[CLAUDE] Docs: S54 closeout — IT ticket reassign cross-stack (Run #376) + harvest reconcile + monitor GATE PASS

- STATUS/HANDOFF: S54 IT-staff reassign (ca4b602, test 216, bundle rotate cả 2), user-mem re-ground 20, Phase 9 Ops scope cho NEXT
- Session log 2026-06-08-S54 + cicd-monitor MEMORY (Run #376, H2-gap post-deploy lag)
- H2 harvest GATE PASS 5/5 (residual reconcile verified) + H1 tooling 4-mặt stable
- flag monthly 2026-07-01: sys.tables 93-vs-92, STATUS re-tier S50..S38

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/HANDOFF.md

@@ -2,10 +2,26 @@
 
 > **Tiering rule (S40):** giữ **2-3 session gần nhất**. Cũ hơn → `docs/changelog/sessions/`. Full brief history pre-S40 → `docs/_archive/HANDOFF-preS40-fullhistory.md`.
 
-**Last updated:** 2026-06-08 (Session 53 — **gotcha #57 EXT Master (Mig 47) + P11-D reassign-UI + P11-E menu-key + database-agent verified-runtime — all prod-verified**. HMW-mode ON, "làm hết" full closeout. 2 code commit (`44b9e54` Mig 47 Run #260 + `dbf6648` C+D Run #261). Test 200→**203**. Bundle admin `DYfjnpY0`→`DfCfHUE9`/user `_3S0BPJ2` unchanged. Bonus Mig 46 local catch-up. ⚠️ cicd-monitor truncated 2× → curl-self-recovered. Prev S52: P11-D+E+F deployed + database-agent adopt.)
+**Last updated:** 2026-06-08 (Session 54 — **IT staff tự reassign ticket (cross-stack authz) — prod-verified**. HMW-mode ON. 1 code commit `ca4b602` → Run #376 PASS ~4m18s. Test 203→**216**. Bundle admin `DfCfHUE9`→`DmjI8Cmn`/user `_3S0BPJ2`→`YxL_MljK` (cả 2 rotate). NO migration. Task 1 Phase 9 Ops anh dừng. ⚠️ residual: 3 agent ghi MEMORY nhầm `src/Backend/.claude` → em main reconcile. Prev S53: gotcha #57 EXT Master Mig 47 + P11-D/E + database-agent verified-runtime.)
 
 ---
 
+## S54 (2026-06-08) — IT staff tự reassign ticket (cross-stack authz · HMW-mode ON · 1 commit prod-verified)
+
+**Anh: `/session-start` → "2 xong sau đó là 1" (task 2 reassign trước, task 1 Phase 9 Ops sau) → task 2 done → "/session-end". Task 1 anh dừng (không khởi động).**
+
+**Done (commit `ca4b602` → Run #376 PASS ~4m18s, prod-verified):**
+- **Feature:** cho **tổ IT (dept Code=="IT") + Admin** reassign ItTicket trên CẢ 2 app (S53 chỉ Admin/fe-admin). "IT staff" = `User.DepartmentId == IT-dept.Id`. NO migration (DepartmentId reuse).
+- **🟨 BE:** NEW `GetAssignableItStaffQuery`→`{CanReassign,Staff}` capability endpoint (`[Authorize]` any-auth, `{false,[]}` cho người ngoài) + `AssignItTicketHandler` authz Admin-OR-IT (Forbidden) + assignee-must-IT (Conflict) + controller `/assign` hạ Authorize-Roles→Authorize (handler fine-grained).
+- **🟧 FE:** fe-admin+fe-user `ItTicketsPage.tsx` **SHA256-identical** (reverse S53 divergence) — nút gate `canReassign`, dropdown `/assignable-staff`. +2 type.
+- **🟪 Test:** +13 (203→**216**) authz guard test-before-merge. **🟥 reviewer PASS** (role-string "Admin" chain-verified real). **🟩 cicd Run #376** bundle cả 2 rotate, smoke OK, Mig giữ 47.
+- ⚠️ **Residual:** 3 agent ghi MEMORY nhầm `src/Backend/.claude/` (cwd-relative khi cd subdir) → em main bắt qua git-status + reconcile canonical + harvest delta. → memory `feedback_agent_cwd_relative_memory_misland`.
+
+**🔴 NEXT SESSION (anh pick):**
+- **Task 1 Phase 9 Ops** (đã scope sẵn — anh dừng S54): **SMTP email outbound** (em code-able — greenfield `IEmailSender`+`SmtpEmailSender` config-driven appsettings `Smtp` section + wire `NotificationService` gửi email cạnh in-app notif tới `User.Email`, no-op an toàn khi chưa creds; built-in `System.Net.Mail.SmtpClient` đủ, không cần MailKit NuGet trừ khi anh muốn; **cần anh quyết: notif nào → email + có SMTP provider/creds chưa**) · **SQL backup register** (`scripts/backup-sql.ps1` READY → em đưa lệnh schtasks daily-2AM retention-30d, anh chạy VPS) · rotate creds + UAT real-user (anh-infra).
+- **Monthly drift audit 2026-07-01** (cron) — flag S54: cicd `sys.tables=93` vs STATUS 92 re-ground.
+- **Cert** `api.solutions.com.vn` expire ~2026-07-23 (auto-renew ~06-23).
+
 ## S53 (2026-06-08) — gotcha #57 EXT Master (Mig 47) + P11-D reassign-UI + P11-E menu-key + database-agent verified-runtime (HMW-mode ON · "làm hết" full closeout · all prod-verified)
 
 **User: `/session-start` → "Workflow làm nhanh" (Task B) → "làm hết luôn đi" (C+D+E+session-end). 2 code commit + docs closeout, all Gitea-verified prod.**