[CLAUDE] Docs: adopt Harness-16 MFE (memory-fidelity-EVAL) — 2-workflow + email AI_INFRA

Adopt AI_INFRA Harness-16 (3 broadcast 2026-06-29) qua 2-workflow mandate:
WF1 implement wf_4c63e1bd-99e + WF2 review wf_13e3d35a-023 (PASS 0-blocking).

MFE = coverage/retention eval (do nap-vs-nho-vs-dung bang SO DO). DISTINCT
voi H6.7 memoryDelta-routing-fidelity (vocab-fork WF1 reviewer bat duoc).

Built (em-main single-writer, 0 production code):
- scripts/mfe-eval.ps1 deterministic NO-API (ASCII #30, exit 0): LEAD coverage-FIT
  (token-RANGE, cap live-read) + age-band flag-not-cut + Goodhart-anchor strikes/RCA;
  SUB per-role coverage do-that (prose->N/A khong 0%); sub-workflow N/A. Smoke 3-tier PASS.
- memory-budget.json :mfe config + eval/mfe/ (seed sample-questions stable-id + README)
  + engine §H + artifact-row + C3-comment + wire session-start §2.1.6 / session-end §L.b(c)
  opt-in + agents/README S93. Judge layer = SCAFFOLD-only (honest nac).

adap-report harness-16-mfe + harness-15-v3 (covered/folded) + email outbox/ai_infra.
AS-10 dogfood: WF1 residual-write caught+reverted. State GIU NGUYEN (Mig 59 · 88 · 434 · gotcha 76).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.claude/agent-memory/cicd-monitor/MEMORY.md

@@ -70,6 +70,7 @@ BE (test+build) ~90s · FE × 2 ~60s/app · deploy ~30s · **total ~3min code /
 
