---
distill-gen: 1
period: 2026-07 (run #484→#508, S97→S133-era; 20 run-records)
source-verbatim: archive/2026-07.md (20 run-records #484→#508)
pointer-style: substring (Ctrl-F) back-resolve vào archive/2026-07.md; mỗi cụm kết → substring:"<unique>"
fields-per-line: VIỆC · KẾT-LUẬN(+commit/Run#/sqlcmd) · BÀI-HỌC · BẤT-NGỜ · [confidence]
---

# Gist 2026-07 — cicd-monitor (distilled S140 sleep-compress)

## TỔNG-HỢP (5 ý — mọi số/mốc truy được về CỤM dưới)

1. **Ship-proof đã VƯỢT hash-delta.** #69 chứng 0-fe-src có thể rotate HOẶC frozen (cả 2 benign) ⟹ tín-hiệu ship THẬT = LM-in-window + real-size (1.64/1.55MB vs SPA-trap 919b) + byte-verify-marker-grep; hash-rotation chỉ là chỉ-báo-phụ (CỤM 1/3/5).
2. **Mỗi loại GO có checklist riêng, đều quy về "verify ở lớp source-of-truth".** whole-session-GO · full-stack-schema-add · data-fix-backfill · cardinality-change · authz-2-layer — verify col-DB qua sqlcmd KHÔNG tin DTO (`endedByLevelFinalize`=None nhưng đúng), AddColumn-count/sys.tables-invariant, invariant-violations=0, DB-policy-row Admin-only, marker=0-trong-OLD (CỤM 1/2/3/4).
3. **Gate-count là fingerprint kiểm-thử.** Domain frozen 45 xuyên kỳ; Infra tăng theo feature 413→432→441→450→456→464 (tổng 458→477→486→495→501→509); 0-src-diff ⟹ count-EXACT-frozen — lệch count = có src thật (CỤM 2/3/4/5).
4. **#41 trigger-filter là baseline DI-ĐỘNG.** non-.md trong `.claude` trigger CI; AS-6 baseline-shift từ #495 (paths-ignore 7-entry) giết trigger-pattern cũ ⟹ phân-loại trigger re-derive per-glob, không hardcode (CỤM 5).
5. **cicd-lane 2 tật kinh-niên cần backstop.** #53 garble-return + tự-dán "CLEAN-return" sai ⟹ verdict corroborate bằng disk/prod (curl+sqlcmd) + poll-til-success TRƯỚC re-snapshot; tin substance-đĩa, không tin lane-self-report (CỤM 4/6).

## CỤM 1 [cao] — Mig 61 data-fix backfill `EndedByLevelFinalize` + whole-session-GO S96/S97
**VIỆC:** #484 `fb2dfa9` DATA-FIX Mig 61 `20260701142752_BackfillEndedByLevelFinalizeFromChangelog` (fix Mig 60 soi NHẦM bảng Approvals→Changelogs) + whole-session review 11-commit-day #478→#484. **KẾT-LUẬN:** GO CLEAN. Backfill VERIFIED-PROD sqlcmd: A/005=1 · A/008=1 (fix ăn) · A/010=0 (control no-over-reach); `endsBeforeCeo` FLIP LIVE A/005 `3da9b890`→True · A/010 `31faef0d`→False; Mig-history top; HEAD `5c914e4` docs-only. **BÀI-HỌC:** DATA-FIX verify ở LỚP col-DB qua sqlcmd, KHÔNG tin DTO (`endedByLevelFinalize` không expose nhưng derived phản-ánh đúng); control-row bắt-buộc. **BẤT-NGỜ:** unconditional FE-rebuild rotate hash KỂ CẢ data-fix (admin `CeTA7Z82`→`mEGqlNWc`, CSS frozen) — #69 CONFIRMED: rotation = deploy-artifact NOT ship-signal. [cao] → substring:"BackfillEndedByLevelFinalizeFromChangelog"

