wal: flush 20260712T1454

.claude/agent-memory/implementer-frontend/MEMORY.md

@@ -6,6 +6,13 @@
 
 ---
 
+## 🆕 2026-07-12 — Supplier import Excel FE (Phase B Approach A) ×2 app byte-identical (lead chốt UX; BE done+450 tests)
+NEW `components/master/SupplierImportDialog.tsx` (folder `master/` MỚI cả 2 app) + wire `pages/master/SuppliersPage.tsx` (nút "Import Excel NCC" outline cạnh "Thêm NCC" trong PageHeader actions flex + render dialog). KHÔNG 4-place mirror — dialog trên page ĐÃ routed → no new route/menuKey/Layout.
+- **Flow:** .xlsx → POST `/suppliers/import/preview` multipart field `file` → preview. `layoutValid===false`→alert đỏ+warnings, ẩn nút xác nhận. Else: badge counts (New/Update/Skip/Error) + warnings amber + `<table>` raw (Dòng·StatusBadge·Mã·Tên·Loại·Thông báo). "Xác nhận nhập" disabled `errorCount>0` → POST `/import/confirm` body `{rows}` = echo `preview.rows` VERBATIM. committed→toast+`invalidateQueries(['suppliers'])`+close; !committed→alert `errors[]`.
+- **BE contract (Read-only DTO):** enum serialize = **INT** (chỉ UtcDateTimeJsonConverter đăng ký, KHÔNG JsonStringEnumConverter) → `type` 1-6 reuse `SupplierTypeLabel`, `status` RowImportStatus 0-3 const-object; camelCase wire (default web JSON); confirm bind positional record `(IReadOnlyList Rows)`. Round-trip 30 field verbatim → TS type partial vẫn OK runtime.
+- **Mirror lesson (tái xác nhận S97-badge):** Dialog (fe-user gradient title bar) + PageHeader + types/master (khác MỖI `Department.parentId` admin-only S65) ĐỀU DIVERGED 2 app — NHƯNG import alias-path `@/…` + symbol-signature giống → new file VẪN byte-identical. Byte-identical SuppliersPage cũ (build 2 app) = proof mọi symbol tương thích. UI: KHÔNG shadcn Badge/Alert/Table primitive (chỉ PhaseBadge) → inline Tailwind badge/alert + `<table>`. Multipart = pattern `ContractAttachmentsSection` (FormData + `Content-Type: multipart/form-data`).
+- **SHA256 ×2 pair:** SupplierImportDialog `6313529c…`, SuppliersPage `e9143d93…`. Build PASS ×2 (admin 1950mod `index-DyOk34HV.js` 19.5s / user 1939mod `index-DXK9ebaz.js` 8.75s, 0 TS err). Pre-existing warn: @import CSS-order + >500KB + realtime.ts dynamic. NO BE touch. Full precedent. Tag `[supplier-import-excel, multipart-preview-confirm, enum-int-wire, byte-identical-2app, no-4place-dialog-on-routed-page]`.
+
 ## 🆕 S97-badge (2026-07-01) — PE chip "✅ Đã được CEO duyệt" khi phiếu ĐÃ DUYỆT đi hết lên CEO (anh Kiệt FDC UAT, em-main chốt)
 FE-ONLY, PROD LIVE. Đối xứng fix endsBeforeCeo (Mig 60). EDIT1 mở rộng `PeFinalizeChip.tsx` (2 app) + EDIT2 wire `phase={p.phase}` ở 6 call-site.
 - **EDIT1 component:** +prop `phase?` + nhánh: `if(!endsBeforeCeo){ if(phase===DaDuyet) return emerald "✅ Đã được CEO duyệt"; return null }` else giữ violet "⚑ Kết thúc·X". Import `PurchaseEvaluationPhase` từ `@/types/purchaseEvaluation` — **cùng alias 2 app** → byte-identical (KHÔNG ngoại-lệ import-path). SHA256 IDENTICAL ×2 = `da9c3ed9…`.