 ## 📅 Recent runs (compressed — full verbatim → `archive/2026-06.md` via `archive/_INDEX.md`)
 
+- **🟢 S93 #473 (id=473, run_number 359) `8ee8f3e` GO ~5m23s (PE tree node Dự án hiện MÃ thay TÊN-dài — FULL-STACK DTO+projection, NO-MIG, FE-real-rotate)** — 7-file: 3 BE App (`PurchaseEvaluationDtos.cs` +`ProjectCode` positional-record · `PurchaseEvaluationFeatures.cs` thread `x.p.Code`→3 projection [List/Inbox/ListApproved] + search `p.Code` · `CreateContractFromEvaluationFeatures.cs`) + 4 FE SHA-mirror (fe-admin+fe-user `PurchaseEvaluationsListPage.tsx` render `pg.projectCode||pg.projectName`+tooltip+sort, `purchaseEvaluation.ts` +`projectCode`). NO `*Migrations*` (DTO/projection-only, 0 schema). status=success ⟹ test gate passed (baseline **434**=45 Dom+389 Infra per brief; tasks-API no numeric, trusted terminal-success+baseline). Smoke 4×200 (api live/ready, admin/eoffice root) + admin :80→301-https. **FE ship-proof (REAL fe-src diff ⟹ #69 expect rotate)**: admin JS `xz8FdmLN`→`CDn40vpV` ✅ + user JS `CA8Rla2w`→`CoPmPBg7` ✅ (BOTH rotated); **CSS BOTH FROZEN** admin `DWQ-DgfZ`/user `Dr0-ikKX` — CORRECT (TSX-logic+TS-field only, ZERO new Tailwind class ⟹ css byte-identical, mirrors S90). Last-Modified admin `09:04:19Z`/user `09:05:14Z` BOTH in-window (run 16:00:19→16:05:42+07) + size admin 1,636,195b/user 1,542,518b real-JS · SPA-trap control fake-hash=919b text/html (confirms large=genuine). **Mig prod=59** (`AddCcmBudgetPeriodToPurchaseEvaluation` latest, COUNT=59 matches repo-HEAD, NO new applied — expected, 0 mig-file in commit). sqlcmd-over-ssh UTF-16LE base64 EncodedCommand, `-U vrapp -P buKL3TGBkD0wDDbYVw65QeX9` (no prefix). Pre-deploy LIVE baseline matched brief's S92 prev-hash EXACTLY (no drift this run). 🔑 **css-frozen-on-logic-only-FE = NOT-a-fail** (re-confirms S90 pattern: JS rotates, CSS frozen when no new utility class — don't FAIL on partial-rotate).
 - **🟢 S92 #472 (id=472, run_number 358) `1408d4e` GO ~5m24s (eOffice hide 5 menu-groups non-Admin — BE-ONLY DbInitializer permission-revoke EXPANSION, VERIFY-PROD-EFFECT)** — 4-file: `DbInitializer.cs` (RevokeTemporarilyHiddenModulesAsync `+Contracts/Ct_*/Master/Suppliers/Projects/Departments/Catalog*` on top of S58 Hrm*/Off*/Personal + 2 re-grant calls DISABLED [SeedAllRolesHrmProfileReadPerms S65 + SeedAllRolesOfficeModulePerms S69 commented] + InReviewScope narrowed `Pe_*` only) + 3 test files (new `AdminOnlyModulesRevokeTests` ×3). NO `*Migrations*`/fe-src. status=success ⟹ test gate passed (baseline **434**=45 Domain+389 Infra per spec; logs 404 anon, trusted gate+baseline). **PURPOSE = verify revoke FLIPPED existing prod rows (NOT bundle).** Smoke 4×200 (api health/live+ready, admin, eoffice). **3-evidence ship-proof**: (1) `Infrastructure.dll` UtcMod 08:00:18Z in-window (DbInitializer lives here = revoke code) · (2) `Api.dll` 08:01:54Z + `Application.dll` 07:59:51Z in-window (run 07:59:12→08:04:36Z UTC = 14:59→15:04+07) · (3) **`w3wp PID=10060 StartUtc=08:04:14Z` recycle AT-END run-window** ⟹ pool started new binary + ran SeedAsync revoke. **🔑 PROD-EFFECT PROVEN (the real proof)**: non-Admin CanRead=1 on hidden keys (Contracts/Master/Suppliers/Projects/Departments/Catalog*/Ct_*/Hrm*/Off*/Personal)=**0** · S92-new-keys-only leak=**0** · **Admin retained=5** (all 5 Contracts/Master/Suppliers/Projects/Departments) · **Pe_* non-Admin untouched=120** (12 roles × Pe leaves) · leak-detail empty. ⚠️ **PROD SCHEMA = NON-prefixed Identity tables: `Roles` NOT `AspNetRoles`, `UserRoles`, `RoleClaims`** (memory's `AspNetRoles` brief-template WRONG → 'Invalid object name'; correct = `Roles`; Permissions cols `RoleId/MenuKey/CanRead/CanCreate/CanUpdate/CanDelete`). DB SQL-auth `-U vrapp -P buKL3TGBkD0wDDbYVw65QeX9` (no prefix), `-S .\SQLEXPRESS -d SolutionErp`. ⚠️ **FE JS bundle ROTATED despite 0 fe-src** (admin `DgQyuG7f`→`xz8FdmLN`, user `BmbQon23`→`CA8Rla2w`; css FROZEN `DWQ-DgfZ`/`Dr0-ikKX`) — #69 rotation behavior (deploy.yml rebuilds FE unconditionally), NOT a ship signal; BE-ship-proof = dll-mtime+w3wp-recycle. Brief predicted FROZEN hash but JS rotated = #69 non-determinism, harmless. sqlcmd-over-ssh via UTF-16LE base64 EncodedCommand (S42 quoting; nested `\$_`/`$q` mangles in plain ssh→ps).
 - _(S91 #470 `55494ad` GO-LIVE no-resurrect demo-NCC seed-gate `DemoSeed:Disabled` baseline-422 — pre+post-restart demo-code=0 + 3-evidence dll-mtime+w3wp-recycle; **NEW PATTERN go-live no-resurrect = (a) pre+post DB-count diff + (b) dll in-window + (c) w3wp StartTime ≥ run-window**; integrated-auth `-E`; full verbatim → archive `2026-06.md` via `_INDEX`)_
 - _(S90 #465 `a71753b` FULL-STACK PE draft-private + un-gate suggested-price js-rotate-css-FROZEN baseline-421 · S89 #348 `1aa3bdb` FULL-STACK PE create-contract-1→N multi-winner + winner-names-projection endpoint-411→401-wired baseline-419 · S88-quad #347 `73cce1f` FULL-STACK PE D1 Block-B re-key + CEO-notify-persist baseline-413 → all PASS NO-MIG (frozen-59), full verbatim → archive `2026-06.md` via `_INDEX`)_

