solution-erp/.claude/agent-memory/reviewer/MEMORY.md

Reviewer Agent — Persistent Memory

Persistent diary cross-session. Auto-injected first ~200 lines at spawn (L1 HOT). Update BEFORE every stop. Tiered Memory v1: L1 HOT soft-cap ~30KB · L2 archive/ on-demand · L3 RAG search_memory just-in-time. Keep entry ≤ 1.5K chars (gotcha #53). Full verbatim history pre-S40 → git d2f52ba + archive/2026-05-q1..q2.md; S51→S76 detail → archive/2026-06.md (S69/S70/S71/S80 curate). Archive map: archive/_INDEX.md + per-period .gist.md.

📁 Area memory (L2 on-demand — Read khi review vùng tương ứng)

• S62 PE budget soft-warning — PASS: hard-block→soft-warning; submit-guard intact + validator giữ BudgetPeriodAmount>0, row8 negative-safe (additive-only). Validator class PurchaseEvaluationFeatures.cs:317.
• Wire/mirror claim verification anchors — sha256 twin-file · git diff -U0 isolate true-adds · allowNegative bleed check · guard-still-intact grep.
• S89 PE budget-sectionB review — investigator 3/3 upheld (do-not-touch FROZEN) + CAUGHT MISSED #70 race: Block B PRO row3/row8 share adjustMut + cross-echo ev stale + NO ||peFetching (every other cell gated). authz-lens ≠ concurrency-lens.
• S89 PE ends-before-CEO PLAN review — CONCERN: BE 3-field design sound (Mig 58 col committed, no mig) but FE coverage gap — 4 PeUrgentChips render-sites, plan covered only 2 (missed InboxPage:290 despite BE Inbox A2 updated + wrong ListPage dir path).
• S89 finalize-note PLAN review — CONCERN: plan ground-truth 100% accurate (all file:line verified incl self-flagged); gaps = note doesn't say intermediate approvers still sign + skipToFinal-last-level corner + Dev DB 9 migs behind.

---

🎯 Role baseline

Adversarial pre-commit reviewer SOLUTION_ERP. Read-only verify + live curl prod UAT (*.solutions.com.vn). Tools: Read, Grep, Glob, Bash (curl + git diff + sqlcmd read) + 5 RAG MCP. Skills: dependency-audit-erp + contract-workflow + permission-matrix. Output: PASS/FAIL + concrete issues file:line. NEVER write code.

---

🚨 Recurring bug patterns (catch priority)

• #44 Silent 403 class-level Authorize quá strict — Drafter dropdown empty silent (TanStack catch silent → UI empty). Grep \[Authorize\(Policy=.*\)\] class-level + curl non-admin expect 200. Fix: class-level [Authorize] only (any authenticated); POST/PUT/DELETE giữ [Authorize(Policy="X.Create")].
• #43 Step.Order ≠ index 0-based — Where(s=>s.Order==i) wrong row. Fix: EF query → in-memory OrderBy(Order).ToList() → index.
• #42 Dual schema V1/V2 — Service phải branch — if (entity.ApprovalWorkflowId is Guid awId) ApproveV2Async else V1Legacy.
• Wire BE claim — grep diff // Mock/alert(/no POST-PUT-DELETE call + live curl expect 2XX. Severity CRITICAL block.
• #70 FE absolute-set stale-echo race — N fields cùng-cột share 1 mutation + echo sibling từ server-snapshot (bs) + invalidate() fire-and-forget (không await) → lưu 2 ô liên-tiếp đè mất. Window mở SAU isPending=false (btn re-enable), KHÔNG lúc in-flight. Catch: đếm field-cùng-cột share mutation + check invalidate awaited; fix = useIsFetching gate nút Lưu tới khi refetch land.
• #71 enum proxy-predicate pollution — thêm enum value vào entity dùng-chung → UI/guard phân-loại theo PROXY-predicate (supplierId===null) thay vì enum tường minh → value mới lẫn nhầm phân-loại + false-pass guard. Catch: grep mọi field-proxy predicate, loại value mới tường minh; build-verify TỪNG app.
• Cross-module security mirror (S29 Smart Friend) — khi mirror entity/Command cross-module (PE→Contract→Budget V2), focus data-shape MISS security guard. Pattern: aw.ApplicableType == ExpectedType validate ON Create BEFORE instantiation (mirror PurchaseEvaluationFeatures.cs:62-77). Attack: Drafter forge POST với approvalWorkflowId của module khác → FK Restrict chỉ check Id-existence NOT ApplicableType → wrong-scope pin. Re-verify IsActive+IsUserSelectable server-side. Password ≥12 chars. Severity MAJOR.
• #17 EF migration 3-file — git diff --name-only | grep Migrations/ expect 3 (target + Designer + Snapshot).

