[CLAUDE] Docs: S22 chốt — Plan C+D+E done, Plan F ABORTED + 3 agent MEMORY drift patch

Session 22 final docs:
- STATUS Last updated S22 + S21 chốt cuối preserved row (§6.5 KEEP narrative)
- HANDOFF Last updated S22 + S21 row preserved
- Session log mới `2026-05-13-1800-s22-plan-cde-test-strict-v2.md` (260 LOC)
  + narrative 4 plan + pre-flight evidence + lessons learned

Cross-agent sync (start-of-session): 3 agent MEMORY.md drift patch
(KHÔNG cắt narrative — chỉ count update):
- investigator/MEMORY.md: 27→29 mig + 81→84 test + 44→46 gotcha + 16→19 memory
  + Mig 28/29 narrative ngắn + Gitea API discovery cross-ref
- implementer/MEMORY.md: test baseline 81→84
- reviewer/MEMORY.md: 81→84 test + 44→46 gotcha + Mig 29 per-NV scope line

CICD Monitor MEMORY.md đã fresh từ S21 t5 — KHÔNG đụng.

Plan F ABORTED reason:
- Contract entity HOÀN TOÀN V1 (no ApprovalWorkflowId column)
- Prod 23 PE + 4 V1-only PE + 7 Contract pin V1
- Drop V1 BE crash startup → defer sau Plan B Contract V2 wire

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.claude/agent-memory/investigator/MEMORY.md

@@ -43,7 +43,7 @@ Common queries: `sys.columns`, `sys.triggers`, `__EFMigrationsHistory`, `COUNT(*
 - Grep `// Mock` / `alert(` / `setEditing(null) // close UI` — wire claim bugs
 
 ### Pattern: Memory cross-reference
-16 memory entries tại `C:\Users\pqhuy\.claude\projects\D--Dropbox-CONG-VIEC-SOLUTION\memory\` (S20 +2 turn 11/12):
+19 memory entries tại `C:\Users\pqhuy\.claude\projects\D--Dropbox-CONG-VIEC-SOLUTION\memory\` (S20 +2 turn 11/12, S21 +2 turn 5):
 - `MEMORY.md` — index
 - `project_solution_erp.md` — cumulative narrative S1-S17
 - `feedback_per_chunk_commit.md` — 5-chunk A-E discipline
@@ -59,7 +59,10 @@ Common queries: `sys.columns`, `sys.triggers`, `__EFMigrationsHistory`, `COUNT(*
 - `feedback_user_manual_style.md` — non-tech docs style
 - `feedback_node_cicd.md` — Node 20.x pin
 - `feedback_responsive_laptop_breakpoint.md` — 4-tầng responsive pattern (S20 t11)
-- `feedback_multi_agent_setup.md` — 3 sub-agents setup discipline (S20 t12)
+- `feedback_multi_agent_setup.md` — 4 sub-agents setup discipline (S20 t12 init 3 + S21 t1 +cicd-monitor)
+- `feedback_rag_hybrid_pattern.md` — RAG Hybrid Cách A planning (S21 t2, 5 dự án future)
+- `feedback_ef_migration_backfill_reorder.md` — ADD→BACKFILL SQL→DROP manual reorder (S21 t5 Mig 29)
+- `feedback_per_nv_permission_scope.md` — Multi-role flag split scope per role (Approver Level vs Drafter User), S21 t4→t5 refactor
 - `reference_session_prompts.md` — canonical session start template
 
 ### Pattern: External research priority sources
@@ -83,15 +86,16 @@ Common queries: `sys.columns`, `sys.triggers`, `__EFMigrationsHistory`, `COUNT(*
 
