wal: flush 20260712T1757

.claude/agent-memory/investigator-codebase/MEMORY.md

@@ -77,20 +77,18 @@ Bearer từ `POST api.solutions.com.vn/api/auth/login` → status matrix expecte
 
 ## 📅 Recent activity (compressed — full verbatim → `archive/2026-06.md` via `archive/_INDEX.md`)
 
-- **2026-07-07 (S105 BVAAU cross-repo auth RCA — on-behalf em-main B3; #53-garble lần-7 → SendMessage-resume recover):** Task: invest read-only repo BVAAU (Home Google login "đá ra ngoài" + CRM1 guard + Zalo User_ID). Verdict: **Q1 root-cause = FE Home MÙ session** — bundle prod cũ gọi relative `/api` trên site TĨNH (`web.config` loại `^/api/` khỏi SPA-fallback) → `/api/auth/me` 404 → anonymous vĩnh viễn, TRONG KHI hub-side OK hết (state→callback→auto-provision→cookie `bvaau.auth` Domain=`.benhvienaau.com` SameSite=Lax; 7 nghi vấn a-g đều KHÔNG); fix API_BASE-absolute = session-BVAAU commit `51c69fb` 13:45 CÙNG-LÚC điều tra → em-main byte-verify bundle mới Home `CtTKjYz2` + CRM1 `Cr8wJMpn` marker PRESENT = LIVE. **Q2** CRM1 trước đó hở 2 tầng (FE soft-gate + API `enforceCrmGate:false`); FE-redirect-home live 51c69fb; kín API = flip `AUTH_ENFORCE_CRM_GATE=true` chờ anh. **Q3** "User_ID" KHÔNG có trong UI 3 app (duyệt Zalo = StaffCode+Note); `ProviderUserId` backend = identity-map GIỮ (`ApprovePendingLogin.cs:114,141`). Nấc: verified (em-main first-hand git-show + curl byte + config live). Learned: class **"hub tập-trung + site tĩnh: relative `/api` sống dev (Vite proxy), chết im prod"** → auth-hub call luôn absolute-host; garble lần-7 = reasoning-lane, recover mới = **SendMessage-resume khi diary trống** (context sống trong-session). Tag `[s105-bvaau-auth-rca, fe-blind-session, 53-garble-7-resume, cross-repo-readonly]`.
-- **2026-07-06 Supplier 30-field invest+review WF `wf_5ac2cdb0` (anh Kiệt FDC — 🅰️ schema go-live):** ⭐ schema-domain lane **#53-GARBLED (null, "no StructuredOutput")** nhưng full design RECOVERED từ chính AS-10 memory-write của nó (reverted sau harvest — `feedback_agent_return_garble_recover`); em-main authored authoritative schema. **6 ground-truth correction vs brief:** (1) **ClosedXML 0.105.0 = project Excel-standard, KHÔNG phải OpenXml raw** — `csproj:8` + mọi path (`XlsxRenderer.cs:18`/`ContractExcelExporter.cs:56`/`AttendanceReportExcelExporter.cs:14`) dùng `XLWorkbook`; `cell.GetString()` auto-decode shared-string → "shared-string pitfall" MOOT (cả 2 pkg referenced, OpenXml KHÔNG dùng cho read). (2) **reuse-existing-cols > parallel-new-cols** — map TÊN CÔNG TY→`Name`(cũ), ĐỊA CHỈ XUẤT HĐ→`Address`, SĐT→`Phone`; thêm cột MỚI chỉ cho TYPE thật-mới (OfficeAddress/MailingAddress/ContactPhone); tạo companyName/invoiceAddress = ORPHAN cột seed live. (3) **`UpdateSupplierCommand.cs:49-57` blind absolute-set cả 9 incl Note = latent #73 clobber** → import (🅱️) PHẢI ghi entity direct + fill-where-non-empty, KHÔNG route qua Update cmd. (4) **seed idempotent-by-Code (`DbInitializer.cs:2781`) SKIP existing → cột mới NULL** → population = seed **fill-nulls-if-exists** (KHÔNG seed-insert-alone). (5) **`SupplierDto` hand-projected 2 site** (`GetSupplierQuery.cs:21`+`ListSuppliersQuery.cs:48-50` positional, no AutoMapper) → +6-file thread mỗi cột. (6) FE: **`Dialog.tsx:48` đã `max-h-70vh overflow-auto`** → form-expand cần 0 layout-code (go-live win lớn nhất); HoSoLink `toFileUrl`/`PathWithCopy` LOCAL-không-export trong `PeDetailTabs.tsx:2087/2098` → extract shared `ui/PathLink.tsx`. Design chốt: +18 nullable AddColumn (net 89), `SupplierType +CaHai=6` APPEND, new `SupplierStatus` enum nullable, Mig 62. Reviews 3× PASS_WITH_CONCERNS (2 goLiveSafe, import-robustness=false chờ 🅱️). Tag `[supplier-30field, wf-invest, closedxml-not-openxml, reuse-cols, hand-dto-2site, update-blind-set-73, seed-fillnulls, dialog-autoscroll]`.