.claude/agent-memory/reviewer/MEMORY.md

@@ -13,6 +13,7 @@
 - **S101 H18 WF2 governance re-run** — PWC; detector fault-inject 4/4; lesson: exact-token sweep misses paraphrased labels → widen concept-phrase khi retire named artifact; #53 garble recovered first-hand. → `archive/2026-07.md`.
 - [S103 H20+crystallized-backfill review](project_s103_h20_crystallized_backfill_review.md) — WF2 PASS (fable-clone ensemble); 6/6 hash recompute MATCH + 4 already-met verified file:line. **Lesson: multi-axis warning phải nằm trong OUTPUT của script, không chỉ doc** — reader chạy script inline.
 - **S101 H19 WF2 review LANE-C (adap-reports+honesty)** — PASS; 4 hash recompute MATCH; hex→SHA = recompute CẢ strip/no-strip chứng content-hash ≠ commit-SHA. → `archive/2026-07.md`.
+- [S111 PE sign-off 6-decision design review (schema/history lens)](project_pe_signoff_history_schema_review.md) — GO-WITH-ADJ; Decision-5 opinion-history: RECOMMEND (a) append-only table, REJECT (b) version-col (drops UNIQUE + breaks UPSERT read every site), (c) Changelog zero-mig fallback. Hook @ ApproveV2Async UPSERT :784-790. Decision-3 caller-safe (SlaExpiryJob=Contract-only, not PE). A1 breaks 4 bypass tests.
 
 ---
 
@@ -89,9 +90,10 @@ Adversarial pre-commit reviewer SOLUTION_ERP. Read-only verify + live curl prod
 - **S88 (2026-06-25) Fidelity-gate L2 gist distill (test-specialist) — FAIL (1 fabrication-by-merge):** gist gán "Mig 45" cho cluster span 2 episode khi chỉ 1 mang số đó (Master = Mig 47). Anti-pattern: merge-distill fabricates false specificity; token-PRESENCE pass BLIND to cross-episode mis-attribution → QUALITY gate after presence gate. Detail → `archive/2026-06.md`.
 