.claude/agent-memory/memory-budget.json

@@ -40,6 +40,34 @@
       "patterns": ["gotcha #", "anti-pattern", "recurring", "lost-update", "race", "bai hoc", "lesson", "guard", "root-cause", "silent-fail"]
     }
   },
+  "mfe": {
+    "_note": "Harness-16 Memory-Fidelity-EVAL (MFE) config (S93, 2026-06-29). Read by scripts/mfe-eval.ps1 (deterministic NO-API analyzer). DISTINCT from H6.7 'memoryDelta-routing-fidelity' -- THIS = COVERAGE/RETENTION eval (does the hot-feed actually retain the must-remember set). Single-source config so the analyzer never hardcodes (B1 derived-tro-canonical). MFE READS token_governor caps (live), NEVER writes them (owner-authority floor, role_boundary_note). Branch-A judge layer = SCAFFOLD-only (numbers meaningless until sample-questions mature AND an independent cross-session judge runs).",
+    "denominator_sources": {
+      "marks": ".claude/governance/ACTIVE-MARKS.md (table rows whose Status = Active-High / Active; skip Medium / Disabled)",
+      "guards": "docs/governance/error-ledger.md (Active-Guards index rows Verified=check + Net not-negative; AS-table AS-N = recurring-error CLASS registry)",
+      "recurring_gotchas": "docs/gotchas.md (### N. headings whose heading+body carries a recurrence-token)"
+    },
+    "merge_guard_to_as": true,
+    "_merge_note": "true = a recurring-gotcha or guard whose AS-row references its #N (or AS-N) collapses INTO that AS class (AS = canonical class registry, deterministic by cross-reference). false = count each source separately (upper bound).",
+    "recurrence_tokens": ["tai phat","tai dien","tai-dien","recurrence","recurring","bug-class","bug class","extend #","cung ho","cung-ho","whack-a-mole","class s"],
+    "sub_denominator": {
+      "role_file_glob": ".claude/agents/*.md",
+      "diary_path_pattern": ".claude/agent-memory/<role>/MEMORY.md",
+      "_diary_trap_note": "READ the agent DIARY agent-memory/<role>/MEMORY.md -- NOT project CLAUDE.md NOR user memory/MEMORY.md (Harness-15-v3 duplicate-filename trap = false-positive).",
+      "denom_header_anchors": ["anti-pattern","split boundary","auto-refuse","boundary","NEVER"],
+      "content_word_min": 2,
+      "_match_note": "numerator = denom item present in diary by EXACT item-id OR >=2 distinct CONTENT-words (after NFD-strip-diacritics + lowercase + drop stop_list). Leading-verb-only match = false-max (broadcast: a verb-only memory scored 9/9) -- the stop_list defeats it.",
+      "stop_list": ["do","not","never","dont","avoid","skip","use","always","ensure","make","keep","the","a","an","of","to","and","or","is","be","when","if","khong","luon","phai","dung","cac","mot","la","va","khi","neu","read","write","edit","commit","push"]
+    },
+    "sample_questions": "eval/mfe/sample-questions.json",
+    "state_file": ".claude/agent-memory/.mfe-state.json",
+    "honest_caveats": {
+      "token_estimate": "char/4 is NOT real tokenization; VN-diacritic hot-memory ~3.0-3.5 byte/tok; report a RANGE [bytes/4 .. bytes/3.0]; FIT verdict uses bytes/3.0 (worst-case). Real tokenizer count lies inside the band -- never a single false-precise number.",
+      "judge_layer": "Branch-A recall/apply scorer is SCAFFOLD-only (empty). Self-grade same-session = meaningless (just read the answers). Numbers meaningful ONLY after (a) sample-questions mature in age AND (b) an independent cross-session/different-model judge scores.",
+      "age_band": "age is a FLAG, never a cut (mark RC-...10-29-11 age=false-proxy). An item drops only on status-change (mark->Disabled, guard->retired, AS row deleted), NOT by age.",
+      "read_only_scope": "MFE WRITES exactly one file: .claude/agent-memory/.mfe-state.json (its own strikes-state for cross-run Goodhart compare). 'READ-ONLY' is scoped to token_governor / the budget caps (owner-authority) which it NEVER writes -- it is NOT the claim 'writes nothing'."
+    }
+  },
   "harness_floor": {
     "_note": "Harness-15 A1/A3 (S81, 2026-06-20): SAN-harness = fixed per-spawn cost (NOT tunable) = tool-schema + framing + own persona/role file + lead-pasted base-doc slice + task prompt. SEPARATE HOUSE (A3 anti-double-count): persona + lead-pasted-docs belong HERE (floor), NOT counted in token_governor.l1_always (which = own agent-memory + archive index + work-state block only). MEASURED-ESTIMATE not exact (H15 honest-note b): persona = directly measured bytes (.claude/agents/<name>.md 4.3KB-13.3KB => ~1.3K-4.0K tok via /3.3); tool-schema + framing = harness-injected (cannot byte-count locally), estimated comparable to AI_INFRA same-toolset-family (Read/Write/Edit/Bash/Grep/Glob/Skill/RAG).",
     "measured_token_estimate": 21000,