+- **2026-07-12 (S112+ Supplier-import-v2 LENS-3 FE-dialog-UX invest `wf` fable-clone):** Task R2/R3/R7 FE. Ground-truth: SupplierImportDialog.tsx + SuppliersPage.tsx **SHA-identical 2-app** (`6313529c`/`e9143d93`) — but types/master.ts DRIFTS (fe-user thiếu `Department.parentId` Mig51, Supplier-portion vẫn mirror). Dialog = 2-step preview→confirm, table READ-ONLY (`:284-325`), **round-trips `preview.rows` verbatim** (`:190`+`:132-134`) → per-row edit ĐÃ khả-thi cho R3 (mutate `row.code`→confirm). Confirm gate `errorCount>0` disable (`:191`). **R2:** 0 template endpoint tồn tại; `ExpectedHeaderTokens` 30-token baked `SupplierExcelImportService.cs:35-68` = single-source cho BE-gen .xlsx row-4 (test Case6 chứng round-trip); blob-download precedent `PeDetailTabs.tsx:3273-79` (`api.get responseType:'blob'`+createObjectURL). **R7:** SuppliersPage cols code/name/type/taxCode/phone/actions (`:174-206`) — **KHÔNG có status/public col**; `Supplier` type có `status` (biz-status ≠ public) NHƯNG **0 field isPublic/visibility** (grep⌀) → R4/R7 cần field MỚI. **Mã NCC=Code** (Supplier.cs:7 comment + col4 TÊN-VIẾT-TẮT→Code). ⚠️**authz-mismatch:** import BE `[Roles=Admin,CatalogManager]` (`SuppliersController.cs:64,77`) vs FE btn gate `Suppliers/Create` (mở-all S59) → non-admin thấy nút→403; template sẽ kế-thừa. NO new menuKey/route. Tag `[s112, supplier-import-v2, fe-lens3, sha-mirror-drift-parentId, expectedheadertokens-template, no-ispublic-field, import-authz-mismatch]`.
