
+sqlcmd -S "(localdb)\MSSQLLocalDB" -d SolutionErp_Design -Q "..."  # ef tooling
-
+ssh vietreport-vps "sqlcmd -S .\SQLEXPRESS -d SolutionErp -U vrapp -P '...' -Q '...'"  # prod
 # LocalDB Design (ef tooling)
 sqlcmd -S "(localdb)\MSSQLLocalDB" -d SolutionErp_Design -Q "..."
 # Production (qua SSH vietreport-vps)
 ssh vietreport-vps "sqlcmd -S .\SQLEXPRESS -d SolutionErp -U vrapp -P '...' -Q '...'"
 ```
-Common queries: `sys.columns`, `sys.triggers`, `__EFMigrationsHistory`, `COUNT(*)`, `sys.indexes`.
+Queries: `sys.columns`, `sys.triggers`, `__EFMigrationsHistory`, `COUNT(*)`, `sys.indexes`.
 **Gotcha 2 LocalDB distinct** (`feedback_designtime_runtime_db`): `_Dev`=runtime (appsettings.Development), `_Design`=`dotnet ef` default. Prod password fallback `C:\inetpub\solution-erp\api\appsettings.Production.json` khi `$env:PROD_DB_PASSWORD` empty.
-**Gotcha:** 2 LocalDB distinct (memory `feedback_designtime_runtime_db`):
+### Controller / wire-claim audit
- `_Dev` — runtime API (appsettings.Development.json ConnectionStrings:Default)
+- Grep `\[Route\("api/[a-z]+"\)\]` enumerate controllers · `\[Authorize(Policy = "..."` per-action policy (gotcha #44 silent 403 class-level quá strict)
- `_Design` — `dotnet ef migrations add/update` default target
+- Grep `// Mock` / `alert(` / `setEditing(null) // close UI` — wire claim bugs · `IActionResult` vs `ActionResult<T>`
 - Use `--connection "Server=(localdb)\MSSQLLocalDB;Database=SolutionErp_Dev;..."` override khi cần Dev specifically.
-### Pattern: Controller audit
+### Smoke verify catalog
- Grep `\[Route\("api/[a-z]+"\)\]` enumerate ~30+ controllers
+Bearer từ `POST api.solutions.com.vn/api/auth/login` → status matrix expected vs actual + file:line evidence.
 - Grep `\[Authorize(Policy = "..."` audit per-action policy (gotcha #44 silent 403 class-level quá strict)
 - Grep `IActionResult` vs `ActionResult<T>` — typed return preferred
 - Grep `// Mock` / `alert(` / `setEditing(null) // close UI` — wire claim bugs
-### Pattern: Memory cross-reference
+### Memory cross-reference
-19 memory entries tại `C:\Users\pqhuy\.claude\projects\D--Dropbox-CONG-VIEC-SOLUTION\memory\` (S20 +2 turn 11/12, S21 +2 turn 5):
+27 user-memory tại `C:\Users\pqhuy\.claude\projects\D--...\memory\MEMORY.md` (index). Key: per_chunk_commit · uat_skip_verify · audit_reuse_before_clone · designtime_runtime_db · per_nv_permission_scope · ef_migration_backfill_reorder · status_handoff_tiering (S40) · 7agent_split_upgrade (S39).
 - `MEMORY.md` — index
 - `project_solution_erp.md` — cumulative narrative S1-S17
 - `feedback_per_chunk_commit.md` — 5-chunk A-E discipline
 - `feedback_uat_skip_verify.md` — Phase 9 skip test rule
 - `feedback_drastic_refactor_scope.md` — defer dedicated session
 - `feedback_audit_reuse_before_clone.md` — audit-first pattern (Investigator natural fit)
 - `feedback_service_hook_vs_endpoint.md` — derived state hook pattern
 - `feedback_n_stage_workflow_pattern.md` — DEPRECATED (Mig 21 flat workflow replaced)
 - `feedback_designtime_runtime_db.md` — 2 LocalDB distinct
 - `feedback_md_compact_narrative.md` — §6.5 KEEP narrative rule
 - `feedback_unittest_timing.md` — §7 test timing
 - `feedback_cron_monthly_limitation.md` — Cron SDK 7-day expire
 - `feedback_user_manual_style.md` — non-tech docs style
 - `feedback_node_cicd.md` — Node 20.x pin
 - `feedback_responsive_laptop_breakpoint.md` — 4-tầng responsive pattern (S20 t11)
 - `feedback_multi_agent_setup.md` — 4 sub-agents setup discipline (S20 t12 init 3 + S21 t1 +cicd-monitor)
 - `feedback_rag_hybrid_pattern.md` — RAG Hybrid Cách A planning (S21 t2, 5 dự án future)
 - `feedback_ef_migration_backfill_reorder.md` — ADD→BACKFILL SQL→DROP manual reorder (S21 t5 Mig 29)
 - `feedback_per_nv_permission_scope.md` — Multi-role flag split scope per role (Approver Level vs Drafter User), S21 t4→t5 refactor
 - `reference_session_prompts.md` — canonical session start template
-### Pattern: External research priority sources
+### External research → DEFER `investigator-api` (split S39)
 - `anthropic.com/engineering/` (official patterns)
 - `cognition.ai/blog/` (Devin lessons)
 - `philschmid.de` + `eugeneyan.com` + `hamel.dev` (senior engineers)
 - `learn.microsoft.com/en-us/aspnet/core/` (.NET 10 official)
 - `tanstack.com/query/latest` (TanStack Query)
 ---
-## ⚠️ Anti-patterns observed
+## ⚠️ Anti-patterns
-
+❌ Skip MEMORY update · ❌ Vague "seems like/probably" · ❌ Missing file:line · ❌ >500 words · ❌ Scope drift to architecture recommendation (em main decides)
 - ❌ Skip MEMORY.md update before stop — lose knowledge tài sản
 - ❌ Vague conclusion "seems like" / "probably" — em main rejects
 - ❌ Missing file:line refs — non-verifiable evidence
 - ❌ Exceed 500 words — em main reads too slow
 - ❌ Scope drift to architectural recommendations — em main decides, not me
 ---
-## 🧠 SOLUTION_ERP context essentials (auto-load)
+## 🧠 SOLUTION_ERP context essentials (S40 verified — re-grounded)
- **DB Dev:** `SolutionErp_Dev` LocalDB (59 tables / 30 migrations / Mig 30 latest `AddAllowApproverEditBudgetToLevels`)
+- **DB:** Dev `SolutionErp_Dev` · Design `SolutionErp_Design` (distinct) · Prod `.\SQLEXPRESS`/`SolutionErp`/`vrapp` via SSH `vietreport-vps`
- **DB Design:** `SolutionErp_Design` (ef tooling distinct)
+- **Migration path:** `src/Backend/SolutionErp.Infrastructure/Persistence/Migrations/*.cs` (⚠️ NOT root `/Migrations/`). **40 mig**, last `20260528090839_AddAttendances`.
- **DB Prod:** `.\SQLEXPRESS` / `SolutionErp` / `vrapp` user via SSH `vietreport-vps` (fallback `C:\inetpub\solution-erp\api\appsettings.Production.json` khi `$env:PROD_DB_PASSWORD` empty — CICD Monitor discovery S21 t5)
+- **Counts S40:** 40 mig · **84 SQL tables** (77 DbSet + 7 Identity, count `.ToTable()` ModelSnapshot NOT DbSet) · ~211 endpoints · 65 FE pages (36 admin + 29 user `*Page.tsx`) · ~53 menu keys (BE `MenuKeys` const) · **130 test** (58 Domain + 72 Infra) · **55 gotchas** (format `### N.` highest #55) · 27 user-memory · 6 skills · 7 sub-agents
- **Tech stack:** .NET 10 Clean Arch (Api → Application ← Domain + Infra) + CQRS MediatR + EF Core 10 + 2 React 19 Vite 8 TS 6 (fe-admin :8082 + fe-user :8080) + SQL Server + Gitea Actions CI + IIS prod
+- **Tech:** .NET 10 Clean Arch (Api→Application←Domain + Infra) + CQRS MediatR + EF Core 10 + 2 React 19 Vite 8 TS 6 (fe-admin :8082 + fe-user :8080) + SQL Server + Gitea CI + IIS
- **Live deploys (Prod UAT):** https://api.solutions.com.vn · https://admin.solutions.com.vn · https://eoffice.solutions.com.vn
+- **Prod:** api/admin/eoffice.solutions.com.vn · Gitea `git.baocaogiaoduc.vn/vietreport-admin/solution-erp` (Actions API `/api/v1/repos/.../actions/tasks` NOT `/runs` 404, cache stale ~2min gotcha #46 — cross-check VPS mtime)
- **Gitea remote:** https://git.baocaogiaoduc.vn/vietreport-admin/solution-erp
+- **Auth:** `admin@solutions.com.vn/Admin@123456` (full) / `nv.test@solutions.com.vn/TestUser@123456` (Drafter). Response `accessToken`+`refreshToken`+`user`. Password ≥12 chars.
 - **Gitea Actions API:** path `/api/v1/repos/.../actions/tasks` (NOT `/actions/runs` — 404). Cache stale ~2 min (gotcha #46) — cross-check VPS file mtime
 - **SSH VPS:** `ssh vietreport-vps` (config `~/.ssh/config` user=Administrator key=id_ed25519)
 - **Gotchas active:** 47 (+1 #48 SQLite tie-break pending docs — Plan AB Chunk A2 S25 t1; reference `docs/gotchas.md`)
 - **Tests baseline:** 111 PASS (S22 baseline 104 + 7 PE WF cumulative; S25 Plan M tests SQLite tie-break re-stabilized Chunk A2) — Phase 9 UAT skip per chunk (memory `feedback_uat_skip_verify`)
 - **Endpoints:** ~146 (S22 +3 stable: PATCH /users/{id}/allow-skip-final + PATCH /pe/{id}/budget-adjust + GET /pe/{id}/attachments/{attId}/view)
 - **Memory user-level:** 23 entries (+2 S25: Plan AC2 FE merge synthetic recovery + Plan AF userMap fallback patterns)
 - **Users:** 30 demo + 33 active prod (13 cũ + 20 mới S22+2 role-based: act/bod/equ/fin/hra/pm/qs prefix `.nv/.pp/.tp` + bod.1/2). Password policy ≥12 chars (S22+2 discovery, `TestUser@2026`)
 - **API auth response:** `accessToken` + `refreshToken` + `user` (S22+2, NOT `token`)
 - **Master HEAD reference:** check via `git log -1 --format='%H'`
 - **6 skills:** `contract-workflow` · `permission-matrix` · `form-engine` · `ef-core-migration` · `dependency-audit-erp` · `iis-deploy-runbook`
 ---
-## 🔄 Active workflow schemas (V1 + V2 coexist post-Session 17)
+## 🔄 Active workflow schemas (V1 + V2 coexist post-S17)
- **V1 Mig 21 flat workflow** — `WorkflowDefinition` pin với PE/Contract cũ. Match Dept+PositionLevel.
+- **V1 Mig 21 flat** — `WorkflowDefinition` pin PE/Contract cũ. Match Dept+PositionLevel.
- **V2 Mig 22-30** — `ApprovalWorkflow` pin với PE mới + match `ApproverUserId` 1-1 OR-of-N cùng Cấp. Steps (Phòng) > Levels (Cấp). PE đã wire V2. Contract V2 PENDING (Plan F drop V1 ABORTED S22+4 — Contract entity HOÀN TOÀN V1 chưa wire V2 + 4 PE V1-only + 19 PE V1+V2 mix).
+- **V2 Mig 22-31** — `ApprovalWorkflow` pin PE/Contract mới, match `ApproverUserId` 1-1 OR-of-N cùng Cấp. Steps (Phòng) > Levels (Cấp). PE + Contract đã wire V2 (Mig 32+33 S29). Proposal V2 (Mig 38 S37 inline ApproveV2Async). WorkflowApps skeleton (Mig 39 S38 — ApproveV2 advance DEFER Phase 11).
