[CLAUDE] Docs: S56 closeout — pre-golive verify + golive-harden + doc-drift + gotcha #58

STATUS/HANDOFF S56 + session log: WF1 pre-golive-verify (7-stream → GO) + WF2 golive-harden (4 fix, code a20cde8 Run #379 PASS). Test 216→228. Code golive-ready; 2 ops VPS pending (IT user + tzutil); FE Phase 2 deferred.

§L closeout (H1/H2): database-agent executed-file→verified-runtime (agents/README:4, D1 closed); ef-core skill 47→48; sys.tables 92→93 reconciled (cicd ground-truth); root CLAUDE test 203→228 + 92→93 bảng; gotcha #58 NEW (EF read-modify-write lost-update→ExecuteUpdate atomic). agent-memory harvest: cicd Run#379 + Fidelity Serializable-correction (impl/test MEMORY, H2 GATE 4.5/5).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/changelog/sessions/2026-06-09-S56-pre-golive-verify-harden.md

@@ -0,0 +1,44 @@
+# Session 56 (2026-06-09) — Pre-golive verify sweep + golive-harden 4 fix
+
+> HMW-mode ON · 2 Workflow fan-out + 1 code commit `a20cde8` → Gitea Run #379 PASS ~4m20s, prod-verified. Code golive-ready.
+
+## Arc
+`/session-start` (HMW-ON marker) → anh hỏi "đọc cách design UIUX NAMGROUP chưa?" (đọc bộ quy ước density-first qua `broadcasts/inbox/namgroup/`) → "Tiếp Phase 2 redesign → fan-out" + "trừ PE/Contract, office các thứ làm giống" → recon (investigator-codebase) → AskUserQuestion scope **DISMISSED** ("wait for next instruction") → pivot: **"kiểm tra lại tính năng + master data, sắp golive"** + `/ultra-on` → **WF1 pre-golive-verify** → "fix hết workflow luôn" → **WF2 golive-harden** → em main review + Serializable bump → ship → cicd PASS → `--resume` → `/session-end`.
+
+## WF1 — `pre-golive-verify` (custom Workflow tool, 7 stream + adversarial)
+7 verify stream song song → mỗi issue qua reviewer-skeptic refute-test → em main synthesize. **15 agent · 1.24M token · ~7m.**
+- **prod-truth** (cicd-monitor) PASS · **schema-integrity** (database-agent) CONCERN (S43 lost-update) · **leave-att-codegen / it-ticket / approvev2-catalogs / master-data-wiring** (investigator-codebase ×4) PASS · **authz-curl** (reviewer) PASS.
+- **6/7 PASS · 1 CONCERN(non-blocker) · 0 blocker · 8 issue → adversarial confirm 6 real, refute 2 false-pos.** Verdict **GO**.
+- **Key insight:** phát hiện đáng giá nhất = **ops/data, KHÔNG phải bug code** — prod phòng IT (CNTT) tồn tại nhưng **0 active user** → ItTicket auto-assign/reassign/SLA-notify inert (test xanh + deploy xanh KHÔNG bắt được "prod chưa provision"; chỉ live-curl + ssh sqlcmd thấy). + master-data idempotency PROVEN (DbInitializer re-run → counts identical).
+- **Containment:** 0 file-write từ 15 agent (MODE-A return-delta), chunk-count 2420 unchanged. P3 harvest: em main APPEND 4 agent-memory.
+
+## WF2 — `golive-harden` (Design→Build→Test→Review∥, 5 agent)
+- **Design (database-agent):** chốt **atomic `ExecuteUpdateAsync` + explicit Serializable tx** cho #3 (ưu tiên NO-migration; reject RowVersion+retry vì re-run MediatR handler awkward + reject plain-Serializable-only).
+- **Build (implementer-backend):** #3 (LeaveOtApprovalFeatures terminal branch) + #5 (ItTicket authz reorder) + #6 (DocxRenderer null-guard). NO migration.