 - **2026-07-10 (S108 first-real-run H19) `[fable-real-single]`** — **FAIL** (1 CRITICAL + 4 MAJOR + 6 minor; em-main 37-fix cùng phiên): email claim “đã sửa comment” khi hmw.js chưa sửa. Lesson: doc assemble-từ-N-worker → grep stale-claim theo CLASS toàn file sau fix đại diện; mọi outward-claim “đã sửa X” phải cat X trước gate. → `archive/2026-07.md`.
-- **2026-07-10 (S109 sleep-recovery P3b fidelity-gate 2 gist L2 tooling-auditor + harvest-curator) `[fable-real-single]`:** **PASS_WITH_FIXES** (3 fix, 0 re-distill): (1) gist-2 meta-count "15 entry" ≠ disk 14 — count COPY từ brief, không đếm disk; (2) delta tự-tính "+8.8KB" cạnh cặp 32.2→41.1 (=8.9) — **self-computed derivative = lớp false-specificity MỚI** ngoài S88 merge-mis-attribution; (3) N/A-justification "(resolved monthly S96)" over-claim — ERD-debt §16+ CÒN pending (root CLAUDE.md), chỉ "(55)" resolved → **fact-claim trong N/A-note verify như content**. Bịa=0 ("S49" vượt-verbatim nhưng TRUE — chéo reviewer `_INDEX.md:28`); đảo-nghĩa=0 ("suýt" giữ ×2); drop-oan=0; 3 self-flag honesty NGUYÊN; pointer 10/10 unique+đúng-entry. Lesson: gist-metadata + số-tự-tính + drop-justification = 3 bề mặt lỗi máy token-coverage mù. Return Verdict-header dòng-1, 0 garble.
-- **2026-07-12 (S111 H22 WAL session-continuity adopt cổng-cuối, working-tree + 2 commit `wal:`) `[engine: fable-real-single · Fable-S111]`:** **PASS_WITH_FIXES** (0C/1M/~7m). Fault-inject cây tạm 2 ca PASS (1-path-vắng → commit 2-path-còn exit-0, không nuốt ngoài-whitelist; 0-delta im lặng — bịt đúng nhánh lead chỉ "quan sát tự nhiên"). CATCH M-duy-nhất: engine CAVEAT còn "STAGED-until-verified" trong khi N.3 CÙNG FILE đã nâng VERIFIED-RUNTIME — lớp lỗi **nâng-nấc-quên-sync-câu-cũ cùng-diff**. Lesson mới: (1) **live-witness > forensics > lời-khai** — commit `67be443` sinh GIỮA lúc mình đang review (status→diff lệch 3 path) = tự chứng kiến hook fire, không cần tin claim; (2) **NTFS CreationTime × commit-time phân định script-RUN-tay vs hook-FIRE** — commit 11:05:39 rơi GIỮA cửa sổ worker-write (ps1 :32 → pause.md :48) → không thể là tay; (3) WAL `updated:` lead tay-ghi đi TRƯỚC commit-time 47-61' → field máy-đọc phải sinh từ `Get-Date` thật, không ước — false-positive cảnh-báo phiên-song-song /tiep; (4) PATH 3-context data-point: PS-của-mình trả Git-Bash (spawn từ bash, env-inherit) ≠ lead đo WSL-system32 — KHÔNG mâu thuẫn, càng chứng exec-env bất-định → PS1 path-independent đứng. Return verdict-header dòng-1.
-- **2026-07-11 (S110 H21+MTv3 adopt cổng-cuối, uncommitted 13-file) `[fable-real-single]`:** **PASS_WITH_FIXES** (0C/5M/~9m). Sàn-5-điểm + 4-note a-d + MTv3-4-vế ĐỦ trên bề mặt chính (2 command + 0.5b/0.6 + engine K.E); X1 hmw nguyên; marker xóa; X8 sạch (mọi "code-enforced" negated). CATCH: (1) worker đổi-fact khi reword — fable-clone:33 "VALID_ROLES nhận cả 12 vai" nhưng hmw.js:22-28 = **10** (engine K.C nói đúng 10) → **claim-về-code trong doc phải grep code lại kể cả khi chỉ reword**; (2) roster-12 promise × VALID_ROLES-10 → lệnh-B 2 vai monitor degrade DEFAULT-subagent silent (hmw.js:104 fail-soft, mất persona+memory-pack) — floor mới EXPOSE edge code cũ mà H19 2-vai-cố-định che khuất; (3) point-edit sót cụm GIỮA-section: runbook §5.1 P5 "EXCLUDED all-but-2" đối đầu P0-mới roster-12 CÙNG checklist; §4.2 fixed nhưng mirror §3.2/§3.3 MISS (asymmetric-mirror-edit); §2.5 q1/q3+bảng marker nguyên un-🧊; (4) 3 supersede-note trỏ 2 adap-report CHƯA tạo = dangling-pointer + outward chưa qua gate. Lesson: sweep hậu-supersede phải đi theo CONCEPT-cluster từng section — acceptance token-hẹp ("Test-Path ngoài 🧊 = 0") PASS trong khi semantics cũ còn nguyên cụm. #53 garble lượt return (status-line thay verdict) → coordinator re-emit request trong-session = recover OK, diary ghi trước re-emit.
+- **2026-07-10 (S109 fidelity-gate 2 gist L2) `[fable-real-single]`:** **PASS_WITH_FIXES** (3 fix): (1) gist meta-count "15" ≠ disk 14 (count COPY brief không đếm disk); (2) delta tự-tính "+8.8KB" cạnh 32.2→41.1 (=8.9) = **self-computed derivative = false-specificity MỚI** ngoài S88; (3) N/A-just "(resolved S96)" over-claim ERD-debt §16+ pending → **fact-claim trong N/A-note verify như content**. Lesson: gist-metadata + số-tự-tính + drop-just = 3 bề mặt token-coverage mù. → `archive/2026-07.md`.
+- **2026-07-12 (S111 H22 WAL adopt cổng-cuối) `[fable-real-single]`:** **PASS_WITH_FIXES** (0C/1M). Fault-inject cây tạm 2 ca PASS; CATCH engine CAVEAT "STAGED" còn khi N.3 cùng-file đã nâng VERIFIED-RUNTIME = **nâng-nấc-quên-sync-câu-cũ cùng-diff**. Lessons: live-witness>forensics>lời-khai (commit sinh GIỮA review = tự chứng hook fire); NTFS CreationTime×commit-time phân-định RUN-tay vs hook-FIRE; PATH 3-context bất-định → PS1 path-independent. → `archive/2026-07.md`.
+- **2026-07-11 (S110 H21+MTv3 adopt cổng-cuối) `[fable-real-single]`:** **PASS_WITH_FIXES** (0C/5M). CATCH: (1) worker đổi-fact khi reword — doc "VALID_ROLES 12 vai" nhưng code=10 → **claim-về-code phải grep lại kể cả chỉ reword**; (2) roster-12×VALID_ROLES-10 → 2 vai monitor degrade DEFAULT silent (floor mới EXPOSE edge code cũ); (3) point-edit sót cụm GIỮA-section + asymmetric-mirror-edit §3.2/§3.3; (4) supersede-note trỏ adap-report CHƯA tạo = dangling. Lesson: sweep hậu-supersede theo CONCEPT-cluster; #53 garble return → in-session re-emit recover. → `archive/2026-07.md`.
+- **2026-07-12 (S112 PE sign-off approach-review PRE-fan-out+deploy, security/governance lane) `[fable-real-single]`:** **GO-WITH-ADJUSTMENTS.** (1) EDGE-5 decision-3 hard-lock: spec placement (reject-branch SVC:92 + EnsureCanReject:321 + handler) **INCOMPLETE — bỏ sót admin-override path SVC:290** (`if(isAdmin) evaluation.Phase=targetPhase`) → admin un-terminal DaDuyet bằng decision=Approve (KHÔNG qua reject). Fix = 1 guard TOP-of-method sau `var fromPhase` SVC:53. Lesson: **terminal-lock gác FROM-state ở ĐỈNH method, KHÔNG rải per-branch** (per-branch bỏ sót admin/fall-through). (2) CEO-skip decision-2: A1 (creator tự ký ô mình thay auto-bypass) **TẠO đường CEO-skip MỚI** multi-step-có-CEO — trước A1 bypass advance-qua slot creator (bỏ check finalize); sau A1 creator qua ApproveV2Async → slot có `AllowApproverFinalize`=true + tick → DaDuyet bỏ CEO (SVC:867). invest-C "đã tồn hôm nay" IMPRECISE (chỉ đúng 1-step-no-CEO). Escalate owner. Lesson: **đổi auto-advance→manual-approve = mở lại per-slot flag mà auto-path che khuất** — re-scan flag khi đổi ai-đi-qua-code-nào.
 