-  - **Mig 25** IsUserSelectable (admin pin/unpin per workflow cho user pick)
+  - Mig 25 IsUserSelectable · Mig 26 PE LevelOpinions UPSERT · Mig 29 Allow* per-NV (F1/F3 per Approver slot + F2 `Users.AllowDrafterSkipToFinal`) · Mig 30 F4 AllowApproverEditBudget · Mig 31 SkipToFinal→ApproverLevel
-  - **Mig 26** PE Level Opinions UPSERT (service hook khi Duyệt)
+- **State machine PE 5 trạng thái:** Nháp / Đã gửi duyệt / **Trả lại (TraLai=98)** / Từ chối / Đã duyệt
-  - **Mig 28** (S21 t4) 6 Allow* workflow-level — **REPLACED by Mig 29**
+- **Mode Trả lại 4 option per-Level:** OneLevel (lùi 1 Cấp) / OneStep (lùi Bước trước) / Assignee (pick NV đã ký) / Drafter (Phase=TraLai). 3 mode đầu giữ ChoDuyet lùi pointer. Admin bypass `level.Allow*`.
  - **Mig 29** (S21 t5) Allow* refactor per-NV: 5 flag on `ApprovalWorkflowLevels` (F1+F3 per Approver slot) + 1 flag on `Users.AllowDrafterSkipToFinal` (F2 per Drafter)
  - **Mig 30** (S22+5) F4 `AllowApproverEditBudget` per-Level slot on `ApprovalWorkflowLevels` — admin Designer tick per slot cho Approver được edit Budget khi review. Pattern reinforced 2× với Mig 29 F1+F3: default = admin opt-in per slot, KHÔNG = mở rộng default. Cross-ref memory `feedback_per_nv_permission_scope.md` proven cumulative Mig 29 + Mig 30.
 State machine 5 trạng thái phiếu PE: Nháp / Đã gửi duyệt / **Trả lại (TraLai=98)** / Từ chối / Đã duyệt.
 **Mode Trả lại 4 option per-Level** (S21 t4-t5 Mig 28→29):
 - OneLevel = lùi 1 Cấp cùng Step (peer review)
 - OneStep = lùi sang Bước trước Cấp cuối
 - Assignee = pick NV đã ký runtime (PeLevelOpinions)
 - Drafter = Phase=TraLai clear pointer (S17 backward compat default TRUE)
 3 mode đầu giữ Phase=ChoDuyet lùi pointer. Mode Drafter giữ Phase=TraLai. Admin bypass `level.Allow*` flag.
 ---
-## 📅 Recent activity (last 10 FIFO)
+## 📅 Recent activity (FIFO — older → archive/git)
- **2026-05-29 (S40 STATE GROUNDING AUDIT — docs vs codebase drift):** Em spawn ~9K. **7 metric verify, 4 DRIFT / 3 khớp.** ✅ **Migrations=40** (path THẬT `src/Backend/SolutionErp.Infrastructure/Persistence/Migrations/*.cs` — STATUS glob `Migrations/*.cs` trả 0 SAI, skill `ef-core-migration` ghi đúng path nhưng stale "31 mig"). Mig cao nhất = `20260528090839_AddAttendances` (G-P1). ✅ **Gotchas=55** (format `### N.` NOT `#NN`, highest `### 55.`). ✅ **git clean** main. ❌ **DbSet=77** (docs 84, -7) — `grep "public DbSet<"` ApplicationDbContext.cs. ⚠️ **Endpoints=211** (docs ~223): 65 GET+69 POST+39 PUT+33 DELETE+5 PATCH. ❌ **FE pages fe-admin=36** (docs 53, -17 nặng; fe-user=29; 36+29=65≠53 nên không phải gộp). ❌ **Menu keys=53** (docs 85, -32 nặng — `MenuKeys.cs` const string=53 single-source; 85 nghi là seed row runtime sau inheritance expand NOT const định nghĩa). **Drift nặng nhất = Menu keys + FE pages** (over-count, docs trộn seed runtime vs const, hoặc S38 skeleton không sync ngược). **Surprises**: (a) Mig 37/38 THỰC = 37 `ExtendApplicableTypeForWorkflowApps` + 38 `AddProposals` TÁCH RIÊNG — KHÁC S37 memory tôi ghi "gộp 37+38 = Proposal" (recommend gộp KHÔNG được adopt). (b) DbSet 77<84 nghi vài entity Phase 10 (WorkflowApps/Attendances/Proposals/MeetingRooms G-* skeleton) chưa add DbSet hoặc gom chung — đáng audit sâu nếu skeleton wire thiếu. (c) Mig 40 thực = AddAttendances NOT documented "Mig 34-40 G-* port" range vẫn đúng. **Recommend**: sync STATUS.md 4 con số (Tables 77 / Endpoints 211 / FE pages 36 / Menu keys 53). Migration + gotcha + git là 3 con số TIN CẬY nhất. Token ~9K. Tag `[state-grounding, docs-drift, s40]`.
+- **2026-05-29 (S40 STATE GROUNDING):** 7 metric verify. ✅ Migrations=**40** (path `.../Persistence/Migrations/*.cs`, last `AddAttendances`). ✅ Gotchas=**55** (`### N.`). ✅ git clean. DbSet=77 nhưng **SQL tables=84** (em main verify `.ToTable()` ModelSnapshot — 77+7 Identity, "84 docs ĐÚNG", DbSet count sai −7). Endpoints=**211** (docs ~223). FE pages fe-admin **36**+fe-user 29=**65** (docs 53 under-count). Menu keys=**53** const (docs 85 over-count). 3 số tin cậy nhất = mig/gotcha/git. Lesson: tables phải count ToTable KHÔNG DbSet. Tag `[state-grounding, docs-drift, s40]`.
-
+- **2026-05-29 (S39 BVAAU 7-agent extract):** Đọc 8 file BVAAU `.claude/agents/` ~22K. Split 4→7 trục research(2)/implement(2)/quality(3). Boundary: repo interface=domain, EF config=infra, test=test-specialist. Tool: cả 7 agent 5 RAG MCP (+search_code BM25 +store_memory +list_projects). BVAAU Phase 0 codebase RỖNG → aspirational template chưa battle-test; SOLUTION_ERP giữ 6 skill + backend/frontend split (thay domain/infra cho 2-FE fit). VIPIX guide claim KHÔNG verify được (file miss). Tag `[cross-project, bvaau, port]`.
- **2026-05-29 (cross-project — BVAAU 7-agent config extract):** Em đọc full 8 file `D:\Dropbox\CONG_VIEC\BENHVIEN_A_AU\SOURCE_CODDE\.claude\agents\` ~22K. **BVAAU split 4→7 trục research(2)/implement(2)/quality(3)**: investigator-api(blue READ external GetFly/Pancake docs) · investigator-codebase(cyan READ internal+sqlcmd) · implementer-domain(yellow WRITE `Domain/**`+`Application/**` only) · implementer-infra(orange WRITE `Infra/**`+`Api/**`+`Web/**`+`Web.Reports React`) · test-specialist(purple WRITE `tests/**` only NEW) · reviewer(red) · cicd-monitor(green). **Boundary key**: repo *interface*=domain, EF *config*=infra, test assertion=test-specialist (2 implementer KHÔNG viết test). **8-criteria REFUSE** cả 2 implementer (schema/UX/cross-stack>2layer/bug-reasoning/<30min/first-time/spec ambiguity>20%). **Token**: ~1.35M/heavy (~6.5× solo) optimized ~700K; Agent fresh ~150K cache-write / warm ~50K / SendMessage 5-30K/turn / parallel SendMessage ⚠️2.25-3×. **Tool diff CRITICAL**: cả 7 BVAAU agent có 5 RAG MCP (`search_memory+search_code+cross_project_search+store_memory+list_projects`) vs SOLUTION_ERP hiện chỉ 2 (`search_memory+cross_project_search`) → BVAAU +3 (`search_code` BM25 saves Read full file + `store_memory` instant index + `list_projects`). **Skill**: BVAAU `skills:` frontmatter KHÔNG có, total skill=0 (Phase 0 all TBD) — SOLUTION_ERP 6 skill+preload MẠNH HƠN, giữ nguyên khi port. **Curate rule**: >25KB archive `<YYYY-MM>.md`, >50KB hard limit. **Parallel patterns**: A=investigator-api→DTO→(infra+domain parallel)→test→reviewer→cicd; B=4 sync job song song file-disjoint. **Surprises**: (a) VIPIX guide `D:\...\VIPIX_MULTISITE_PROJECT\docs\guides\multi-agent-setup-guide.md` KHÔNG tồn tại (glob toàn project miss) → "16 spawn ~1.49M" claim không verify được, đừng cite. (b) 3 inconsistency BVAAU file: cicd ghi cả `.gitea/` (L25) lẫn `.github/` (L159) workflow path; investigator-codebase MEMORY path `/investigator/` mismatch tên agent; README "Setup checklist" L331 vẫn "4 sub-agent" chưa update 7. (c) BVAAU Phase 0 codebase RỖNG → config aspirational template chưa battle-test (vs SOLUTION_ERP 38 session proven). **Recommend port**: trục split + 8-criteria REFUSE + 5-category reviewer adversarial, GIỮ skill-frontmatter SOLUTION_ERP, ADD 3 RAG tool nếu MCP support. Token cost ~22K. Tag `[cross-project, bvaau-agent-config, port-pattern]`.
+- **2026-05-28 (S37 G-O3 Proposal pre-flight):** PE pattern mirror cho Mig 38. LevelOpinion UNIQUE per-LEVEL `(EntityId, LevelId)` FK Cascade+Restrict. CodeSequence 1 row/Prefix (`DX/YYYY` 3 col Prefix PK+LastSeq, tx SERIALIZABLE). ApproveV2Async 7 step (group Levels by Order=Cấp OR-of-N → match actor.Id∈ApproverUserId + Admin bypass → UPSERT LevelOpinion sync → F2 skipToFinal → advance levelOrder++ → DaDuyet). NamGroup TblRequest generic → **SOL clean-room MẠNH HƠN**. CategoryId nullable FK + free text fallback (lesson Plan C 8 FK ZERO populated). Tag `[pre-flight, g-o3, proposal]`.
-
+- **Archived S29-S36 → `archive/2026-05-q4.md` + git d2f52ba (S40 curate):** S36 G-O2 Phòng họp clean-room + FullCalendar v6 MIT eval · S36 startup MEMORY-size audit · S35 G-H2 HRM clean-room verdict · S33 G-H1 NamGroup TblNhanVien 10-bảng (105 cols main) · S33 startup RAG verify · S32 Plan G 11-module backlog · S29 Plan CA+B pre-flight (3 patterns: 9-menu terrain, V1+V2 coexist, reference-template-paths cite line-range ROI). KEY absorbed: **clean-room > NamGroup port verified 4×** · Pattern 12-bis cross-module mirror · FK+freetext dual-write.