+- **Test (test-specialist):** +12 → 228. 4 LeaveBalanceTests update `.AsNoTracking()` (ExecuteUpdate bypass tracker = stale-tracked-read, không regression).
+- **Review (reviewer ∥ database-agent):** reviewer stage **StructuredOutput-FAIL** (kết thúc không gọi StructuredOutput) → **em main đỡ cross-stack review** (đọc 3 production diff = clean). database-agent **PASS** + 1 MAJOR: tx READ COMMITTED vs convention Serializable + rare auto-create-race → **em main bump `IsolationLevel.Serializable`** (1 dòng, đóng nốt + align). Re-verify build 0-warn + test 228.
+
+## 4 fix
+| # | Issue | Fix | File |
+|---|---|---|---|
+| #3 | LeaveBalance lost-update (S43/DB11) | atomic `ExecuteUpdateAsync(UsedDays=UsedDays+n)` + explicit Serializable tx (NO mig, exactly-once `Status!=DaGuiDuyet:296` nguyên) | `LeaveOtApprovalFeatures.cs:354-405` |
+| #5 | ItTicket existence-oracle | authz Forbidden-trước-NotFound (fail-closed, non-IT nhận 403 cho mọi ticketId) | `WorkflowAppsFeatures.cs:493-510` |
+| #6 | DocxRenderer CS8602 (2 warn) | null-guard MainDocumentPart + Document, deref qua local non-null | `DocxRenderer.cs:27-44` |
+| #4 | Travel/Vehicle ApproveV2 0 test | +4 smoke (Submit→Approve terminal + outsider-Forbidden) | `WorkflowAppApproveV2Tests.cs` + NEW `Forms/DocxRendererTests.cs` |
+
+## Ship + verify
+- Commit `a20cde8` (13 file: 3 BE + 4 test + 6 agent-memory) → push main `bef5825..a20cde8`.
+- 🟩 cicd Run #379 (run_number 265) PASS ~4m20s: test **228** · bundle FROZEN admin `4SUwDLD8`/user `XdKzt9LL` (BE-only verified 3×) · Mig 48 unchanged · `sys.tables`=**93** · health 200 ×3 · endpoint 401 (control route 404 chứng minh auth thật).
+
+## Lessons
+- **Workflow-agent StructuredOutput-fail = class mới** của agent-return-unreliable → em main đỡ qua git-diff/disk truth (extends `feedback_agent_kill_recovery`: external-kill / truncate / **StructuredOutput-non-emission** đều recover qua git/disk/prod, KHÔNG agent return-message).
+- **Workflow-agent self-write MEMORY (G-015 residual):** sub giữ Write dù brief MODE-A "return-delta-only" → implementer-backend/test-specialist/database-agent tự ghi agent-memory mình (placement-correct, không stray) → em main VERIFY sane + bundle harvest commit. H2 GATE bắt **Fidelity gap**: em main định bump-correction nhưng Edit fail (file-not-Read) → skip → 2 entry stale "READ COMMITTED" contradicting shipped Serializable → session-end append correction.
+- **Adversarial tách-vai có ROI:** database-agent review bắt lỗ phụ (auto-create race + lệch convention isolation) mà build+test-xanh KHÔNG thấy.
+- **gotcha #58** NEW: EF read-modify-write lost-update → ExecuteUpdate atomic + Serializable.
+- **sys.tables 92↔93 reconciled:** 93 authoritative (cicd ground-truth Run #379); narrative "92" = under-count cũ.
+
+## Deferred
+- FE redesign Phase 2 (recon ready, scope Budget+designers chờ chốt).
+- 2 ops VPS (gán user IT + tzutil UTC+7) — của anh.
+- root CLAUDE.md count-sweep → monthly audit 2026-07-01.
+- L1 soft-cap trim (cicd/investigator/reviewer ≈30KB) → next curate.