 ---
 

.claude/agent-memory/reviewer/archive/2026-07.md

@@ -16,3 +16,21 @@
 - **S101 H19 fable-clone WF2 Lane-A (toggle mechanism) — PASS_WITH_CONCERNS (1 CONCERN, 0 BLOCKING):** 3 Lane-A asks all CONFIRMED — (Q1) `/fable-real`=Write · `/fable-clone`=Remove-Item mirror ultra-on/off, both carry no-hot-reload warning; (Q2) semantic INVERSE (marker-absent=ảo-DEFAULT · present=thật) consistent across 8 statements + `git check-ignore .claude/fable-real-mode.on`=IGNORED (line 92 AFTER `!.claude/**` neg line 83, verified `check-ignore -v`) + tracked cmd-file NOT-ignored; (Q3) GAP-1 scope-guard "N lane CÙNG 1 vai, KHÔNG mixed-roster" pinned in BOTH cmd-files + §K.C, and hmw.js VALID_ROLES independently confirmed = all 9 roles no 2-position gate (resolveModel unrestricted) → GAP-1 leak framing ACCURATE not fabricated. **CONCERN (refutation that landed):** marker is a WRITE-ONLY dead artifact — `/fable-real.md:10` claims "Mode persist qua marker → SỐNG qua session/compact" but NOTHING reads `fable-real-mode.on`; `/session-start` BƯỚC 0.5 reads only `hmw-mode.on` and was NOT extended (session-start.md unmodified in git status, empty grep for any reader). Write half-loop exists, read→report→route half-loop absent → wording overstates mechanism. Non-blocking because vacuously-met-today (all-inherit → 2 positions ALREADY top-model → 0 runtime-delta; toggle manual/owner-driven by design) — bites only when Fable returns + tiering resumes. **Anti-pattern: mirror-a-toggle copies the WRITER side but silently drops the READER side** — a persist-claim needs BOTH write-on-set AND read-on-session-start; verify the consumer exists, not just the producer. Vacuously-met disclosure itself was clean (§K.D + mark both say "KHÔNG overclaim runtime-delta"). *(dời từ Role-baseline @S102 — H2 Placement-flag; NOTE @S102: reader BƯỚC 0.5b ĐÃ wire tại S101-cuối → CONCERN closed, marker có consumer.)*
 - **S100 H18 WF2 synthesis + Lane-B** — SYNTHESIS reviewer 2-lane JSON→overall **PASS_WITH_CONCERNS** (LaneA PASS + LaneB PWC, neither BLOCKING). Re-verified indep: ledger +2/0-del revert-clean · ratio-band replaced `|diff|>=10` · glob replaced 3-fixed-list · 6/6 consumers 🧊-marked · every LIVE `_ledger` marked (unmarked=history) · CONCERN workflows/README:51 no-token points-authoritative=non-block · KEY anti-pattern HELD (stale WF2 `wf_31ea3985` NOT stamped, both placeholders await fresh run). Prior S100-bis Lane-B PASS (2 minor) folded in.
 - **2026-07-10 (S108 first-real-run H19) `[engine: fable-real-single · Fable-S108]`** (em-main harvest B3, GAP-2/3): Task single-deep-pass adversarial 3 artifact S108 (runbook 58.7KB + adap-request + email outward — $outwardFlag=Y Cat-6). Verdict **FAIL** — 1 CRITICAL (email claim “đã sửa comment” khi hmw.js:31-32 chưa sửa, cat xác nhận) + 4 MAJOR (2 stale-outage-claim sót §3.5/§4.3 · clone-example thiếu tier:'opus' trái K.B/floor-2 khi Fable UP · AP-4 tự-toggle trái K.D-2 · drift-note 9-vai sai vs engine-10) + 6 minor; core JSON-shape/biến/checklist/GAP-guard **SOUND** (7 refutation: 5 đứng · 2 vỡ về phía artifact). Learned: doc assemble-từ-N-worker → grep stale-claim theo CLASS toàn file sau khi fix đại diện (header “đã sửa 6” ≠ sửa hết) · mọi outward-claim “đã sửa X” phải cat X trước gate. Surprise: đoạn drift-note (viết để cảnh báo drift) là chỗ duy nhất mô tả sai canonical. Em-main áp 37-fix + vá hmw.js thật → verdict-fixes closed cùng phiên. Return dòng-1 Verdict-header chuẩn, 0 garble.
+
+---
+## S112 curate (self, 2026-07-12, hook 20.5KB) — collapsed 2026-06 digest cluster from L1 Recent-activity (verbatim below; detail already in 2026-06.md / linked area files)
+
+- **2026-06-29 S93 Harness-16 MFE adoption review (WF2 `wf_13e3d35a` 3-lane PASS 0-blocking):** ⭐ code-gate re-derived denom-29 + leading-verb-trap DEFEATED (`NEVER commit push`→0 content-word) + READ-ONLY-budget proof (1 write-op `.mfe-state.json`); WF1-reviewer caught BLOCKING vocab-fork (memory-fidelity H6.7≠H16 → MFE+alias-map §H). Detail → adap-report harness-16-mfe. → _INDEX.