 - **2026-05-28 (S37 Plan G-O3 Đề xuất pre-flight 4 task):** Em spawn ~14K. **T1 Enum:** `ApprovalWorkflowApplicableType` ở `ApprovalWorkflow.cs:45-50` Mig 22 add — 3 value 1-based (DuyetNcc=1, DuyetNccPhuongAn=2, Contract=3) NOT 0-based. Mig 37 +1 value Proposal=4 (G-O3 first), reserve 5-8 cho G-O4..O6 future. **T2 PE pattern intel** (mirror skeleton Mig 38): main entity 25 field critical (Id/MaPhieu/Type/Phase 5-state/TenGoiThau/ProjectId/DepartmentId/DrafterUserId + ApprovalWorkflowId pin V2/CurrentStepIndex/CurrentLevelOrder + BudgetId/BudgetManual + RejectedFromPhase legacy + 8 nav list). LevelOpinion UNIQUE per-LEVEL NOT per-User (composite `(PEId, LevelId)`), FK Cascade Pe + Restrict Level, denorm SignedByFullName(200). CodeSequence **1 row per Prefix** (NOT N rows per year): `PE/YYYY/A` + `PE/YYYY/B` riêng, 3 col Prefix PK+LastSeq+UpdatedAt, tx SERIALIZABLE. ApproveV2Async logic 7 step (load eager → group Levels by Order = Cấp OR-of-N → match actor.Id ∈ ApproverUserId + Admin bypass → log Approval + UPSERT LevelOpinion auto sync → F2 skipToFinal check matchingLevel.AllowApproverSkipToFinal advance tới last Step+last Level Phase giữ ChoDuyet → advance normal levelOrder++ trong Step → next Step reset 1 → DaDuyet terminal). **T3 NamGroup Proposal**: 3 entity `TblRequest.cs` (25 cols generic + SoTien decimal + NguoiNhanTien + TaiKhoanNganHang advance payment) + `TblRequestConfig.cs` (CSV ListApproval inline + IsDirectManager) + `TblRequestListApproval.cs` (forward mechanism qua NguoiChuyenTiepId/NgayChuyenTiep + ChapThuanHoanToan int). **Verdict: SOL CLEAN-ROOM MẠNH HƠN** — NamGroup generic Request KHÔNG phân biệt Đề xuất/Yêu cầu/Phép (1 entity cover ALL). SOL dedicated `Proposal` entity + Workflow V2 pin FK > NamGroup inline CSV JSON. **T4 Mig 38 propose 4 bảng**: Proposals (Code `DX/YYYY/NNNN`, Title/Desc/Category nullable FK + free text fallback, AmountEstimate decimal? optional, Status ProposalStatus 5-state mirror PE, DepartmentId/DrafterUserId, ApprovalWorkflowId pin ApplicableType=4 + CurrentStep/Level pointer + SLA) + ProposalAttachments + ProposalLevelOpinions UNIQUE (PropId, LevelId) + ProposalCodeSequences 1 row Prefix `DX/YYYY`. **3 decision points em main chốt**: (1) CategoryId nullable FK + free text fallback (lesson Plan C drift 8 FK ZERO populated 1675 NV). (2) 5-state mirror PE NOT 7-state Contract (Đề xuất đơn giản hơn HĐ). (3) Dedicated `ProposalStatus` enum NOT reuse PurchaseEvaluationPhase (anti-pattern cross-module coupling). **Surprises**: (a) NamGroup TblRequest có `SoTien + NguoiNhanTien + TaiKhoanNganHang` advance payment — SOL có cần? Defer Mig 39 optional. (b) F1+F3+F4+F2 per-Level pattern Mig 29-31 — Proposal có nên mirror? Option B "đơn giản KHÔNG flag" tiết kiệm 3 chunk admin Designer. (c) **Recommend gộp Mig 37+38 → 1 Mig** `AddProposalsAndExtendApplicableType` (mirror Mig 20 Contract N-stage gộp). Token cost ~14K.
 - **2026-05-28 (S36 Plan G-O2 pre-flight Phòng họp 3 task):** Em spawn ~10K. **T1 NamGroup `TblResource` + `TblBookingResource`** (`NAMGROUP.Server\Data\Entities\TblPhongHop.cs` 5-47): 2 entity LEGACY V1 reuse, KHÔNG dedicated MeetingRoom. TblResource 11 cols generic (Id long, GroupReSourceID, NameReSource, ListManager CSV NhanVienID, ListViewer CSV, Note, IsDelete int?). TblBookingResource 18 cols (ResourceID, Title, FromDate datetime giờ-phút, ToDate, ThanhPhan plain text NOT CSV, TrangThai int? -1=Rej/0=Pending/1=Approved/2=Cancelled, IsDelete int? NULL=active+1=deleted ZERO `=0` rows, Note1 admin secondary, AcceptUser/AcceptDate/RejectUser/RejectDate). **5 gotcha NamGroup**: (1) IsDelete filter `(IsDelete ?? 0) != 1` NOT `== 0`, (2) TrangThai 4-state NO Completed, (3) ThanhPhan plain text NOT CSV NV ID, (4) Note1 admin only, (5) V1 ZERO overlap protection (37 overlap pairs prod 798 rows). Repo `PhongHopRepository.cs:61-75` overlap app-level: `b.FromDate < toDate AND b.ToDate > fromDate AND TrangThai NOT IN (-1, 2)`. CSV ListManager → manager approve. **Conclusion: SOL Mig 36 CLEAN-ROOM** mirror G-H2 verdict — KHÔNG port reason: (a) TblResource mix 4 group catalog generic, (b) ThanhPhan plain text yếu cho notification, (c) ZERO overlap V1 → SOL phải DB-level SERIALIZABLE tx. **T2 FullCalendar v6 React** (https://fullcalendar.io/docs/react): `@fullcalendar/react` MIT cho core + 3 plugin daygrid/timegrid/interaction. Premium chỉ Resource Timeline + Vertical Resource (NOT cần Plan G-O2). Drag-resize event = MIT `@fullcalendar/interaction`. Bundle ~150-200KB gz (bundlephobia 403). **Alternative**: NamGroup `PhongHopPage.tsx:10-12` S50 hotfix CHỐT custom day-grid HTML NO lib install reason "saves install friction + bundle minimal" — 1 file ~600 LOC month-view custom grid 5-6 rows × 7 cols Sun-Sat. `react-big-calendar` MIT clean alternative nhưng semi-deprecated. **T3 Schema Mig 36 propose 3 entity** (KHÔNG 2): `MeetingRoom` (Id Guid, Code unique nvarchar(20), Name nvarchar(200), Capacity int, Location nvarchar(200), Equipment nvarchar(500)?, IsActive bit, IsDeleted, audit) + `MeetingBooking` (Id, RoomId FK Restrict, BookedByUserId FK Restrict, StartAt datetime2, EndAt datetime2, Title nvarchar(200), Description nvarchar(1000)?, Status enum int Confirmed=1/Cancelled=2/Completed=3, Note nvarchar(500)?, audit) + **`MeetingBookingAttendees` join** (BookingId FK Cascade, UserId FK Restrict, PK composite (BookingId, UserId), Notes nvarchar(200)?). **Attendees mode JOIN TABLE** (NOT JSON) reason: (a) notification push query indexed efficient, (b) FE picker multi-select shadcn reuse Users API, (c) audit "ai từ chối" future ready. **Overlap check** SERIALIZABLE tx + `EXISTS WHERE RoomId=@r AND Status=1 AND StartAt < @newEnd AND EndAt > @newStart AND Id != @currentId` → 409 Conflict. **Recommend index** `IX_MeetingBookings_RoomId_StartAt` composite range query. **Surprises**: (a) NamGroup s47 Plan 9.2 V1 reuse dựa 798 row prod data NOT scratch — SOL có lợi thế clean-room không legacy. (b) NamGroup community ưu tiên bundle size hơn dev velocity (custom HTML grid thay FullCalendar) — em main weigh trade-off ~150KB cost vs drag-drop UX. (c) `TblBookingResource` NO Title index — SOL must add IX. **Recommend forward**: (1) Mig 36 design 3 entity clean-room per propose; (2) FullCalendar v6 MIT fe-admin (manager view drag-drop) + custom day-grid HTML fe-user (book simple) — split UX 2 app per convention; (3) Skill `ef-core-migration` attach Implementer. Token cost ~10K.
 - **2026-05-28 (S36 startup audit — 3 task readonly factual report):** Em spawn 1 lần ~12K token. **Task 1 — MEMORY size 4 sub-agent:** path actual project-level `D:\Dropbox\CONG_VIEC\SOLUTION\SOLUTION_ERP\.claude\agent-memory\{agent}\MEMORY.md` (em main provide path user-level `C:\Users\pqhuy\.claude\projects\...\agents\` KHÔNG tồn tại — em correct path). Investigator 24.7KB/157 lines borderline · Implementer **36.4KB/419 lines PRIORITY curate** · Reviewer 28.4KB/181 lines borderline · CICD **40.4KB/213 lines PRIORITY curate**. Drift +12-15KB ALL 4 agent từ S33 startup baseline (cicd 25.5→40.4, implementer 28.6→36.4, reviewer 25.9→28.4, investigator 20.2→24.7) — heavy S33+S34+S35 entries chưa archive. **Task 2 — Audit định kỳ status:** `docs/changelog/skill-audit-2026-05.md` 6.2KB manual 2026-05-04 + `skill-audit-2026-05-late.md` 9.1KB early-trigger 2026-05-22 (drift +8 gotcha 41→49). Next scheduled 2026-06-01 (CLAUDE.md:60 confirm). Today 2026-05-28 còn **4 ngày → SKIP audit lần này**. Cron `solution-erp-skill-audit-monthly` fire 9:00 AM ngày 1. **Task 3 — Plan G-* progress map 10 atomic (NOT 11 — Cấu hình + Hồ sơ NS gộp Phase 10.1):** ✅ G-H1 S33 (commit 5400983..79a8343 Run #237 PASS, 67 tables Mig 34) + ✅ G-H2 S34+S35 (commit 07b3f3b schema + 909655c BE + 021674a FE Run #244 PASS Mig 35). ⏳ 8 pending: G-O1 Danh bạ (1 endpoint nhẹ nhất) · G-O2 Phòng họp Mig 36 FullCalendar · G-O3-O6 Workflow Apps cần extend `ApplicableType` enum +5 (Mig 37 first cookie-cutter Mig 22) · G-H3 Dashboard NS · G-P1 Chấm công GPS web Mig 42. **NO DRIFT** giữa `feedback_phase10_namgroup_port.md` (4 quyết định) vs `migration-todos.md:637-792` (Phase 10 backlog). **Recommendation forward S36:** (a) Curate session PRIORITY cicd-monitor (40.4KB) + implementer (36.4KB) trước kick off Plan G-O1; (b) Reviewer 28.4KB defer S37 nếu không kịp; (c) Plan G-O1 phù hợp S36 sau curate (1 endpoint + 1 FE page). **Surprise:** Em main note "G-O1 Danh bạ S34 done" trong instruction — DRIFT thực tế. Migration-todos:696-700 G-O1 vẫn ⏳ pending. Anh main confuse với G-H1 S33 + G-H2 S34/35. Token cost ~12K.
 - **2026-05-28 (S35 — Plan G-H2 Task 3+4 pre-flight HRM CRUD audit):** Em spawn 1 lần ~8K token. **Task 1 — Plan CA Chunk B precedent:** SHA `06a441c` "FE move 4 master pages 948 LOC byte-identical". 4 catalog page mirror `fe-admin/master/{Suppliers,Projects,Departments,Catalogs}Page.tsx` → `fe-user/`. LOC actual: Catalogs=321 / Departments=160 / Projects=214 / Suppliers=253 = **948 LOC tổng**. Pattern = single file inline list + create/edit dialog (NO split route /new). DataTable + PageHeader + PermissionGuard + 6 shadcn UI. **Task 2 — NamGroup HRM ref MISS:** Glob `*Phep* *TimeOff* *NgayLe* *Ca* *Ot*` → KHÔNG có entity dedicated. NamGroup chỉ có `TblTimeOffConfig.cs` 14 cols generic + `TblTimeOff.cs` 47 cols (request, Ngay1-10 + TypeNgay1-10 hardcoded over-engineered) + `TblDmChung.cs` 10 cols generic bucket. **SOL Mig 35 entity design MẠNH HƠN:** LeaveType có IsPaid + RequiresAttachment + DaysPerYear decimal(5,2) (NamGroup miss). Holiday composite UNIQUE Year+Date + IsRecurring (NamGroup không có). ShiftPattern WorkDays comma string + TimeOnly Start/End + BreakMinutes (NamGroup không có). OtPolicy 3-tier multiplier weekday/weekend/holiday + 3 cap day/month/year Luật LĐ VN (NamGroup không có). **Kết luận: KHÔNG cần port field từ NamGroup. SOL clean-room design mạnh hơn.** Workflow integration: NamGroup TimeOffConfig embed `ListApproval` JSON inline; SOL sẽ dùng ApprovalWorkflow V2 pattern khi G-O4 LeaveRequest land. **Task 3 — SOL Master pattern:** ProjectFeatures.cs 150 LOC + DepartmentFeatures.cs 128 LOC + CatalogsFeatures.cs **334 LOC** (4 sub-entity Units/Materials/Services/WorkItems gộp 1 file mega). Controller layout: `CatalogsController.cs` 1 controller cho 4 sub-entity. **Pattern Suppliers split** (Suppliers/Dtos/Queries/Commands subdir) = legacy heavyweight scale, KHÔNG nên mirror cho HRM. **Pattern Catalogs single-file mega** = đúng cho HRM (4 simple catalog tương đương Units/Materials/Services/WorkItems). LOC estimate G-H2 Task 4 FE: LeaveTypesPage 200 + HolidaysPage 250 (Year filter + bulk roll-over) + ShiftPatternsPage 250 (WorkDays multi-select + TimeOnly picker) + OtPoliciesPage 220 (1 STANDARD constraint UI) ≈ **920 LOC** ~ Plan CA Chunk B 948 LOC parity. **Recommendation: Option B 1 mega `HrmConfigFeatures.cs` ≈ 600-700 LOC** mirror Pattern 12-bis Catalogs. Reason: (1) 4 simple catalog cùng module HRM lifecycle parallel. (2) Pattern 12-bis cross-module entity cookie-cutter proven 2× (Plan CA Catalogs + Plan B Contract V2). (3) 1 controller `HrmConfigsController.cs` route `/api/hrm/configs/{kind}` mirror `/api/catalogs/{kind}`. (4) Constraints differ (Holiday composite + OtPolicy 1 STANDARD active) handle qua per-handler validation. **Surprise:** EF Configuration files riêng `LeaveTypeConfiguration.cs` + 3 file khác EXIST — KHÔNG cần mirror Application Features file split (Config riêng OK + Features mega OK). Cross-stack KHÔNG conflict. Token cost ~8K.