+- **[→ git+session-log 07-07] S105 BVAAU cross-repo auth RCA:** Q1 root-cause = FE Home MÙ session (bundle cũ relative `/api` trên site TĨNH `web.config` loại `^/api/` → `/api/auth/me` 404 → anonymous); fix API_BASE-absolute `51c69fb` LIVE. Q2 CRM1 hở 2 tầng (FE soft + API `enforceCrmGate:false`) → flip `AUTH_ENFORCE_CRM_GATE=true`. Q3 Zalo "User_ID" KHÔNG có UI. Class **"hub+site-tĩnh relative-`/api` chết im prod"**; #53-garble-7 → SendMessage-resume recover. *(verbatim → archive/2026-07.md)*
+- **[→ 07-12 LENS-3 entry above + git 07-06] S104 Supplier 30-field 🅰️ schema-invest WF `wf_5ac2cdb0`:** SUPERSEDED anchors giữ: ClosedXML 0.105.0 = Excel-standard (KHÔNG OpenXml-raw, `csproj:8`); reuse-existing-cols>parallel; `UpdateSupplierCommand.cs:49-57` blind-set=latent#73; seed fill-nulls-if-exists (`DbInitializer.cs:2781`); `SupplierDto` hand-projected 2-site (`GetSupplierQuery.cs:21`+`ListSuppliersQuery.cs:48-50`); `Dialog.tsx:48` max-h-70vh; extract `ui/PathLink.tsx`. Chốt Mig 62 +18 nullable. *(verbatim → archive/2026-07.md)*
 - **[→ git+session-log 07-03 + adap-reports] S101 H19-adopt Lane-2:** map reviewer=review-gate / investigator=ground-truth-lane; 12-pt tier-checklist ALL✅ (11/11 inherit, C3 no-`[1m]`-in-frontmatter); toggle-marker MUST copy `.gitignore:87` last-match placement; VACUOUS-MET all-inherit+Fable. *(verbatim → archive/2026-07.md)*
 - **[→ git+session-log 07-02 + adap-reports] S100 H18-adopt WF1:** ⭐ ghost-wire-class **config-key-defined-but-unread** (`budget.json:54-55` script re-hardcode same-value→no-flag; catch=grep-key-across-scripts); cron=ghost-wire (CronList=0); `_ledger` orphan-catch 0/15-lifetime. *(verbatim → archive/2026-07.md)*
-- **[→ git+session-log 07-02] S98 verify-lane V2:** detector 28→25, 8 derived-stale=100% FP count-token-soft-net vs canonical 61/89/440/79; grep-gotcha "Fable RESTORED" exact misses README variant ":3 Fable 5 1M RESTORED". *(verbatim → archive/2026-07.md)*
-- **[→ git+session-log 07-01] S97 feedback-audit:** #77/#78/#79 present `gotchas.md:1301/1317/1325`; #53-garble ×6 = cicd MEMORY-self-target ~17.5KB structural-root-cause; Mig 60 wrong-table Approvals→Mig 61 Changelogs both present. *(verbatim → archive/2026-07.md)*
-- **[→ 07-06 entry above + session-log] 2026-07-01 Supplier GAP predecessor:** SUPERSEDED by 07-06 schema-design entry above (same anchors: 9-prop lean, seed-cram→Note, HoSoLink NAS precedent, prod 20-NCC). *(verbatim → archive/2026-07.md)*
-- **[→ `scripts/mfe-eval.ps1` §H + session-log 06-29] S93 MFE ground-truth:** denominator=marks/AS/guards/gotcha dedup-by-AS-xref=29; per-role coverage denom=numbered-anti-pattern numer=diary-match exact-id OR ≥2-content-word (beats leading-verb-giả). *(verbatim → archive/2026-07.md)*
+- **2026-07-12 (S112-b) Supplier import-v2 LENS-4 public/visibility recon (anh Kiệt FDC, RETURN-only):** ⭐ **3 SELECTION consumers ALL hit `GET /suppliers` (ListSuppliersQuery)** → (1) master `SuppliersPage.tsx:83` ×2-app (admin, MUST see draft opt-in) (2) PE add-supplier dropdown `PeDetailTabs.tsx:2222` pageSize=1000 (3) Contract create `ContractCreatePage.tsx:321` pageSize=200. **DISPLAY-of-existing (join by stored SupplierId → MUST NOT filter)**: ContractFeatures:293/392/434 · ContractWorkflowService:168/373 · ContractExcelExporter:44 · GetDashboardStats:42 (TopSuppliers group-over-contracts → draft never appears) · PeFeatures:560/728/874/952 · CreateContractFromEvaluation:63/168. **WRITE-GUARD backstops** (validate-supplier-exists on attach → add draft-reject): `ContractFeatures.cs:64` + `PurchaseEvaluationSupplierFeatures.cs:49`. **NO IsPublic field today**; `SupplierStatus` enum = business (DangHoatDong/Blacklist/NgungHopTac) NOT visibility. **SupplierConfiguration.cs:47/50** = Code unique-filtered `[IsDeleted]=0` + IsRequired + `HasQueryFilter(!IsDeleted)` only. c4 Tên-viết-tắt→Code (SupplierExcelImportService:249) + import HARD-requires Code (:103-108) → conflicts R3 "Mã NCC nhập sau, Excel không có cột". DTO hand-projected 2-site (List+Get). Rec: fail-closed default (GET public-only → dropdowns unchanged, S87/S88-safe) + stored `IsPublic bit`. Tag `[s112b, supplier-visibility, lens4, fail-closed-default, no-global-queryfilter]`.