## CỤM 2 [cao] — Supplier full-stack expand + import saga (Mig 62/63/64)
**VIỆC:** #488 `778fc98` Mig 62 `ExpandSupplierFields` (9→27 field) · #496 `e100ef0` Mig 63 `AddSupplierImportSourceFields` · #383 `5fa11b5` Mig 64 `AddSupplierPublishState`. **KẾT-LUẬN:** 3/3 GO APPLIED-PROD. Mig 62 AddColumn×18 VERIFIED sys.columns (Suppliers 35 cols, sys.tables=89 UNCHANGED); GET /api/suppliers 200 = 22 items DTO 18 new keys. Mig 64 IsPublic backfill 37/37. Gate #496=458 (45D+413I) · #383=477 (45D+432I). FE REAL-SHIP byte-verify `officeAddress`/`legalRepresentative` (#488) · `Tải file mẫu`/`Đã công bố`/`Nháp (ẩn)` (#383); endpoint `/suppliers/import/template`+`?published=true` WIRED 401. **BÀI-HỌC:** FULL-STACK-SCHEMA-ADD checklist = CI-success + Mig-top==HEAD + AddColumn-count-EXACT + sys.tables-invariant + target-rows-outcome-EXACT + DTO-new-keys + bundle-marker-grep + dll/w3wp-in-window. **BẤT-NGỜ:** UN-CRAM DATA-OUTCOME EXACT — 4 NCC (TRUONGGIANG/TANPHU/TGN/DONGDUONG) Note=NULL sau guarded `Sql()`, LinkGuq populated đúng-chọn-lọc; guard chạy phải verify TỪNG hàng, không chỉ count. [cao] → substring:"UN-CRAM DATA-OUTCOME EXACT" (phụ: "AddSupplierImportSourceFields", "AddSupplierPublishState")

## CỤM 3 [cao] — PE feature migs: multi-NCC (Mig 65) + Min-Max range (Mig 66) + giá-ÂM guard
**VIỆC:** #384 `d436af2` Mig 65 multi-NCC per-hạng-mục (winner-truth `IsWinner`→`Quote.IsSelected`; endpoint select-winner body `{supplierIds}`→`{detailId,supplierIds}`) · #386 `88368fd` giá-ÂM + submit-guard (`PurchaseEvaluationWorkflowService.cs:206` `selectedThanhTien.Sum()<=0`→`.All(x==0)`) · #387 `316a82f` Mig 66 `20260714035636_AddPeApprovedPriceRange`. **KẾT-LUẬN:** 3/3 GO. Mig 65 `BackfillPeQuoteIsSelectedAndWinnerInvariant` invariant-violations=0 (33 sup/23 winners), data-only sys.tables=89 frozen. Mig 66 COL_LENGTH(ApprovedPriceMaxAmount)=9 + history-top. Gate #384=486 · #386=495 · #387=501 (Domain frozen 45). byte-verify #77: `Đã nhập giá chào thầu`/`hoàn tiền NCC`/`phát sinh giảm` (#386) · `cả Min và Max`/`duyệt theo khoảng`/`ProMinMax`/`Min–Max` en-dash (#387) · `trúng thầu theo từng hạng mục` (#384); select-winner WIRED 401≠404. **BÀI-HỌC:** cardinality single→multi = grep MỌI consumer + invariant-check post-backfill; marker NEW-code phải =0 trong OLD-bundle → =1 post. **BẤT-NGỜ:** (1) FALSE-discriminator `PRO Min` =1 tồn OLD (label `ProMin` pre-existing) — chọn chuỗi vắng-hẳn-OLD; (2) pre-deploy frozen-bundle TRAP: grep-sớm khi CI running → false-FAIL, poll-til-success TRƯỚC re-snapshot; (3) js-rotate+css-frozen = fingerprint FE-logic-no-style. [cao] → substring:"BackfillPeQuoteIsSelectedAndWinnerInvariant" (phụ: "AddPeApprovedPriceRange", "selectedThanhTien.Sum")

## CỤM 4 [cao] — S118 SECURITY-AUTHZ Reports.Read gate + #53 garble recovery
**VIỆC:** #389 `c808b9a` gate ReportsController → `[Authorize(Policy="Reports.Read")]` trên dashboard+contracts/export (my-dashboard kept-open); +4 reflection `AuthorizePolicyRegressionTests.cs`. **KẾT-LUẬN:** GO 5m34s, gate log = 509 (45D+464I). DB Reports.Read→Admin-ONLY (sqlcmd: 1 role CanRead=1; Procurement CanRead=0 → non-admin 403 by-construction). dll restart-in-window; smoke no-token 401×3; NO-FE (bundle S117 frozen), NO-Mig. **BÀI-HỌC:** authz verify 2-layer = attr-test reflection + DB-policy-row → 403 by-construction, không cần curl-prove password. **BẤT-NGỜ:** cicd-lane return GARBLED #53 (trả memory-curation slice thay verdict) → em-main-solo curl+sqlcmd recover; nhãn "CLEAN-return" cũ SAI (harvest-curator S118 bắt) — không tin lane-self-assessment. [cao] → substring:"c808b9a" (phụ: "403 by-construction")