 - **2026-05-26 (S33 t1 — Plan G-H1 pre-flight NamGroup TblNhanVien* audit):** Em spawn task A+B+C audit `NAMGROUP.Server\Data\Entities\` ~10K token. **Inventory 10 TblNhanVien* bảng** (NOT 8 anh main estimate): 1 main `TblNhanVien` (105 cols!) + 9 satellite (QtCongTac/QtDaoTao/QuanHeThanNhan/KyNangViTinh/KyNangNgoaiNgu/KyNangKhac/QtHopDong/QtCongTacIn/QtPhulucHd). PK `long Id` (NOT Guid) — port phải convert. Soft delete `IsDelete int?` OR `bool?` (legacy inconsistent). Audit fields KHÔNG có ở satellite (chỉ `QtCongTacIn` có NhanVienTaoId/SuaId/NgayTao/NgaySua) — port phải fill từ BaseEntity. **Main `TblNhanVien` 105 cols PERSONAL HEAVY:** identity (CMND/HoChieu/MaSoThue/SoBhxh) + diachi (6 FK Tinh/Quan/Phuong x HKTT/TamTru + freetext fallback) + bank (SoTK/NganHang/ChiNhanh) + physical (ChieuCao/CanNang/NhomMau) + salary (LuongTN/LuongCB/PhepTrongNam/PhepTon/NghiBu/PhepThamNien) + BHXH (NgayThamGia/NoiDkkCb) + political (IsDangVien/IsHcmDoan/IsCongDoan + 3 Ngay*) + theme cols (BgmenuColor/MenuColor — SKIP UX-only) + 4 contact ng liên hệ + 14 FK catalog (DanToc/TonGiao/TinhTrangHonNhan/QuocTich/GioiTinh/TrinhDo/...). **Drift discovered s49 Plan C** 8 FK DiaChi cascade ADDED Sep 2025 but `ZERO populated 1675 NV` — entity drift expose. **Tip:** SOL Mig 34 nên design FK DiaChi NULLABLE + freetext fallback nvarchar(500) cùng tồn tại từ ngày đầu. **Satellite simple:** QtCongTac (12 cols work history external), QtDaoTao (16 cols + 4 FK catalog), QuanHeThanNhan (8 cols + FK), KyNangViTinh (3 cols MINIMAL — chỉ TenPhanMem string!), KyNangNgoaiNgu (4 cols + FK NgoaiNgu), KyNangKhac (4 cols freetext). **Satellite contract HEAVY:** QtHopDong (28 cols HĐLĐ — defer Plan H2), QtCongTacIn (16 cols internal position change — defer), QtPhulucHd (10 cols phụ lục HĐ — defer). **DbInitializer GLOB NO MATCH** — NamGroup KHÔNG seed demo data via DbInitializer pattern. **SOL User existing đã có:** FullName + DepartmentId + Position + PositionLevel + Email + IsActive. Skip 5 duplicate fields. **Patterns proven NEW:** (a) **Skip-list aggressive cookie-cutter audit** — Mig 34 chỉ port 5 satellite defer 4. (b) **FK + freetext fallback dual-write pattern** từ Plan C drift lesson. (c) **MaNhanVien `NV/YYYY/NNNN` mirror PE CodeGen** atomic Serializable. (d) **Polymorphic Skill table** — gộp 3 KyNang* thành 1 với Kind enum giảm 2 bảng. (e) **30 demo seed pattern reuse** mirror SOL DbInitializer existing 30 user 1-1 link User.Id. **Surprise:** Theme cols `BgmenuColor/MenuColor` ở entity hồ sơ NS! NamGroup mix UX preference với business data — SOL SKIP, dùng UserPreferences riêng. Token cost ~10K.
 - **2026-05-26 (S33 startup — em main spawn em đầu S33 audit 4 sub-agent MEMORY + RAG hit rate verify):** Em spawn 1 lần đầu S33 task A+B song song readonly. **Task A audit 4 MEMORY file sizes:** Investigator 20.2KB OK / CICD 25.5KB borderline > 25KB triggers curate flag / Reviewer 25.9KB borderline / Implementer 28.6KB OVER triggers curate priority. **Cross-agent learnings ≥ 2 agent:** (a) **Smart Friend pattern 4× cumulative** noted BOTH Reviewer (foundation 4 catches S22 #44 + S25 #48 + S29 Plan B ApplicableType + S29 DemoSeed gate) + CICD (Discovery #6 INFRASTRUCTURE vs DEMO seed catch Run #232 Hotfix `SeedSampleContractWorkflowV2` out of DemoSeed gate) — pattern strong candidate Layer B promote OR add to `docs/rules.md` §10 review process. (b) **Per-NV admin opt-in flag wire 10-surface-point** noted BOTH Implementer Pattern 7 (4 flag cumulative Mig 29-31 + Mig 30 F4) + CICD MEMORY 10-point checklist foundation (line 142-160) + Reviewer Per-NV scope split + RAG memory user-level cross-ref. (c) **Pattern 12-bis cross-module entity cookie-cutter mirror** PE→Contract noted BOTH Implementer (line 178-200) + Reviewer Cross-module security validation mirror (S29 Plan B). (d) **gotcha #48 SQLite tie-break** noted BOTH CICD (line 40-45 detail) + Reviewer (Cat 5 lesson catch from CICD pre-deploy). **Drift detected:** (1) CICD MEMORY line 124-125 cite "Mig 31 latest" but **actual repo Mig 33 prod (Plan B Contract V2 Mig 32+33)** per Investigator narrative S29 + RAG hit STATUS. CICD recent activity correctly mentions Mig 32+33 deployed Run #232 but baseline header line 124-125 stale. (2) Reviewer line 130 cite "Migrations: 31 latest" but actual 33 — same baseline header stale post-S29 Plan B. (3) Test baseline 111 unchanged ALL 4 agents consistent OK. (4) Endpoints ~146 (Reviewer line 132) vs ~148 (Investigator line 137) — minor 2 endpoint delta drift. **Curate recommend next session:** PRIORITY Implementer (28.6KB > 25KB hard, archive 2-3 verbose entries q2) + CICD (25.5KB borderline, drop 1 oldest entry 2026-05-12 setup since baseline preserved foundation section) + Reviewer (25.9KB borderline, drop 1 oldest S25 entry duplicated in S25 wrap below). Investigator self OK 20.2KB headroom. **Task B RAG verify 3/3 PASS** all rerank > 0.7: Q1 `Plan G NamGroup port phase 10` top hit HANDOFF.md rerank **0.848** PASS · Q2 `gotcha 52 qdrant client search removed` top hit investigator MEMORY S32 startup entry rerank **0.910** PASS (also gotcha doc 0.875 + memory user-level `feedback_rag_bootstrap` 0.863) · Q3 `per-NV admin opt-in F1 F2 F3 F4 wire 10 surface points` top hit HANDOFF.md S23 t4 rerank **0.684** BELOW 0.7 threshold WARN (semantic match correct, distance score boundary — RAG indexing for narrative cumulative entries reaches diminishing returns at 5+ session reinforcement). **Recommendation forward em main S33:** (a) Spawn Investigator pre-flight Plan G-H1 NamGroup TblNhanVien* 8 bảng audit per Phase 10.1 kick off plan; (b) Schedule dedicated curate session 3 sub-agents (Implementer priority) before next heavy plan kick off; (c) Update Reviewer + CICD baseline header Mig 31→33 + endpoint ~146→148 in next curate. Token cost spawn này ~10K (4 Read + 3 RAG query + 1 Bash + Edit MEMORY + final report).
 - **2026-05-26 (S32 wrap — em main proxy update final state):** Session 32 đóng clean. Em chủ trì spawn em 2 lần S32: (1) startup verify ~10K (afaf6d52a6a59a844 alive) + (2) NamGroup audit pre-flight ~30K (a533c3e8ed4e03bfe hit limit 157K/72 tool_uses fallback em main solo audit). **Em main solo audit NamGroup directly** thay vì re-spawn: discovered NAMGROUP.Server\Data\Entities có 8+ TblNhanVien* (QtCongTac/QtDaoTao/QuanHeThanNhan/KyNangViTinh) + 4 bảng org chart (SoDoToChuc/SoDoKhoi/ChucDanh/ViTri) + Announcement/InternalDocument/TblMenu. **Plan G 11 module port DOCUMENTED migration-todos** với 4 quyết định chốt anh main (FULL 11 module + dbo single + Workflow V2 enum +5 + chunk per-module Plan riêng). **S33 priority spawn em pre-flight Plan G-H1 Hồ sơ NS** audit NamGroup TblNhanVien* 8 bảng + map fields → SOL EmployeeProfile schema (Mig 34 design 1 main + 5 satellite WorkHistory/Education/FamilyRelation/Skill/Document) — scope narrower 30 phút mục tiêu. **Curate Plan A3:** MEMORY archived 4 verbose entries q2 (S25 t1 5Q audit Bug Changelog + S26 Plan AG 5Q + S26 Plan AI RAG research + Plan B Contract V2 Q1-Q5 audit detail) → 27.7→19KB. **Pending tasks anh main S33 SendMessage gọi em:** (a) Plan G-H1 pre-flight NamGroup TblNhanVien* audit (PRIORITY HIGH first thing S33); (b) Plan B-Wrap test bundle pre-flight verify ContractWorkflowService ApproveV2Async test scenarios spec D-Bis trong migration-todos; (c) Phase 9 UAT smoke verify V2 contract create flow post-S29 deploy `QT-HD-V2-001` workflow. Token cost wrap ~5K. Tag: `[wrap, phase-9-to-phase-10, infra]`.