+- **[all verbatim → archive/2026-07.md] S98 verify-lane (detector 28→25, 8 derived-stale=FP vs canonical 61/89/440/79; grep exact misses README variant) · S97 feedback-audit (#77/#78/#79 `gotchas.md:1301/1317/1325`; #53-garble×6=cicd MEMORY-self-target ~17.5KB; Mig60 wrong-table Approvals→Mig61 Changelogs) · 07-01 Supplier-predecessor SUPERSEDED by 07-06 · S93 MFE denom=marks/AS/guards dedup-AS-xref=29, coverage exact-id OR ≥2-content-word.**
 
-- **PE FROZEN-Mig59 patchwork + go-live recon cluster (S87→S89, 8 entries → `archive/2026-06.md`):** AREA-2 budget-matrix (`SetPeCcmBudgetPeriodCommand` band-aid misplaced in `PeSuggestedPriceFeatures.cs:153-199`; PRO=drafter-flow vs CCM=role-flow authz asymmetry Section-B row3; "Dự án" col intentional FE-only "—") · AREA-3 finalize/price (AllowApproverFinalize AUTO Mig58 + finalizeByCcmDelegation OPT-IN Mig54 coexist, AUTO-first; ApplyApprovedPriceOnFinalize allow-list {Ncc,ProMin,ProMax,Ccm}; isSystem-branch DEAD via public ApproveV2Async) · AREA-4 UpdatePeDraft (**LATENT #73-class BUG:** HoSoLink absolute-set `PurchaseEvaluationFeatures.cs:280` but PeHeaderForm PUT OMITS → clears; 2 PUT call-sites mutually destructive; no HoSoLink-preserve test) · AREA-5 urgent/notify/TZ (SignalR push BYPASSES UtcDateTimeJsonConverter benign-Kind.Utc; urgent SET/UNSET symmetric fail-closed; possible double-notify-then-skip drafter=Cấp1) · AREA-6 FE-consumers (all 6 PE-comp+3 pages SHA-identical 2-app; residual single-winner `PeListPanel.tsx:168` blank ≥2 joint; #70 stale-echo PRO row3/8 no-peFetching) · S89 AllowApproverFinalize-NOTE feasibility (**GAP: BE field MỚI cần** — flag chỉ ở `currentLevelOptions` current-level; approvalFlow+list+dashboard DTO KHÔNG carry → expose `EndsBeforeCeo`+FinalizeStep/LevelName; FE note đầu `PeWorkflowPanel.tsx` flow `<ol>`) · 06-24 3-change (winner=SINGLE `SelectedSupplierId`, winnerQuoteTotal DERIVED 3-site; budget=0 blocked 2-layer; terminal=NEW per-Level bool mirror SkipToFinal) · 06-23 D2/D4/D5 UAT (urgent authz BẤT-ĐỐI-XỨNG gắn-role/gỡ-DeptMgr; PE-create dropdown `PeWorkspaceCreateView.tsx:94`; workflow-required 2-tầng).
