[CLAUDE] Docs+Skill: audit định kỳ 2026-05 — 6 file patch + 1 log page

Combined audit (skill staleness + doc drift) theo §6.4 + §9.4. Cron 2026-05-01 trễ 4 ngày (cron empty), chạy manual 2026-05-04 sau Session 9 close Chunk E-bis.

Drift patched (Phase 1 — count cross-check):
- docs/CLAUDE.md:70    52 bảng → 55 bảng (+§14 DepartmentApprovals Mig 16)
- docs/rules.md:368    Phase 8 active — 77 test → Phase 9 — 83 test
- docs/architecture.md:329, 365   77 test → 83 test (2 chỗ)
- .claude/skills/ef-core-migration/SKILL.md:52    77 test → 83 test + ghi 6 PE 2-stage S9
- .claude/skills/dependency-audit-erp/SKILL.md:153    26+ bẫy → 41 bẫy

Skill content patch (Phase 2 — staleness):
- contract-workflow: thêm "Phase 9 cross-ref (Mig 16)" block + section "Phase 9 done" (2-stage dept approval + smart reject + lock edit + CanBypassReview)
  → KHÔNG tạo skill 2-stage riêng (§9.5 anti-pattern "viết skill chỉ để có thêm")

KEEP per §6.5 (không cắt narrative):
- docs/rules.md:328 "52 bảng" example minh họa rule §6.5
- docs/changelog/migration-todos.md:152, 196 historical session record
- 9 session log mention 77/52 — snapshot lịch sử

Total patches: 6 file ~+30 / ~12 lines, KHÔNG rewrite, đáp ứng 3 câu validation §6.5.

Audit log: docs/changelog/skill-audit-2026-05.md (1 page max per cadence).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.claude/skills/contract-workflow/SKILL.md

@@ -26,6 +26,20 @@ when-to-use:
 > - `Domain/PurchaseEvaluations/PurchaseEvaluationPolicy.cs`
 > - `Infrastructure/Services/PurchaseEvaluationWorkflowService.cs`
 > - Kế thừa HĐ từ phiếu `DaDuyet` qua `CreateContractFromEvaluationCommand` — pin `Contract.WorkflowDefinitionId` theo ContractType user chọn.
+>
+> **Phase 9 cross-ref (Migration 16 — Session 8/9):** 3 mở rộng cross-cut 3 module
+> (Contract + PurchaseEvaluation + Budget):
+> - **2-stage dept approval** (đóng bug anh Kiệt FDC): NV Review → TPB Confirm.
+>   `*DepartmentApprovals` table UNIQUE (TargetId, Phase, Dept, Stage). Service
+>   inject UserManager → check role DeptManager / CanBypassReview → upsert row +
+>   block transition cho đến khi Stage=Confirm. **6 test PE 2-stage** ở
+>   `tests/.../Services/PeTwoStageApprovalTests.cs` (`IdentityFixture` reusable).
+> - **Smart reject + Resume jump-back**: `Reject` → set `RejectedFromPhase` snapshot
+>   + force `targetPhase=DangSoanThao`. `Resume` (Drafter trình lại từ DangSoanThao
+>   với RejectedFromPhase != null) → jump straight tới phase đã reject, bypass
+>   policy guard. Áp dụng 3 module.
+> - **Lock edit guards** 17 handler: Phase != DangSoanThao → throw 409 ConflictException.
+>   KHÔNG lock Comment + Attachment + Opinion (workflow design intent).
 
 ## Domain entities (implemented)
 
@@ -293,6 +307,13 @@ POST /api/contracts/{id}/transitions { targetPhase: 3, decision: 1, comment: "..
 - **WorkflowDefinition cascade delete** → NÊN restrict FK. Nếu cascade sẽ xóa Contract cũ → data loss. Đã fix trong migration.
 - **User-kind approver không enforce runtime** — designer cho chọn nhưng guard v1 chỉ check Role. Iter 2 cần wire `step.Approvers.Where(a => a.Kind == User)` vào check.
 
+## Phase 9 done (Mig 16 — Session 8/9)
+
+- [x] **2-stage dept approval** xuyên 3 module — NV Review BLOCK / TPB Confirm ALLOW
+- [x] **Smart reject + Resume jump-back** — RejectedFromPhase snapshot + bypass policy
+- [x] **Lock edit guards** 17 handler khi Phase != DangSoanThao
+- [x] **CanBypassReview toggle** per User — admin UI + audit IsBypassed=true
+
 ## Tier 4+ (còn thiếu / future)
 
 - [ ] Warning notification 20% SLA (`SlaWarningSent` flag đã có)