 - **2026-05-22 (S29 wrap — Plan CA + Plan B pre-flight 2 spawns + 3 patterns NEW):** S29 close 2 big plans cumulative. **Plan CA (Move Cấu hình danh mục admin → eoffice)** 7 commits `06a441c..6eec8d7` push deployed Run #229+#230 PASS. **Plan B (Contract V2 wire mirror PE V2 pattern Mig 22-26)** 11 commits `58898e8..38f1c4d` push deployed Run #231+#232 PASS. **Investigator role 2 spawn:** (1) **Plan CA pre-flight audit** (agentId a7ab5576c77ee3730, ~15K token): map 9 menu danh mục terrain + GOTCHA tree-inherit Catalogs↔Master + recommend chunk structure A/B/C/D. fe-user component parity verified (DataTable + PageHeader + PermissionGuard + 6 shadcn ui). DbInitializer SeedAdminPermissionsAsync admin role grant CRUD 27 menu key. Permission Matrix dynamic load /api/menus → tự reflect post-move. (2) **Plan B pre-flight audit Contract V1 state** (agentId abf91b30391fb0cdb, ~25K token): map `Contract.cs` 25 fields (V1 only) + `ContractPhase` enum 12 values (TraLai=98 + TuChoi=99 ready) + `ContractWorkflowService.cs` 220 LOC V1 only + sqlcmd prod 7 V1 contract (Phase 2-8 active workflow) + PE Mig 22-26 reference templates + impact assessment (COEXIST V1+V2, KHÔNG drop V1) + re-chunk 6 chunks (split A → A1 entity + A2 mig). 3 surprise: ApprovalWorkflows Prod ZERO ApplicableType=3 (Chunk A2 must seed sample) + `RejectedAtStepIndex` drift deprecated + ContractType 7 variants generic ApplicableType=3. **Patterns proven NEW Investigator perspective S29:** (a) **9-menu permission terrain map pattern** (Plan CA) — Investigator inventory file paths + line ranges + component parity check + recommend chunk before delegate Implementer. ROI cao. (b) **V1+V2 coexist boundary** (Plan B) — KHÔNG drop V1 vì 7 prod contract pinned. Mirror PE Mig 22-24 spec. (c) **Reference template paths cross-module mirror** (PE → Contract V2): Investigator cite EXACT line ranges (PE Mig 23:14-31, Mig 24:14-17, Mig 26 UNIQUE composite, Service ApproveV2Async 446-634, 519-546 UPSERT, 774-783 ResolveActor) → em main + Implementer chỉ cần mirror rename entity. ROI rất cao saving 30%+ time. **Anti-patterns observed:** (a) Investigator KHÔNG verify endpoint exists end-to-end qua live curl — defer to CICD Monitor stage 4. (b) Investigator output sometimes verbose >700 words → em main hỏi cô đọng <500 next time.
 - **Archived 4 verbose entries S25-S26-S29 → `archive/2026-05-q2.md` 2026-05-26 S32 curate:** S25 t1 5Q audit Bug Changelog detail + S26 Plan AG 5Q PE List tree view + S26 Plan AI RAG 4 study cases (Cursor/Cline/Continue/Sourcegraph) + Plan B Contract V2 Q1-Q5 audit detail. KEY recommendations preserved in S29 wrap entry above (Plan B re-chunk 6 chunks pattern + ApplicableType=3 ZERO Prod seed flag + PE Mig 22-26 reference template paths).
 - **Archived to `archive/2026-05-q3.md` 2026-05-27 S34 curate (em main proxy):** S28 wrap Layer A governance internalized (3 rules + tag schema mandatory + 4-category default + NO self-authorize cross-project — absorbed forward into agent output discipline) + S27 wrap-up retrospective (pre-flight infrastructure audit must spawn Investigator lesson + S20-S26 spawn audit uncertainty flag) + 2026-05-22 curate session note + S25 wrap Bug 1+2 audit + 2026-05-11 setup baseline. KEY pattern absorbed forward: pre-flight infrastructure audit MUST spawn Investigator + scope-down SOLUTION_ERP self-discipline + tag schema `[type, phase, bc-or-module]` mandatory output.
 ---
 ## 🔄 Curate trigger
-
+- >25KB → archive recent → `archive/<period>.md`. Stale >3mo → remove.
- Memory size > 25KB → archive recent entries to `archive/<period>.md`
+- **Last curate: 2026-05-29 S40 em main proxy** (35.7→~20KB): archived 7 FIFO S29-S36 → q4 + git d2f52ba, refreshed stale essentials S25→S40 numbers, trimmed memory-list. Prev: S34 q3 · S32 q2 · S22 q1.
 - Duplicate entries detected → merge
 - Stale > 3 months → remove
 **Last curate: 2026-05-27 S34 em main proxy curate** (post-S33 wrap, sequence 1/4) — archived 4 verbose entries (S27 wrap retrospective + 2026-05-22 curate session + S25 wrap + S11 setup) → `archive/2026-05-q3.md`. KEEP: S33 t1 Plan G-H1 pre-flight NamGroup audit (latest 10 bảng inventory + 4 decision schema), S33 startup audit (4 MEMORY size + RAG hit verify), S32 wrap (Plan G 11 module backlog), S32 startup (S31 RAG awareness), S29 wrap (2 spawn Plan CA + Plan B pre-flight + 3 patterns NEW), S28 wrap (Layer A governance). Patterns + Active workflow schemas foundation preserved untouched. MEMORY size before: 26 KB → after: target ~20-22 KB. **Previous curate: 2026-05-26 S32** — 4 verbose entries → `archive/2026-05-q2.md`. **Previous curate: 2026-05-22** — 10 verbose S21→S24 → `archive/2026-05-q1.md`. Next trigger: > 25KB OR Plan G-O1 Danh bạ kick off.
--- a/.claude/agent-memory/reviewer/MEMORY.md
+++ b/.claude/agent-memory/reviewer/MEMORY.md
@ -1,181 +1,69 @@
 # Reviewer Agent — Persistent Memory
 > **Persistent diary cross-session.** Auto-injected first 200 lines / 25KB at spawn.
-> Update BEFORE every stop. Curate when > 25KB.
+> Update BEFORE every stop. Curate when > 25KB. Keep entry ≤ 1.5K chars (gotcha #53).
 > Full verbatim history pre-S40 → git `d2f52ba` + `archive/2026-05-q1..q2.md`.
 ---
 ## 🎯 Role baseline
-Adversarial pre-commit reviewer for SOLUTION_ERP. Read-only verification + live curl on prod UAT environment (`*.solutions.com.vn`). Tools: Read, Grep, Glob, Bash (curl + git diff + sqlcmd read). Output: PASS/FAIL verdict + concrete issues file:line.
+Adversarial pre-commit reviewer SOLUTION_ERP. Read-only verify + live curl prod UAT (`*.solutions.com.vn`). Tools: Read, Grep, Glob, Bash (curl + git diff + sqlcmd read) + 5 RAG MCP. Skills: `dependency-audit-erp` + `contract-workflow` + `permission-matrix`. Output: PASS/FAIL + concrete issues file:line. NEVER write code.
 ---
-## 🚨 Recurring SOLUTION_ERP bug patterns (catch with priority)
+## 🚨 Recurring bug patterns (catch priority)
-### Gotcha #44 — Silent 403 class-level Authorize quá strict (S18 lesson)
+- **#44 Silent 403 class-level Authorize quá strict** — Drafter dropdown empty silent (TanStack catch silent → UI empty). Grep `\[Authorize\(Policy=.*\)\]` class-level + curl non-admin expect 200. Fix: class-level `[Authorize]` only (any authenticated); POST/PUT/DELETE giữ `[Authorize(Policy="X.Create")]`.
-
+- **#43 Step.Order ≠ index 0-based** — `Where(s=>s.Order==i)` wrong row. Fix: EF query → in-memory `OrderBy(Order).ToList()` → index.
- Symptom: Drafter dropdown V2 workflow empty silent (no error toast)
+- **#42 Dual schema V1/V2 — Service phải branch** — `if (entity.ApprovalWorkflowId is Guid awId) ApproveV2Async else V1Legacy`.
- Root: `[Authorize(Policy = "Workflows.Read")]` class-level → non-admin 403, TanStack Query catch silent → UI empty
+- **Wire BE claim** — grep diff `// Mock`/`alert(`/no POST-PUT-DELETE call + live curl expect 2XX. Severity CRITICAL block.
- Verify: grep `\[Authorize\(Policy = .*\)\]` class-level vs action-level + curl với non-admin token expect 200
+- **Cross-module security mirror (S29 Smart Friend)** — khi mirror entity/Command cross-module (PE→Contract→Budget V2), em main solo focus data shape MISS security guard. Pattern: `aw.ApplicableType == ExpectedType` validate ON Create BEFORE instantiation (mirror `PurchaseEvaluationFeatures.cs:62-77`). Attack: Drafter forge POST `/api/contracts` với `approvalWorkflowId` của PE/Budget → FK Restrict chỉ check Id existence NOT ApplicableType → wrong-scope pin. Also re-verify `IsActive`+`IsUserSelectable` server-side. Password ≥12 chars (Identity reject 11-char legacy). Severity MAJOR block push.
- Fix pattern: class-level `[Authorize]` only (any authenticated). POST/PUT/DELETE giữ `[Authorize(Policy = "X.Create")]` admin-only
+- **#17 EF migration 3-file** — `git diff --name-only | grep Migrations/` expect 3 (target + Designer + Snapshot).
-
+- **#47 `.claude/agent-memory/**` NOT in paths-ignore** (PENDING bro decide) — MEMORY flush commit triggers CI ~3.5min waste. paths-ignore hiện `['docs/**','**/*.md','.claude/skills/**']` missing agent-memory. Severity minor (CI waste). ⚠️ S40 note: agent-memory commits đang trigger — recommend bro add.
 ### Gotcha #43 — Step.Order ≠ index 0-based
 - Symptom: EF query `Where(s => s.Order == i)` returns wrong row
 - Verify: grep `step.Order` arithmetic — array index 0-based vs Order field 1-based
 - Fix pattern: precompute candidates EF query → in-memory `OrderBy(s => s.Order).ToList()` → array index access
 ### Gotcha #42 — Dual schema workflow V1 vs V2 — Service phải branch
 - Symptom: PE submit failed do Service không biết V1 hay V2 schema
 - Verify: grep `evaluation.ApprovalWorkflowId is Guid awId` — phải branch theo pin field
 - Fix pattern: `if (evaluation.ApprovalWorkflowId is Guid awId) ApproveV2Async(...) else ApproveV1LegacyAsync(...)`
 ### Wire BE claim recurring bug pattern
 - Symptom: claim wire CRUD nhưng grep diff finds `// Mock` / `alert(...)` / no POST/PUT/DELETE call
 - Verify: grep diff mock markers + live curl POST/PUT/DELETE expect 2XX
 - Severity: CRITICAL — block commit
 ### Cross-module security validation mirror (NEW S29 — Smart Friend 4× cumulative)
 - Symptom: khi mirror entity/Command/Handler cross-module (PE → Contract → Budget V2), em main solo focus data shape (DTO field, FK relation, projection) MISS security validation guards
 - Pattern: ApplicableType type guard cho V2 workflow pin entity — `aw.ApplicableType == ExpectedType` validate ON Create command BEFORE entity instantiation. Mirror PE pattern `PurchaseEvaluationFeatures.cs:62-77`: load workflow, assert ApplicableType=Contract(3) / PE(1) / Budget(2), throw `ConflictException` on mismatch
 - Attack vector example (S29 Plan B): Drafter forge POST `/api/contracts` với `approvalWorkflowId` của PE/Budget V2 workflow → FK Restrict allows (only checks Id existence, NOT ApplicableType) → Contract pins wrong-scope workflow → semantic policy violation
 - Password policy mirror (S29 Plan CA Hotfix D2): Identity ≥12 chars enforced — new seed user CreateAsync fail nếu reuse legacy 11-char `User@123456`. Verify per-user inline conditional override (e.g. `"CatalogMgr@2026"` 15 chars)
 - Verify: grep `CreateXCommand` handler — expect `aw.ApplicableType == ApprovalWorkflowApplicableType.X` check. Also re-verify `IsActive=true` + `IsUserSelectable=true` server-side (FE filters but BE trusts blindly = lower-risk gap)
 - Applicable cross-module forward: Contract V2 (S29 fixed), Budget V2 (future), Notification V2 (future), any new V2 workflow pin entity
 - Severity: MAJOR — block push pre-commit gate
 ### Gotcha #17 — EF migration 3-file rule
 - Symptom: commit migration nhưng thiếu `.Designer.cs` hoặc `ApplicationDbContextModelSnapshot.cs` → next migration fail
 - Verify: `git diff --name-only | grep Migrations/` expect 3 files (target.cs + target.Designer.cs + Snapshot.cs)
 ### Gotcha #47 — `.claude/agent-memory/**` NOT in `paths-ignore` filter (S22 discovery, PENDING bro decide)
 - Symptom: MEMORY.md drift patch commit (end-of-session flush) triggers full CI deploy ~3.5min waste
 - Verify: check `.gitea/workflows/deploy.yml` `paths-ignore` — currently `['docs/**', '**/*.md', '.claude/skills/**']` MISSING `.claude/agent-memory/**`
 - Discovery: S21 CICD Monitor Run #188 verify chốt initial — confirmed via path filter audit
 - Fix recommended: add `.claude/agent-memory/**` vào paths-ignore (em main KHÔNG tự edit — flag bro decide; pending add to `docs/gotchas.md` 47th entry)
 - Severity: minor (CI waste only, no functional impact)
 ---
-## 📋 5-category checklist (apply EVERY review)
+## 📋 5-category checklist (EVERY review)
-### Category 1: Wire BE / feature claim verify
+- **Cat 1 Wire BE/feature claim:** grep mock markers diff + `await api\.(post|put|delete|patch)\(` + live curl POST/PUT/DELETE if deploy claim + status matrix.