-- **2026-06-20 governance-landing map (RC-sig + User-Mark H12/13 + objective-criteria):** ⭐ WHERE-to-land 3 AI_INFRA gov broadcasts. `harness-11-engine.md` = CANONICAL engine (D5/D6/D7 safety-tier + D8 one-direction-lock + D9 single-writer + D10 Bash-residual + CAVEAT no-OS-hook). `error-ledger.md` = §L.a AS-1..13 + §L.b 7-step. adap-report FORMAT richest = `2026-06-18-Governance-harness-11.md`. rules.md §6.6 = objective-criteria. **report-before-stamp ⊂ D7 (extend, đừng duplicate → C3 vocab-fork).** → _INDEX.
-- **2026-06-20 Harness-14 Eval/Budget/Outcome audit:** ⭐ H-14 = time/age/recency-decay KHÔNG được làm căn-cứ cắt feature. (1) BUDGET aligned: `memory-budget.json` 0 decay/TTL/age hit; `keep_floor=5`=newest-protection (drains OLDEST), cap seed-by-MEASURE. (2) detectors = canonical-anchor-vs-STATUS + disk-cross-check, ZERO age-window. (3) EVAL genuine: `eval/golden-set-solution_erp.jsonl` (14q) + `evaluator.md` recall@5≥0.7 — weekly-manual no-automation. (4) anti-downgrade = Harness-8 "all-inherit chất-lượng>chi-phí" PARTIAL (no generic rule in rules.md, grep 0). → _INDEX.
-- **PE recon cluster (S69→S76, → _INDEX):** "Giá chào thầu" mục-c = `WinnerQuoteTotal`=SUM(Quote.ThanhTien WHERE supplier==Selected) DERIVED (3 nơi đồng-predicate) — PRO-Min/Max+CCM-proposed = Mig 54 NEW field. **Budget gate = PURE ROLE no-phase** (`canEditPro=Admin||Procurement`/`canEditCcm=Admin||CostControl` `PurchaseEvaluationFeatures.cs:800-801`; comment "bảng NS=tài-liệu-sống như Excel"); **submission-count-lock NEXISTS** (grep 0) → "khóa Initial sau lần-trình-đầu" = feature-MỚI. **Value-threshold HOOK B** = `ApproveV2Async` advance `:816-845` (reuse skipToFinal mechanic); **urgent flag** = AddColumn mirror `ItTicketPriority`. Badge ✎NS = +2 bool DTO via `GetUsersInRoleAsync` batch (no-N+1) both sites. PRO/CCM/CEO = `Procurement/CostControl/Director` (domain-shorthand NOT constants); V2 routing IGNORES roles (= specific ApproverUserId), 100% LINEAR no value/threshold config.
-- **Office/HRM recon cluster (S65→S69, → _INDEX):** 21 `Off_*` keys, 10 office pages `{fe-admin,fe-user}/src/pages/office/` SHA256-mirror (except MyAttendance + AttendanceReport admin-only); golive-flip = remove `RevokeTemporarilyHiddenModulesAsync` call `DbInitializer.cs:2040`. Employee **master-detail EXISTS** (not list-only), Dept FLAT no-tree (pre-Mig51), 5 satellite 15-endpoint full. NamGroup **PURO = UI-skin** (ref demo.purocorp.vn) hardcoded-navTree, KpiCard-not-tab, shared PageHeader/WidgetCard. **gotcha #66:** `index.css h1-4{color:#0b1220}` OUTSIDE @layer → TW-v4 unlayered wins → heading-in-gradient MUST `text-white!`.
+- **PE FROZEN-Mig59 patchwork + go-live recon cluster (S87→S89, 8 entries verbatim → `archive/2026-06.md`):** key catches — AREA-4 **LATENT #73-class BUG** HoSoLink absolute-set `PurchaseEvaluationFeatures.cs:280` but PeHeaderForm PUT OMITS→clears (2 PUT mutually destructive, no preserve-test) · AREA-3 AllowApproverFinalize AUTO(Mig58)+finalizeByCcmDelegation OPT-IN(Mig54) coexist AUTO-first, ApplyApprovedPrice allow-list {Ncc,ProMin,ProMax,Ccm} · AREA-2 budget-matrix band-aid `PeSuggestedPriceFeatures.cs:153-199` PRO=drafter vs CCM=role authz-asymm · AREA-6 FE all 6-comp+3-pages SHA-mirror 2-app, #70 stale-echo · S89 AllowApproverFinalize-NOTE **GAP BE-field-MỚI** (flag only `currentLevelOptions`, DTO no-carry→expose EndsBeforeCeo) · 06-24 winner=SINGLE `SelectedSupplierId` derived-3-site, terminal=per-Level bool · 06-23 urgent authz asymmetric, PE-create dropdown `PeWorkspaceCreateView.tsx:94`.