## CỤM 5 [vừa] — Governance-only PASS streak #486→#495 + #69 TWO-MODE + #41 filter + AS-6 shift
**VIỆC:** 10 run 0-src-change (#486 `5ee32c0` · #487 `f0874dd` · #489 `21387cd` +office-document · #490 `d74f67f` · #491 `69957fd` · #492 `f5a5c3e` · #493 `6ee60cd` · #494 `ac3f122` · #385 `81b59f0` · run508 `e9124fc`); inflection **#495 `8aa3869` H22-WAL-adopt 30-file** (deploy.yml TỰ-ĐỔI +2 paths-ignore trong chính commit). **KẾT-LUẬN:** tất cả GO, gate frozen theo kỳ, Mig frozen (61→62→65→66), smoke 200 ship-proof. #69 TWO-MODE CONFIRMED: 0-fe-src rotate (#489 `ChSNAJBK`→`BVyH-FY7`) HOẶC frozen (#490→#494 streak ×6) — cả 2 benign; ship-proof = LM-in-window + real-size, hash chỉ-báo-phụ. #41 filter 2-chiều verified: non-.md trong `.claude` (hmw.js/.ps1/memory-budget.json) TRIGGER; .md-only = 0-run. AS-6 BASELINE SHIFT từ #495: paths-ignore 7-entry → agent-memory/**+runs/** hết trigger (pattern #490/#492 DEAD). deploy.yml workflow-self-change = run parse+chạy-trọn = PASS. **BÀI-HỌC:** governance-PASS checklist = CI-success + Mig-top-frozen + sys.tables-89 + smoke-200 + bundle-frozen-or-benign-rotate; #41 trigger là baseline DI-ĐỘNG — không hardcode. **BẤT-NGỜ:** spot-check missed-run detector = LM-prod-NEWER-than-last-verified-window (bắt #494); deploy.yml self-modifying vẫn hợp-lệ. [vừa] → substring:"#69 TWO-MODE CONFIRMED" (phụ: "AS-6 BASELINE SHIFT")

## CỤM 6 [vừa] — Tooling/poll/smoke methodology (cross-entry)
**VIỆC:** đúc lesson tool-level rải khắp run-record. **KẾT-LUẬN:** cách-đo, không phải run-verdict. **BÀI-HỌC:** (1) w3wp `$_.StartTime` mangled qua nested ssh→PS → base64-EncodedCommand; (2) busy-wait favicon-spin ~10s/iter QUÁ CHẬM → 250×/iter≈50s; python `time.sleep` foreground CHẠY được (chỉ bash sleep builtin bị block); (3) poll.py break-cond phải `status==success|completed`, KHÔNG chờ `conclusion` populated (`conclusion=None` = tasks-endpoint quirk, trust success — từng over-spin 6 iter); (4) smoke: bare `/health`=404 UNMAPPED (thật = `/health/live`+`/ready`); jq thiếu → python json; cp1252 capture → `curl -o` + open(utf-8); Windows-python không thấy `/tmp`; (5) sqlcmd integrated-auth `-E -h -1 -W`. **BẤT-NGỜ:** SPA-trap fake-hash 919b text/html = control chứng bundle thật; 411 IIS Length-Required pre-auth ≠ 404 = SignalR wired (#25). [vừa] → substring:"base64-EncodedCommand" (phụ: "favicon-spin")

## COVERAGE-TOKENS (per-file đóng-kín — nguồn: archive/2026-07.md của cicd-monitor)
**Gotchas:** #25 · #41 · #53 · #69 · #77. **Mig:** 60 (soi-nhầm) · 61 · 62 `ExpandSupplierFields` · 63 · 64 · 65 · 66. **SHA chính:** `5c914e4` `fb2dfa9` `f0874dd` `5ee32c0` `21387cd` `778fc98` `ac3f122` `6ee60cd` `f5a5c3e` `69957fd` `d74f67f` `d436af2` `5fa11b5` `e100ef0` `8aa3869` `88368fd` `81b59f0` `316a82f` `c808b9a` `e9124fc`; phụ: `162f0b9` `debe82f` `38262d8` `1eea51b` `f1af05c` `8304d08` `525a01a` `513aa09`. **file:line:** `PurchaseEvaluationWorkflowService.cs:206` · `ReportsController.cs` · `AuthorizePolicyRegressionTests.cs`. **Guards:** `Sum()<=0`→`All(x==0)` · `IsWinner⟺Any(IsSelected)`=0 · `Reports.Read` · body `{detailId,supplierIds}`. **Root-causes:** Mig 60 soi-nhầm-Approvals→Changelogs · unconditional-FE-rebuild #69. **Data-facts:** A/005=1 · A/008=1 · A/010=0 · `3da9b890` · `31faef0d` · gate-chain 440/458/477/486/495/501/505/509 (Domain 45) · sys.tables 88/89 · AddColumn×18/35 cols · 22 items 18 keys · IsPublic 37/37 · invariant=0 (33/23) · COL_LENGTH=9 · token-len 468. **Drop `thấp`:** 0 cụm (không có cụm thấp — bundle-hash-chain ephemeral giữ ở verbatim, không enumerate trong gist).