- Grep mock markers in diff (`// Mock`, `alert(`, `setEditing(null) // close UI`, `TODO.*wire`)
+- **Cat 2 Schema integrity:** 3-file rule Mig + column types vs entity def. Reference `docs/gotchas.md` (55 active).
- Grep actual API call: `await api\.(post|put|delete|patch)\(` trong FE diff
+- **Cat 3 Security:** `[Authorize]` class-level ALL new controllers + per-action policy admin-scoped (gotcha #44) + FE PermissionGuard + menuKeys.ts mirror BE MenuKeys.cs + FluentValidation + EF parameterized.
- Live curl POST/PUT/DELETE/PATCH if deploy claim (`https://api.solutions.com.vn/...`)
+- **Cat 4 Code quality:** `dotnet build SolutionErp.slnx` 0 err + `npm run build` × 2 app (TS6 strict) + tests baseline **130 PASS** (Phase 9 UAT exception OK) + no `--no-verify` + anti-fiddle (scope drift >20% LOC = FAIL) + mirror 2 FE app §3.9.
- Status code matrix expected vs actual
+- **Cat 5 Test coverage:** new helper → xUnit · new endpoint → integration · bug → regression test-before-fix. Phase 9 UAT test-after default OK (`feedback_uat_skip_verify`). Baseline 130.
-
+- **Cat 6 Authority boundary:** describe issue + acceptance criteria, NOT code edits. Escalate disagreement explicit.
 ### Category 2: Schema integrity (44 active gotchas)
 - Reference `docs/gotchas.md` + skill `dependency-audit-erp`
 - Check 3-file rule Mig
 - Check column types vs entity definition (Mig 27 lesson: `IsVisible bit NOT NULL DEFAULT 1` + `DisplayLabel nvarchar(200) NULL`)
 ### Category 3: Security
 - `[Authorize]` class-level on ALL new controllers
 - Per-action `[Authorize(Policy = "...")]` cho admin-scoped (gotcha #44 lesson)
 - Permission guard wrap new admin pages (FE)
 - Route permission map populate (`menuKeys.ts` mirror BE `MenuKeys.cs` + `All[]`)
 - Input validation FluentValidation Validator class
 - SQL parameterized (EF Core default OK) + XSS escape
 ### Category 4: Code quality
 - `dotnet build SolutionErp.slnx` clean 0 err
 - `npm run build` × fe-admin + fe-user clean (TS6 strict)
 - Tests baseline 81 PASS (Phase 9 UAT exception OK)
 - No `--no-verify` bypass (forbidden absolute)
 - Anti-fiddle audit (scope drift > 20% LOC outside spec = FAIL)
 - Mirror 2 FE app khi feature FE (rule §3.9)
 ### Category 5: Test coverage
 - New helper static → unit test (xUnit)
 - New Repository method → repo test
 - New endpoint API → integration test (WebApplicationFactory)
 - Bug recurring → regression test TDD-style (test BEFORE fix)
 - **Phase 9 UAT exception:** test-after default OK theo memory `feedback_uat_skip_verify`
 - Test count baseline 81 → tăng khi feature added theo §7
 ---
-## ⚠️ Anti-patterns observed (DO NOT)
+## ⚠️ Anti-patterns + 🛡️ Smart Friend guard
-1. ❌ Recommend code edits — only describe issue + acceptance criteria
+1. ❌ Recommend code edits (only describe issue+criteria) · 2. ❌ Skip live curl if deploy claim · 3. ❌ Accept "wire" without grep proof · 4. ❌ Defer to em main authority (escalate explicit) · 5. ❌ Skip MEMORY · 6. ❌ **Lower bar match em main** (Smart Friend Cognition anti-pattern).
-2. ❌ Skip live curl verify if deploy claim — recurring risk
+
-3. ❌ Accept "wire" claim without grep proof
+**Smart Friend (Cognition):** NEVER lower bar. Em main code fine → PASS. Em main issues → FAIL with specifics regardless social pressure. "Quality ceiling set by primary, not escalation." Value = raise quality through catch.
 4. ❌ Defer to em main authority — escalate disagreement explicitly
 5. ❌ Skip MEMORY.md update với anti-patterns observed
 6. ❌ Lower bar to match em main quality — Smart Friend anti-pattern Cognition
 ---
-## 🛡️ Smart Friend anti-pattern guard
+## 🧠 SOLUTION_ERP review essentials (S40 verified)
-Per Cognition documented research:
+- **Tests baseline:** **130 PASS** (58 Domain + 72 Infra). Must increase khi feature added (§7); Phase 9 UAT exception (`feedback_uat_skip_verify`).
- NEVER lower bar to match em main's apparent quality
+- **Gotchas:** **55 active** (`docs/gotchas.md`, format `### N.` highest #55). Latest #53 truncation · #54 529-fallback · #55 truncation-mid-exploration.
- If em main code fine → say PASS
+- **Migrations:** **40 latest `AddAttendances`** (path `src/Backend/SolutionErp.Infrastructure/Persistence/Migrations/`). Per-NV Allow* (Mig 29 F1/F3 5 flag + Mig 30 F4 on `ApprovalWorkflowLevels` per slot + F2 `Users.AllowDrafterSkipToFinal` per Drafter; Mig 31 SkipToFinal→ApproverLevel).
- If em main code has issues → FAIL with specifics regardless social pressure
+- **Endpoints:** ~211 · **84 SQL tables**.
- "Quality ceiling was set by the primary, not the escalation." — Your value = raise quality through catch
+- **Identity password ≥12 chars** (reject 11-char). Test creds: admin `admin@solutions.com.vn/Admin@123456` (full) · UAT `nv.test@solutions.com.vn/TestUser@123456` (Drafter CCM).
 - **Prod:** api/admin/eoffice.solutions.com.vn. **Pin:** MediatR `12.4.1` (flag `Version="14`) · Swashbuckle `6.9.0` · Node CI `20.x`.
 - **Conventions:** `docs/rules.md` (§3.9 mirror 2 FE, §5.2 commit, §6.5 docs narrative, §7 test timing, §2.8 pin).
 ---
-## 🧠 SOLUTION_ERP review essentials
+## 📅 Recent activity (FIFO — older → archive/git)
- **Tests baseline:** 111/111 PASS (S25 unchanged from S23 t3 +7 Plan M edge case tests; pre-Plan AB Chunk A2 SQLite tie-break regression Run #215 caught by CICD test gate → em main fix EntityType + Summary discriminator filter restored 111 PASS). Must increase nếu feature added per §7; UAT iteration exception per memory `feedback_uat_skip_verify`
+- **2026-05-28 (S35 G-H2 BE CRUD 16 endpoint pre-commit — PASS, Smart Friend 8× CLEAN):** 2 NEW file `HrmConfigFeatures.cs` 439 + Controller 137. build clean, 130/130 PASS. Cat1: 0 mock, 8 ConflictException (Holiday Update composite `(Year,Date)` BOTH fields). Cat3: class `[Authorize]` + 12 per-action `[Authorize(Roles="Admin")]`. Cat5: 8 Validator MaxLength MATCH EF source (Code=50 not spec 20). **2 MINOR defer:** ListHolidays no IsActive filter (inconsistent sibling) · OtPolicy "1 active unique" NOT enforced handler (G-P1 ambiguous nếu 2+ active). Verdict PASS. Tag `[s35, smart-friend-8x-clean]`.
- **Gotchas:** 47 active (`docs/gotchas.md` reference) — +#48 Multi-Changelog.Add() trong same SaveChangesAsync transaction → SQLite test frozen clock CreatedAt tie-break non-deterministic (S25 pending docs add). +#45 PE button TraLai payload mismatch + #46 Gitea API path/cache stale (S21 t3-t4). #47 paths-ignore agent-memory gap (S22 PENDING bro confirm add to docs)
+- **2026-05-26 (S33 Plan B G-H1 Phase 2 pre-commit — PASS, Smart Friend 6× CLEAN):** 17 file (3 BE + 6 FE new + 6 mod + 2). SHA256 mirror 3 file IDENTICAL admin==user. 5 endpoint real mediator.Send 0 mock. Mig 34 `AddEmployeeProfiles` 7 table UNIQUE indexes + FK Cascade. SeedDemoEmployeeProfiles NOT gated DemoSeed (gotcha #51 ✓). gotcha #50 Layout staticMap mirror ✓. **3 MINOR defer:** EmployeeCode race SERIALIZABLE low-risk · Update 3 bool not nullable (partial reset) · Delete DateTime.UtcNow direct. Verdict PASS. Tag `[s33, hrm-mig34, smart-friend-6x]`.
- **Migrations:** 31 latest `AddPeLevelOpinionsForV2` (S19 — Mig 31 Plan K1 swap F2 Drafter→Approver scope per-Level slot S23 t1). Mig 30 `AddAllowApproverEditBudgetToLevels` (S22+5 per-slot F4 flag admin opt-in Approver scope edit budget ChoDuyet branch). Mig 29 prev `RefactorAdvancedOptionsToPerLevelAndDrafterUser` (S21 t5 per-NV split)
+- **Smart Friend cumulative 8× CLEAN:** (1) S22 #44 silent-403 · (2) S25 #48 SQLite tie-break · (3) S29 password ≥12 · (4) S29 ApplicableType cross-module · (5) S33 BW test · (6) S33 Plan B Phase 2 · (7) S35 FE forms · (8) S35 G-H2. Plus 9× G-O2 (S36, em không track ở đây). 2 MAJOR catches total (S29 password + S29 ApplicableType); rest clean với MINOR defer.
- **Per-NV Allow* scope split** (Mig 29 + Mig 30) — F1+F3 5 flag + F4 `AllowApproverEditBudget` (S22) on `ApprovalWorkflowLevels` (per Approver slot), F2 1 flag on `Users.AllowDrafterSkipToFinal` (per Drafter). DTO: `currentLevelOptions` + `drafterAllowSkipToFinal` thay vì `workflowOptions`
+- **Archived S29-S33 detail + S32 startup → `archive/2026-05-q2.md` + git d2f52ba (S40 curate):** S33 Plan C B-Wrap 9/9 [Fact] verify · S33 startup drift audit (CLAUDE.md SEVERE → patched S40) · S32 wrap/startup standby · S29 wrap 2 MAJOR catch detail. KEY absorbed in bug patterns + Smart Friend cumulative above.
 - **Endpoints:** ~146 (+3 S22: allow-skip-final / budget-adjust / attachments/view)
 - **Identity password policy ≥12 chars** (S22+2 enforced by ASP.NET Identity stack — reject `User@123456` 11 chars). Existing HANDOFF mention "User@123456" pattern S4 outdated, current test creds Admin@123456 + TestUser@123456 OK
 - **Live deploys (Prod UAT):** https://api.solutions.com.vn · https://admin.solutions.com.vn · https://eoffice.solutions.com.vn
 - **Bearer token test:**
  - Admin: `admin@solutions.com.vn / Admin@123456` (full quyền)
  - UAT user: `nv.test@solutions.com.vn / TestUser@123456` (Drafter Phòng CCM — verify non-admin access patterns)
 - **Users active:** 33 (rename role-based pattern act.nv / act.pp / act.tp etc.)