+- **S92 (2026-06-29) Adversarial PROD-security hide 5 menu-groups admin-only on eoffice (uncommitted) — PASS (0 blocking, 1 awareness note):** A-E all upheld; CatalogManager Danh-mục access stripped (intended-by-spec, role assigned to 0 users post-S89, flag em-main only). Detail + per-attack file:line → project_s92_admin_only_modules_revoke.md.
+- **S91 (2026-06-25) PE D2 create-contract 1→N multi-winner + winner-names (FROZEN, NOT-deployed) — PASS:** fix for S89-bis dead-end; codegen mid-loop SaveChanges flushes ONLY seq-row (contract built LOCAL); GiaTri per-winner Quote-sum join PES.Id; positional DTO arg-order verified 3 sites; FE mirror byte-identical; 419 PASS. Detail → `archive/2026-06.md`.
+- **S90 (2026-06-25) PE stability-fix batch D1 (5 chg+11 test, FROZEN) — PASS:** Block B re-key SelectedSupplierId→IsWinner (single unchanged proven); CEO-notify SaveChanges (was Add-but-never-flush); HoSoLink null-safe+clear-via-empty option(b); #70 ||peFetching 2 PRO cells; 413 PASS. Detail → `archive/2026-06.md`.
+- **S89-bis (2026-06-25) AREA-6 FE-consumers (PE FROZEN, investigator verify) — 4/4 confirm + 1 NEW miss:** all 4 hold; NEW catch = create-contract joint-winner DEAD-END (FE shows button on `some(isWinner)` but BE hard-blocks `SelectedSupplierId is null`). Anti-pattern: single→multi conversion stops at detail-display layer. Detail → `archive/2026-06.md`.
+- **S89 (2026-06-25) AREA-4 workflow-edit (PE FROZEN, investigator verify) — 3 confirm/1 do-not-touch:** HoSoLink #73-class clear-on-partial-edit CONFIRMED + NEW 2nd destructive call-site (PeDetailTabs:817 InfoTab.save omits hoSoLink). Anti-pattern: echo-all-siblings convention rots when NEW absolute-set field added. Detail → `archive/2026-06.md`.
+- **S86 (2026-06-24) PE Section B 3-cột Dự-án|PRO|CCM (Mig 59) — PASS:** authz byte-mirror UpdatePeSuggestedPriceCcm (NotFound→Forbidden, fail-closed); FE `canEditCcm` KHỚP BIT-EXACT BE gate; submit-guard untouched (grep CcmBudgetPeriod in Services=ZERO); div-by-0 safe; 402 PASS. Detail → `archive/2026-06.md`.
+- **S82 (2026-06-21) Harness-15-v2 adopt review (0 code) — 3/3 lane PASS:** caught 3 MINOR. Memory-note: `broadcasts/_index.md` sha = notify self-declared `content_sha256` frontmatter NOT recompute → don't flag index-vs-file mismatch before reading frontmatter. Stamped-mark mid-session edit OK if only refresh confirmed-decision What-cell.
+- **S76 (2026-06-19) PE budget 3-cột Mig 56 + badge — PASS:** MAJOR race fixed gotcha #70 (useIsFetching gate). Badge role-set MUST mirror gate bit-for-bit. SURPRISE: spec "KHÔNG migration" FALSE — đọc changed-set thật, đừng tin scope-framing em-main. → _INDEX S76.
+- **S72* (2026-06-18) Mig 54 PE giá-đề-xuất + CCM-finalize OPT-IN — financial go-live PASS:** fail-closed guard throw BEFORE set Phase=DaDuyet; finalize-bypass = 3 orthogonal gate + server-recompute amount no-trust-client. → _INDEX S72*.
+- **S71 (2026-06-18) Harness-10 run-trace — PASS/GAPS:** "TRACKED" 2-level = check-ignore(eligible) vs git-ls-files(committed), model only post `git add`. → _INDEX S71*.
+- **S69 (2026-06-17) Office re-skin + golive authz — PASS:** re-skin proof = grep api-call+queryKey sorted -u byte-equal; public-grant = granted root NOT inherit-root (no sibling cascade); accent missing -800 stop = silent no-class Tailwind v4. → _INDEX S69*.
+- **S65 (2026-06-16) public HRM Hồ sơ + PE mục E — PASS:** upgrade-path MUST MUTATE row (`if(!row.CanRead){...}`) NOT skip-existing when prior revoke pre-set false (S58-class); menu-hide ≠ API-lock. → _INDEX S65*.
+- **S88 (2026-06-25) Fidelity-gate L2 gist distill (test-specialist) — FAIL (1 fabrication-by-merge):** gist gán "Mig 45" cho cluster span 2 episode khi chỉ 1 mang số đó (Master = Mig 47). Anti-pattern: merge-distill fabricates false specificity; token-PRESENCE pass BLIND to cross-episode mis-attribution → QUALITY gate after presence gate. Detail → `archive/2026-06.md`.