+- **2026-06-20 governance recon (both → archive/_INDEX):** (a) landing-map — `harness-11-engine.md`=CANONICAL engine (D5/6/7 safety-tier+D8 one-dir-lock+D9 single-writer+D10 Bash-residual+CAVEAT no-OS-hook); `error-ledger.md`=§L.a AS-1..13+§L.b 7-step; rules.md §6.6=objective-criteria; report-before-stamp ⊂ D7 (extend not duplicate→C3 vocab-fork). (b) Harness-14 = age/recency-decay KHÔNG căn-cứ cắt feature; `memory-budget.json` 0 decay `keep_floor=5`=newest-protect drains-OLDEST; detectors canonical-anchor-vs-STATUS+disk 0 age-window; EVAL `golden-set-solution_erp.jsonl` 14q recall@5≥0.7 weekly-manual; anti-downgrade=H8 all-inherit PARTIAL (no generic rule grep 0).
+- **PE recon cluster (S69→S76, verbatim → _INDEX):** "Giá chào thầu" mục-c=`WinnerQuoteTotal`=SUM(Quote.ThanhTien WHERE supplier==Selected) DERIVED 3-site; Budget gate=PURE ROLE no-phase (`canEditPro/Ccm` `PurchaseEvaluationFeatures.cs:800-801`); submission-count-lock NEXISTS (grep 0); Value-threshold HOOK B=`ApproveV2Async :816-845`; PRO/CCM/CEO=`Procurement/CostControl/Director` shorthand; V2 routing IGNORES roles (=ApproverUserId) 100% LINEAR.
+- **Office/HRM recon cluster (S65→S69, verbatim → _INDEX):** 21 `Off_*` keys, 10 office pages `{fe-admin,fe-user}/src/pages/office/` SHA-mirror (exc MyAttendance+AttendanceReport admin-only); golive-flip=remove `RevokeTemporarilyHiddenModulesAsync` `DbInitializer.cs:2040`; Employee master-detail EXISTS, Dept FLAT pre-Mig51; NamGroup PURO=UI-skin hardcoded-navTree; **gotcha #66** `index.css h1-4{color}` OUTSIDE @layer→TW-v4 unlayered wins→heading MUST `text-white!`.
 - **Governance/Harness recon cluster (S71, → _INDEX):** H8 all-inherit FULLY adopted both layers (12/12 frontmatter + hmw.js resolveModel); **run-trace "TRACKED" = 2-level** (`git check-ignore` eligible vs `git ls-files` committed — model works only post `git add`); G-015 containment shift (Harness-2 "mọi tracked=vi-phạm" → H10 "tracked NGOÀI run-folder+code-disjoint=vi-phạm"). **path-trap:** bare `runs/` from repo-root = 0 → actual `.claude/workflows/runs/` (22 tracked). detector refine(b) = `.claude/hooks`/`.claude/scripts` not-exist (now S75 has `scripts/governance-detectors.ps1`).
 - **[→ git pre-S60]** S60 recon#2 V2-engine-map (ApproveV2Async:446-634 guard+UPSERT+advance; skipToFinal F2:561-602 precedent) · S60 PE Section-3 submit-guard ROLE-only. Full text git.
 - **[→ archive/2026-06.md + git]** S52 P11-D/E/F 6-gap recon · S50 HrmConfigs add-kind 11-spot · S51 gotcha #57 EXT reachability (curated S59).