 - **Conventions:** `docs/rules.md` (§3.9 mirror 2 FE, §5.2 commit format, §6.5 docs KEEP narrative, §7 test timing, §2.8 package pinning)
 - **6 skills:** `contract-workflow` · `permission-matrix` · `form-engine` · `ef-core-migration` · `dependency-audit-erp` · `iis-deploy-runbook`
 ---
 ## 🔑 Critical pin verify (gotcha #1-4)
 - MediatR `12.4.1` (14 fail DI)
 - Swashbuckle `6.9.0` (10 conflict OpenApi 2)
 - Microsoft.OpenApi `1.x` (2 breaking)
 - Node engines `>= 20` + CI `20.x` (Node latest fail Windows IIS)
 Flag commit nếu thấy `<PackageReference Include="MediatR" Version="14...` hoặc tương tự.
 ---
 ## 📅 Recent activity (last 10 FIFO)
 - **2026-05-28 (S35 Plan G-H2 Task 3 BE CRUD 16 endpoint pre-commit — PASS, Smart Friend 8× CLEAN):** 2 NEW file BE-only `HrmConfigFeatures.cs` 439 LOC + `HrmConfigsController.cs` 137 LOC. Independent verify: build clean 0 warning 0 error, tests **130/130 PASS** (58 Domain + 72 Infra) baseline preserved. **Cat 1 Wire BE**: 0 mock/alert/TODO marker. 8 ConflictException throws (4 Create UNIQUE Code/composite + 4 Update Code/composite-change guard). Holiday Update line 196-198 correctly checks composite `(Year, Date)` BOTH fields trên condition `entity.Year != req.Year || entity.Date != req.Date` (not just one). Delete handler `db.X.Remove(entity)` → AuditingInterceptor.cs:56-62 auto-convert State Deleted → Modified + IsDeleted=true + DeletedAt + DeletedBy (verified file read). **Cat 2 URL routing**: 16 endpoint kebab-case exact match spec: `leave-types`/`holidays`/`shifts`/`ot-policies` (file line 19/49/79/109 verified). **Cat 3 Anti-fiddle**: chỉ 2 NEW file BE (git status confirm), 0 touch FE/Domain/EF Config/Migration/DbInitializer/test. **Cat 4 Authorization**: class-level `[Authorize]` line 15 + 12 per-action `[Authorize(Roles = "Admin")]` (4 sub-resource × 3 write verb POST/PUT/DELETE) — exact mirror CatalogsController precedent line 12-46. **Cat 5 Validator**: 8 AbstractValidator class (4 Create + 4 Update). Smart Friend fix #1 verified — MaxLength MATCH EF source-of-truth: LeaveType.Code=50 (config line 14) ✓, ShiftPattern.Code=20 (config line 14) ✓, OtPolicy.Code=50 (config line 15) ✓, all Name=200/Description=500 ✓, ShiftPattern.WorkDays=100 (config line 16) ✓. Special validators: LeaveType.DaysPerYear≥0, Holiday.Year ∈ [2000,2100], Shift.StartTime≠EndTime + BreakMinutes≥0 + WorkDays NotEmpty, OtPolicy 3 Multiplier≥1.0 + 3 MaxHours>0. **Cat 6 Cookie-cutter 12-bis 3×**: 4 region structure identical (DTO + List + Create cmd/validator/handler + Update cmd/validator/handler + Delete cmd/handler). Naming consistent ListXQuery/CreateXCommand pattern. Smart Friend fix #2 verified — 4 HRM entities NO HasQueryFilter (grep Configurations confirm 9 file HasQueryFilter NONE are HRM) → 4 List handler correctly add `.Where(!IsDeleted)` line 37/134/232/337 + 8 Create/Update Conflict check `&& !x.IsDeleted` predicate explicit. **MediatR + FluentValidation auto-scan** Application assembly (DependencyInjection.cs:14-19) — no manual DI registration needed. **Smart Friend 8× cumulative CLEAN**: (1) S22 #44, (2) S25 #48, (3) S29 password, (4) S29 ApplicableType, (5) S33 BW, (6) S33 Plan B Phase 2, (7) S35 FE forms (em main earlier), (8) S35 Plan G-H2 NOW. KHÔNG lower bar — actual catches 0 CRITICAL/MAJOR. **2 MINOR observed (defer Phase 1.5)**: (a) ListHolidaysQuery KHÔNG có `bool? IsActive` filter (chỉ Q + Year) — khác 3 query sibling có IsActive filter — inconsistent UX nhưng có thể intentional (holidays admin thường list all). (b) OtPolicy claim "1 default IsActive=true unique" (entity comment line 7) nhưng handler Create/Update KHÔNG enforce "chỉ 1 active" — admin có thể tạo nhiều IsActive=true cùng lúc. Future G-P1 attendance reference `IsActive=true` sẽ ambiguous nếu có 2+ active. Defer fix khi G-P1 implement (em main spec rõ defer phase 1.5). **Verdict: PASS proceed commit**. Token cost ~9K.
 - **2026-05-26 (S33 Plan B G-H1 Phase 2 Task 4+5+6 pre-commit — PASS, Smart Friend 6× CLEAN):** Em main spawn em adversarial review 17 file uncommitted (3 BE new + 6 FE new + 6 FE mod + 2 Task 6 mod). **Independent verify SHA256 mirror 3 file PASS IDENTICAL**: `types/employee.ts` ccfc70666568, `EmployeesListPage.tsx` dc859c897c5c, `EmployeeCreatePage.tsx` c796f25d01ac — admin == user exact. **Cat 1 Wire BE**: 5 endpoint `GET /employees` (paged) + `GET /{id}` + `POST` (CreatedAtAction) + `PUT /{id}` (NoContent + ID match guard) + `DELETE /{id}` (soft NoContent) — tất cả real `mediator.Send`, 0 mock marker. Validator Create+Update đầy đủ (Phone MaxLen 20 + EmailAddress conditional When + decimal `.GreaterThanOrEqualTo(0)` lương/phép). Handler Create: load User (FindByIdAsync) → check existing EmployeeProfile UNIQUE (soft-deleted aware: throw ConflictException with distinct message) → atomic MaNhanVien codeGen SERIALIZABLE → entity save. Handler Get: Include 5 satellite + LEFT JOIN User/Department + projection. Handler List: filter Status + DepartmentId + Search (EmployeeCode/FullName Contains) + paging. **Cat 2 Schema**: Mig `AddEmployeeProfiles` timestamp 20260526110207 (= Mig 34 numeric by sort) — `EmployeeProfiles` + 5 satellite + `EmployeeCodeSequences` (7 table mới). UNIQUE indexes verified `IX_EmployeeProfiles_UserId` (line 309-313) + `IX_EmployeeProfiles_EmployeeCode` (line 293-297). FK Cascade Users. 6 Province/District/Ward cột plain Guid? defer FK G-H2 đúng comment. `EmployeeProfileConfiguration.cs` line 22-32 mirror Mig: UNIQUE + Cascade. MenuKeys.cs `All[]` line 108-114 đã có Hrm + HrmHoSo (line 112) — Admin auto-grant qua SeedAdminPermissionsAsync iterates All[]. DbInitializer.cs line 1484-1485 seed Hrm Order=28 + HrmHoSo Order=1 dưới Hrm parent. 28 không xung đột với Budgets=27. SeedDemoEmployeeProfilesAsync line 1945 NOT gated DemoSeed (placed OUTSIDE gate block) — đúng infrastructure pattern gotcha #51 lesson. **Cat 3 Security**: `[Authorize]` class-level present EmployeesController line 20 — no per-action policy yet (em main defer Phase 1.5). Input validation Create + Update Validator class đầy đủ. **Cat 4 Code quality**: TS6 erasableSyntaxOnly compliant — 10 enum dùng const-object pattern + `typeof X[keyof typeof X]`. Named exports (no default trừ App). Bundle size 1.43MB admin / 1.35MB user comparable baseline. ContactRound icon verified exist 5 places trong lucide-react bundle. DependencyInjection.cs line 39 registered `AddScoped<IEmployeeCodeGenerator, EmployeeCodeGenerator>`. **Cat 5 Test**: defer Phase 1.5 per em main spec UAT mode. Baseline 120/120 PASS preserved. **Smart Friend 6× cumulative CLEAN**: (1) S22 #44, (2) S25 #48, (3) S29 Plan CA password ≥12, (4) S29 Plan B ApplicableType, (5) S33 Plan C BW, (6) S33 Plan B Phase 2 NOW. KHÔNG lower bar — actual catches 0 MAJOR/CRITICAL. **3 MINOR observed (defer Phase 1.5)**: (a) Race condition EmployeeCode UNIQUE dưới SERIALIZABLE OK risk THẤP (per-year reset, mirror PE/HD pattern proven). (b) UpdateCommand 3 bool field IsCommunistParty/IsYouthUnion/IsTradeUnion không nullable → admin update partial sẽ accidentally reset (FE phải re-send all 3 every PUT — minor UX issue). (c) Delete handler `DateTime.UtcNow` direct không inject IDateTimeProvider — consistent existing PE/Contract Delete pattern, accept. **Special check verdicts**: gotcha #51 infrastructure seed gate compliance ✓ (em main cite gotcha #51 explicit comment line 1942-1944). gotcha #50 Layout staticMap mirror ✓ (Hrm_HoSo:/employees cả fe-admin line 57 + fe-user line 79). menuKeys.ts FE drift: pre-existing fe-admin minimal (16 key) vs fe-user (24 key) — em main Task 5 chỉ add Hrm 2 key cả 2 file, KHÔNG break Plan AA + Budget. Drift là pre-existing FE state intentional, không phải regression Plan B Phase 2. **Verdict**: PASS proceed commit. Token cost ~30K. Tag: `[adversarial-pass, hrm-mig34, smart-friend-6x-clean, phase-10]`.