.claude/agent-memory/reviewer/project_pe_signoff_history_schema_review.md

@@ -0,0 +1,22 @@
+---
+name: pe-signoff-history-schema-review
+description: PE sign-off 6-decision design review (S111, pre-fanout, prod-live) — schema/history lens; opinion-history mechanism pick + Decision-3 hard-lock caller-safety + A1 test breakage
+metadata:
+  type: project
+---
+
+# PE sign-off change — schema/history lens review (GO-WITH-ADJUSTMENTS)
+
+Base = investigation `wf_fd8f2bfe-9f6` (PASS_WITH_CONCERNS). Design review BEFORE fan-out + prod deploy. My lens = SCHEMA/HISTORY (Decision 5 opinion-history + Decision 6 no-migrate).
+
+**Why (context):** anh Kiệt chốt 6 decisions (A1 bypass-only-below-creator; no self-approve-guard; EDGE-5 hard-lock DaDuyet/TuChoi; 1-button; opinion-history keep+edit+save-old; new-phiếu-only). Reviewing HOW, not re-debating WHAT.
+
+**How to apply (findings that held):**
+- **Decision 5 mechanism — RECOMMEND (a) append-only `PurchaseEvaluationLevelOpinionHistory` table.** Reject (b) round/version-col: DESTRUCTIVE — must DROP existing UNIQUE `(PEId, ApprovalWorkflowLevelId)` at `PurchaseEvaluationLevelOpinionConfiguration.cs:30` + break UPSERT read `FirstOrDefault(PEId,LevelId)` at `PurchaseEvaluationWorkflowService.cs:766-768` (returns arbitrary version) at every read site. (c) Changelog = zero-migration fallback IF audit-tab-only display OK, but overloads `PurchaseEvaluationEntityType` (no LevelOpinion value; would reuse Workflow=5 already holding return-mode+transition logs). (a) = only additive CreateTable (safest mig class, no ALTER/backfill/index-change), reversible-by-drop, clean per-cell FE history. FK: Cascade on PEId (mirror parent), LOOSE-Guid on LevelId (avoid FK-Restrict-forever like parent `.cs:28`).
+- **History hook = ApproveV2Async UPSERT else-branch `:784-790`** (capture existingOpinion BEFORE mutate). Bypass-path overwrite `:635-641` becomes DEAD under A1 (creator own-slot no longer auto-signed).
+- **A1 × Decision-5 interaction (KEY):** under A1 the creator's own slot is NO LONGER auto-signed at submit → ONLY overwrite path = re-sign (TraLai-resubmit / return-mode-backward re-approve). History belongs at approve-UPSERT, not submit-bypass.
+- **Decision 3 caller-safety VERIFIED:** only production caller of PE `TransitionAsync` = MediatR handler `PurchaseEvaluationFeatures.cs:523` via controller `/transitions`. `SlaExpiryJob.cs:100` uses `IContractWorkflowService` on `db.Contracts` — NOT PE. So top-of-method hard-lock guard `fromPhase∈{DaDuyet,TuChoi}→throw` is safe (no background-loop crash). EDGE-5 root cause = `EnsureCanRejectV2Async:321` early-returns when Phase!=ChoDuyet (does NOT block) → reject branch `:92-146` then mutates DaDuyet→TraLai. Guard must sit BEFORE reject branch + admin-override `:290` (block even Admin).
+- **Decision 6 schema-safe:** new history table empty for old phiếu (auto no-backfill). Terminal old phiếu hard-locked post-D3 → never overwrite → never accrue history. BUT code changes are GLOBAL (no per-phiếu scheme flag) → "phiếu mới only" not literally enforced for in-flight old phiếu → clarify = no-backfill (auto) vs old-retain-old-semantics (needs flag = scope+).
+- **Test breakage (spec change, §7 update-with-code):** `PeSubmitGuardAndBypassTests.cs` L465/L510/L580/L642 encode old S60 auto-sign-own-slot → BREAK under A1 (method names literally wrong e.g. `BypassesAllLevels_MovesToStep2`). L545 (drafter-not-in-step1) stays green.
+
+**Open (owner):** "cho sửa/cập-nhật" = re-sign-overwrite only (covered) vs NEW standalone edit-opinion endpoint (adds command+authz+own history-capture, NOT in lens scope). Verdict = GO-WITH-ADJUSTMENTS.