 ## 🧠 SOLUTION_ERP context essentials (auto-load)
 
-- **DB Dev:** `SolutionErp_Dev` LocalDB (59 tables / 27 migrations / Mig 27 latest `AddVisibilityAndDisplayLabelToMenuItems`)
+- **DB Dev:** `SolutionErp_Dev` LocalDB (59 tables / 29 migrations / Mig 29 latest `RefactorAdvancedOptionsToPerLevelAndDrafterUser`)
 - **DB Design:** `SolutionErp_Design` (ef tooling distinct)
-- **DB Prod:** `.\SQLEXPRESS` / `SolutionErp` / `vrapp` user via SSH `vietreport-vps`
+- **DB Prod:** `.\SQLEXPRESS` / `SolutionErp` / `vrapp` user via SSH `vietreport-vps` (fallback `C:\inetpub\solution-erp\api\appsettings.Production.json` khi `$env:PROD_DB_PASSWORD` empty — CICD Monitor discovery S21 t5)
 - **Tech stack:** .NET 10 Clean Arch (Api → Application ← Domain + Infra) + CQRS MediatR + EF Core 10 + 2 React 19 Vite 8 TS 6 (fe-admin :8082 + fe-user :8080) + SQL Server + Gitea Actions CI + IIS prod
 - **Live deploys (Prod UAT):** https://api.solutions.com.vn · https://admin.solutions.com.vn · https://eoffice.solutions.com.vn
 - **Gitea remote:** https://git.baocaogiaoduc.vn/vietreport-admin/solution-erp
+- **Gitea Actions API:** path `/api/v1/repos/.../actions/tasks` (NOT `/actions/runs` — 404). Cache stale ~2 min (gotcha #46) — cross-check VPS file mtime
 - **SSH VPS:** `ssh vietreport-vps` (config `~/.ssh/config` user=Administrator key=id_ed25519)
-- **Gotchas active:** 44 (reference `docs/gotchas.md`)
-- **Tests baseline:** 81 PASS (58 Domain + 23 Infra) — Phase 9 UAT skip per chunk (memory `feedback_uat_skip_verify`)
+- **Gotchas active:** 46 (reference `docs/gotchas.md`)
+- **Tests baseline:** 84 PASS (58 Domain + 26 Infra) — Phase 9 UAT skip per chunk (memory `feedback_uat_skip_verify`)
 - **Master HEAD reference:** check via `git log -1 --format='%H'`
 - **6 skills:** `contract-workflow` · `permission-matrix` · `form-engine` · `ef-core-migration` · `dependency-audit-erp` · `iis-deploy-runbook`
 
@@ -100,10 +104,22 @@ Common queries: `sys.columns`, `sys.triggers`, `__EFMigrationsHistory`, `COUNT(*
 ## 🔄 Active workflow schemas (V1 + V2 coexist post-Session 17)
 
 - **V1 Mig 21 flat workflow** — `WorkflowDefinition` pin với PE/Contract cũ. Match Dept+PositionLevel.
-- **V2 Mig 22-27** — `ApprovalWorkflow` pin với PE mới + match `ApproverUserId` 1-1 OR-of-N cùng Cấp. Steps (Phòng) > Levels (Cấp). PE đã wire V2. Contract V2 PENDING Session 21+.
+- **V2 Mig 22-29** — `ApprovalWorkflow` pin với PE mới + match `ApproverUserId` 1-1 OR-of-N cùng Cấp. Steps (Phòng) > Levels (Cấp). PE đã wire V2. Contract V2 PENDING (Plan B).
+  - **Mig 25** IsUserSelectable (admin pin/unpin per workflow cho user pick)
+  - **Mig 26** PE Level Opinions UPSERT (service hook khi Duyệt)
+  - **Mig 28** (S21 t4) 6 Allow* workflow-level — **REPLACED by Mig 29**
+  - **Mig 29** (S21 t5) Allow* refactor per-NV: 5 flag on `ApprovalWorkflowLevels` (F1+F3 per Approver slot) + 1 flag on `Users.AllowDrafterSkipToFinal` (F2 per Drafter)
 
 State machine 5 trạng thái phiếu PE: Nháp / Đã gửi duyệt / **Trả lại (TraLai=98)** / Từ chối / Đã duyệt.
 
+**Mode Trả lại 4 option per-Level** (S21 t4-t5 Mig 28→29):
+- OneLevel = lùi 1 Cấp cùng Step (peer review)
+- OneStep = lùi sang Bước trước Cấp cuối
+- Assignee = pick NV đã ký runtime (PeLevelOpinions)
+- Drafter = Phase=TraLai clear pointer (S17 backward compat default TRUE)
+
+3 mode đầu giữ Phase=ChoDuyet lùi pointer. Mode Drafter giữ Phase=TraLai. Admin bypass `level.Allow*` flag.
+
 ---
 
 ## 📅 Recent activity (last 10 FIFO)