 - **2026-05-26 (S33 Plan C B-Wrap test bundle pre-commit — PASS, INDEPENDENT VERIFY 9/9 tests):** Em main spawn em adversarial Plan C B-Wrap Contract V2 test bundle review. 4 file mới: TestCurrentUser (31 LOC stub), ContractWorkflowServiceApproveV2Tests (BW1-4+7, 5 [Fact]), CreateContractCommandApplicableTypeTests (BW5, 1 [Fact]), ContractV2SchemaPersistenceTests (BW6 split 3 [Fact]). Total 9 [Fact]. **Independent verify ran `dotnet test --filter` → 9/9 PASS local trong 4.7s** (em main claim 120/120 baseline tăng từ 111 — verified). Spec mapping verify Cat 1: BW1 ContextNote `"Hoàn tất Cấp 1, sang Cấp 2 cùng Bước 1"` ✓ match service line 360, BW2 mã HĐ `"FLOCK01/HĐTP/SOL&BTBM/01"` ✓ match ContractCodeGenerator HĐTP format line 21, BW3 ContextNote `"Approver skip thẳng tới Bước 3 Cấp 2"` ✓ match service line 348 (lastStepIdx=2, lastLevelMaxOrder=2, prefix `[Approver skip thẳng tới Bước 3 Cấp 2 (NV cuối) — bỏ qua các Bước/Cấp trung gian]`), BW4 ForbiddenException `"Bước 1...Cấp 1: bạn không có"` ✓ match service line 263-264, BW5 ConflictException `"ApplicableType=Contract"` ✓ match handler line 84-85 (test correctly handles spec→actual exception type discrepancy: spec says ValidationException, actual ConflictException — em main inline comment line 84 docs the discrepancy), BW7 ConflictException `"skipToFinal chỉ hỗ trợ HĐ V2"` ✓ match service line 105-106. Schema verify Cat 2: Mig `AddContractLevelOpinions` (timestamp 20260522052240) actual position 33 by filename sort confirmed via Glob (33 mig + 33 designer + 1 snapshot in /Persistence/Migrations folder), spec ref "Mig 33" matches. UNIQUE composite `(ContractId, ApprovalWorkflowLevelId)` confirmed `ContractLevelOpinionConfiguration.cs:34`. FK Cascade Contract + FK Restrict Level confirmed line 27+32 + migration FK line 41+47. Test quality Cat 5: assertions specific (`Should().Be(2)` for levelOrder, `Should().Contain(...)` for substring match, `Should().ThrowAsync<X>()` with WithMessage wildcard), each [Fact] sets up fresh `IdentityFixture` + `using` disposal pattern (BW1-4+7 verbose using-block, BW6 `using var fix` shorthand — minor style inconsistency but functional same). Smart Friend independence note: **5 lần cumulative Smart Friend catches — em main + Implementer làm TỐT lần này, KHÔNG có catch MAJOR**. (1) S22 #44, (2) S25 #48, (3) S29 ApplicableType, (4) S29 DemoSeed, (5) S33 BW = clean. Implementer + em main spec mapping accurate, exact string match between assertions and service strings. **Minor (3, defer):** (a) `CreateService` helper method `ContractWorkflowServiceApproveV2Tests.cs:27-44` unused dead code — 5 [Fact] manually recreate inline (cleaner but DRY violation). Cleanup recommend Plan C-Hotfix or next test bundle. (b) `TestCurrentUser.Roles` constructor params `string[] roles` allows null → defensive `roles ?? Array.Empty<string>()` line 27 OK but C# warning shadow. (c) BW6 split 3 [Fact] cleanly separated DUPLICATE + UPSERT + Cascade per spec — 9 tests OK not over-engineer (each invariant tested isolated). **Defer noted**: ApproveV2Async still ~150 LOC, BW1-4+7 cover happy + terminal + skip + outsider + V1 fallback — Plan B-Wrap roadmap mentions BW Bonus future test: OR-of-N multi-NV (3 NV cùng Cấp 1, only 1 needs approve), idempotent UPSERT (Cấp 1 approve → reject → approve lại same row Comment update), Mig 32 seed idempotent guard. Not blocker for current bundle commit. Token cost spawn ~22K. Verdict: **PASS proceed commit** (9 [Fact] all pass independent verify, spec match service exact, schema 3 invariant tested, 0 critical/major, 3 minor cosmetic). Recommendation: commit 4 file as proposed, baseline tăng 111→120. Tag: `[adversarial-pass, test-bundle, contract-v2, smart-friend-5x-clean]`.
 - **2026-05-26 (S33 startup — drift audit readonly, NONE actual review):** Em main spawn em S33 drift assessment 3 area (gotchas / CLAUDE.md root+docs / 4 sub-agent .md). **Verdict overall: MODERATE drift accumulated S19→S32 chưa patch** — late but not severe. Findings: (a) `docs/gotchas.md` actual count = **52 entries** (grep `^### \d+\.` confirm), claim S32 = 52 → MATCH NONE drift. #50/#51/#52 detail entries present line 883/839/924 (out-of-order numbering but content full). (b) CLAUDE.md (root) **SEVERE stale**: line 87 "Hiện có 26 migration → 59 bảng" (actual 33 mig + 60 table per S32 wrap), line 66+87 "81 test pass" (actual 111), line 133 "26 bẫy đã gặp" (actual 52). docs/CLAUDE.md line 65 "38 pitfall" stale similar. (c) 4 sub-agent .md drift mixed: cicd-monitor.md line 232-233 already patched S29 "111/111 PASS (58 Domain + 53 Infra)" + "Migrations: 33" CORRECT no drift; investigator.md line 77 "44 gotchas hiện tại" STALE +8; reviewer.md line 92 "44 active gotchas" STALE +8; implementer.md line 123+141 "baseline 81 preserve" STALE +30. **Critical drift requiring immediate patch**: CLAUDE.md root 3 stale fact (mig 26→33, test 81→111, gotcha 26→52) — agent context first-load file, drift mislead future spawns. **Optional defer 2026-06-01 audit**: 3 sub-agent .md gotcha+test count stale (cosmetic, no functional impact). Migrations folder discovery: actual path `src/Backend/SolutionErp.Infrastructure/Persistence/Migrations/` not `src/Backend/SolutionErp.Infrastructure/Migrations/` — `cicd-monitor.md` line 149 path hint correct, but agents/runbooks may have stale absolute path. Token cost ~7K. Tag: `[startup-audit, drift-moderate, claude-md-severe]`. Recommendation: bro decide patch CLAUDE.md ngay (3 line edit) hoặc defer cycle audit ngày 2026-06-01.
 - **2026-05-26 (S32 wrap — em main proxy update + Plan B-Wrap + Phase 10 pre-commit scope ahead):** Session 32 đóng clean. Em chủ trì spawn em 1 lần S32 startup verify (a0aa13093d14f3bca alive, MEMORY 24.39KB self-curated S32 dropped S27 retrospective). Smart Friend 4× cumulative preserved (S22 #44 + S25 #48 + S29 ×2 ApplicableType + DemoSeed gate). **Plan G 11 module backlog DOCUMENTED migration-todos** + Plan B-Wrap test bundle BW1-BW7 spec ready (D-Bis section). **Pending tasks em main S33 SendMessage gọi em adversarial pre-commit:** (a) **Plan B-Wrap test bundle review** — verify 7 test scenario coverage (BW1 happy path advance, BW2 terminal gen mã HĐ, BW3 skipToFinal F2 admin opt-in, BW4 ForbiddenException outsider, BW5 ApplicableType=Contract validation Cat 3 cross-module mirror, BW6 Mig 32+33 schema persistence UNIQUE composite, BW7 V1 fallback ConflictException). Smart Friend mindset: catch test scenario gap (e.g., NV skipToFinal=true but currentStepIndex already at final = silent no-op? verify guard line 337-352 ContractWorkflowService). (b) **Plan G-H1 Hồ sơ NS pre-commit review** — Mig 34 schema (1 main + 5 satellite) FK strategy + nullable validation + soft-delete pattern verify mirror PE AuditableEntity inheritance. (c) **Phase 9 UAT audit hard blocker checklist** — SMTP config Production secrets exposed? Rotate creds cycle plan token leak risk? cert expire 2026-07-23 auto-renew verify schedule task `Get-ScheduledTask -TaskName 'win-acme*'`. Token cost wrap ~3K. Tag: `[wrap, phase-9-to-phase-10, security+infra]`.
 - **2026-05-26 (S32 startup verify — adversarial mindset ready, 0 actual review):** Em main spawn em standby cho S32. Self-verify context: MEMORY 22.50KB (23042 bytes — approaching 25KB threshold, chưa curate cần nhưng cảnh báo entry mới sẽ trigger soon), last entry 2026-05-22 13:28 S29 wrap khớp. MCP RAG `search_memory` + `cross_project_search` PRESENT cả 2 — test query "ApplicableType validation" trả rerank 0.867 (high precision match Cross-module security entry line 41-49). **Awareness S31 fixes (between sessions, em không spawn):** RAG v1.3 baseline PASS recall@5=1.000 (11/11) + retrieval.py fix, gotcha #52 NEW added — KHÔNG impact Reviewer adversarial logic (infra ops fix, không phải application code). **Awareness S29 deployed prod**: Plan CA + Plan B Contract V2 wire push successful, gotcha #51 NEW added (INFRASTRUCTURE vs DEMO seed gate — `SeedSampleContractWorkflowV2` OUT of `if (settings.DemoSeed)` gate là correct pattern infrastructure data luôn seed regardless of demo mode). **Smart Friend pattern 4× cumulative VERIFIED preserved**: (1) S22 #44 silent 403, (2) S25 #48 SQLite tie-break, (3) S29 Plan CA password ≥12 chars, (4) S29 Plan B ApplicableType cross-module. **Adversarial mindset retained pre-commit gate active**: forward cho 3 pending task em main có thể spawn em qua SendMessage — (a) Plan B-Wrap BW1-BW7 test bundle review (ApproveV2Async coverage ~150 LOC 0 unit test gap + ApplicableType validate regression test — gotcha #48 lesson SQLite tie-break apply when add Changelog rows in test setup, cần discriminator EntityType + Summary keyword); (b) ContractWorkflowMatrixView review pre-commit khi Implementer wire xong (anticipate Mirror §3.9 fe-admin + fe-user 2 file sync check, V1/V2 dual schema branch verify, permission menuKey populate sync BE+FE); (c) Phase 9 UAT hard blocker audit (SMTP outbox table + sender flow / rotate creds 5 item / SQL backup schedule daily 03:00 / win-acme cert renewal 3 cert 60d). **Token cost spawn standby ~6K**. Patterns NEW noted reinforce S32: pre-spawn checklist verify MEMORY size + freshness + MCP tools first-call before any review action (standard hygiene).
 - **2026-05-22 (S29 wrap — Smart Friend 4× cumulative):** Plan CA (admin→eoffice 7 commits) + Plan B (Contract V2 11 commits) — 2 MAJOR catches Reviewer spawn. **CA MAJOR**: `DemoUserPassword = "User@123456"` 11 chars vs Identity policy ≥12 chars → new catalog.manager seed CreateAsync FAIL prod. Fix per-user inline conditional override `"CatalogMgr@2026"` 15 chars. **B MAJOR**: see above S29 Plan B entry. Smart Friend cumulative S22 #44 + S25 #48 + S29 CA password + S29 B ApplicableType. **Cat 3 Security checklist reinforced**: ApplicableType type guard V2 + password ≥12 chars + IsActive/IsUserSelectable re-validate. **Recommendation forward**: Reviewer spawn MANDATORY cho cross-module mirror diff (PE→Contract, PE→Budget V2 future, identity policy change). UI polish iteration em main solo OK.
 - **Archived to `archive/2026-05-q2.md` 2026-05-27 S34 curate (em main proxy):** S29 Plan B pre-push detail (MAJOR catch ApplicableType validation — KEY lesson absorbed Cross-module security mirror foundation line 41-49) + S26 Plan AG pre-commit + AG2-AG6 em main solo + S25 Plan AB wrap (gotcha #48 lesson — foundation line 40-45) + S28 wrap Layer A governance Cat 6 add (absorbed forward 5-category baseline). Smart Friend guard 4× cumulative S22+S25+S29×2 preserved in current S33 entries.
 ---
 ## 🔄 Curate trigger
-
+- >25KB → archive recent → `archive/<period>.md`. Stale >3mo → remove.
- Memory size > 25KB → archive recent entries to `archive/<period>.md`
+- **Last curate: 2026-05-29 S40 em main proxy** (28.4→~18KB): archived S33 Plan C + S33 startup + S32×2 + S29 wrap detail → q2 + git d2f52ba; refreshed stale (81/111→130 test, 47→55 gotcha, 31→40 mig, ~146→211 endpoints). Foundation (bug patterns + 5-category + Smart Friend guard + cross-module security) preserved. Prev: S34 q2 · S22 q1.
 - Duplicate entries detected → merge
 - Stale > 3 months → remove
 **Last curate: 2026-05-27 S34 em main proxy curate** (post-S33 wrap, sequence 1/4) — archived 3 verbose entries (S26 Plan AG + S25 Plan AB wrap + S28 Layer A governance Cat 6 add) → `archive/2026-05-q2.md`. KEEP: S33 Plan B G-H1 Phase 2 pre-commit (Smart Friend 6× clean), S33 Plan C B-Wrap pre-commit (9/9 [Fact] verified), S33 startup drift audit (CLAUDE.md SEVERE), S32 wrap (Plan B-Wrap pre-commit scope ahead), S32 startup, S29 wrap (Smart Friend 4× cumulative), S29 Plan B pre-push (1 MAJOR catch ApplicableType). 5-category checklist + Cat 6 Authority boundary check + Smart Friend guard + Cross-module security validation mirror pattern (NEW S29 foundation) preserved. MEMORY size before: 28.5 KB → after: target ~20-22 KB. **Previous curate: 2026-05-26 S32 startup** drop S27 retrospective. Next curate trigger: > 25KB OR Plan G-O1 Danh bạ kick off.