---

📋 6-category checklist (EVERY review)

• Cat 1 Wire BE/feature claim: grep mock markers diff + await api\.(post|put|delete|patch)\( + live curl POST/PUT/DELETE if deploy claim + status matrix.
• Cat 2 Schema integrity: 3-file rule Mig + column types vs entity def. Reference docs/gotchas.md (71 active).
• Cat 3 Security: [Authorize] class-level ALL new controllers + per-action policy admin-scoped (gotcha #44) + FE PermissionGuard + menuKeys.ts mirror BE MenuKeys.cs + FluentValidation + EF parameterized.
• Cat 4 Code quality: dotnet build SolutionErp.slnx 0 err + npm run build × 2 app (TS6 strict) + tests baseline 354 PASS (Phase 9 UAT exception OK) + no --no-verify + anti-fiddle (scope drift >20% LOC = FAIL) + mirror 2 FE app §3.9.
• Cat 5 Test coverage: new helper → xUnit · new endpoint → integration · bug → regression test-before-fix. Phase 9 UAT test-after default OK (feedback_uat_skip_verify). Baseline 354.
• Cat 6 Writing-quality (Harness-7, S64): outward text (verdict gửi anh / report) = tiếng Việt câu hoàn-chỉnh đủ dấu đúng ngữ-pháp; describe issue + acceptance criteria, NOT code edits. Escalate disagreement explicit.

---

⚠️ Anti-patterns + 🛡️ Smart Friend guard

1. ❌ Recommend code edits (only describe issue+criteria) · 2. ❌ Skip live curl if deploy claim · 3. ❌ Accept "wire" without grep proof · 4. ❌ Defer to em main authority (escalate explicit) · 5. ❌ Skip MEMORY · 6. ❌ Lower bar match em main (Smart Friend Cognition anti-pattern).

Smart Friend (Cognition): NEVER lower bar. Em main code fine → PASS. Em main issues → FAIL with specifics regardless social pressure. "Quality ceiling set by primary, not escalation." Value = raise quality through catch.

---

🧠 SOLUTION_ERP review essentials (S80 verified — re-ground từ docs/STATUS.md canonical)

• Tests baseline: 354 PASS (45 Domain + 309 Infra · 0 fail/skip). Must increase khi feature added (§7); Phase 9 UAT exception (feedback_uat_skip_verify).
• Gotchas: 71 active (docs/gotchas.md, format ### N.). Latest: #69 bundle-hash non-determ (deploy rebuild-FE-uncond rotate) · #70 FE stale-echo race (useIsFetching gate) · #71 enum proxy-predicate pollution · #66 Tailwind v4 unlayered h1-h4 color thắng utility · #58 EF read-modify-write lost-update→ExecuteUpdate atomic.
• Migrations: 57 latest AddPeSuggestedPriceNotes (path src/Backend/SolutionErp.Infrastructure/Persistence/Migrations/). PE-budget: Mig 50 PeWorkItemBudgets per-gói-thầu (DROP module Budget cũ) · Mig 54 giá-đề-xuất PRO/CCM + giá-chốt · Mig 55 CcmNote · Mig 56 ProInitial/ProAdjust split · Mig 57 ghi-chú-giá PRO/CCM.
• Endpoints: ~253 · 88 SQL tables.
• Identity password ≥12 chars (reject 11-char). Test creds: admin admin@solutions.com.vn/Admin@123456 (full) · UAT nv.test@solutions.com.vn/TestUser@123456 (Drafter CCM).
• Prod: api/admin/eoffice.solutions.com.vn. Bundle live admin CsJetgZH / user BVS0ApIm (Run #330). Pin: MediatR 12.4.1 (flag Version="14) · Swashbuckle 6.9.0 · Node CI 20.x.
• Conventions: docs/rules.md (§1.1 outward writing, §3.9 mirror 2 FE, §5.2 commit, §6.5 docs narrative, §7 test timing, §2.8 pin).

---

📅 Recent activity (compressed — full verbatim → archive/2026-06.md via archive/_INDEX.md)

• S91 (2026-06-25) Adversarial PE D2 create-contract 1→N multi-winner + list winner-names (OUTWARD, FROZEN module, NOT-deployed) — PASS (genuine, 0 blocking): This IS the fix for the dead-end I caught in S89-bis. BE handler (CreateContractFromEvaluationFeatures.cs:45-152) rewritten IRequest<Guid>→List<Guid>, 1 Contract per IsWinner supplier. The S89-bis hard-block if(SelectedSupplierId is null) throw REMOVED → replaced winners=Suppliers.Where(IsWinner); if Count==0 throw (joint ≥2 now accepted). All 5 spec concerns verified true: (a) codegen mid-loop SaveChanges flushes ONLY seq-row — loop-1 builds contract LOCAL (never db.Contracts.Add), GenerateAsync:51 db.SaveChangesAsync on SHARED scoped ctx flushes only the tracked ContractCodeSequences row; pe (tracked via Include) NOT mutated until pe.ContractId=contracts[0].Id at :148 AFTER both loops; loop-2 does the Add+changelogs+final SaveChanges :150. (b) GiaTri: single→detailsSum=Details.Sum(ThanhTienNganSach) (legacy); ≥2→per-winner Details.SelectMany(Quotes).Where(q.PurchaseEvaluationSupplierId==w.Id).Sum(ThanhTien) — join key is PES-row Id (Quote.PurchaseEvaluationSupplierId FK→PES.Id, entity:11 confirmed), mirrors submit-guard WorkflowService:190 + detail-bundle winnerQuoteTotal:1109-1112 byte-for-shape (all 3 layers same IsWinner+row-Id join; create sums PER-winner, guard/display sum ALL → N contracts sum to gate total, test asserts w0=140+w1=260). (c) idempotency: contract.Id from BaseEntity:5 Guid.NewGuid() valid pre-SaveChanges; guard pe.ContractId is not null :59. (d) guards+Includes all present (.Include(Suppliers)+.Include(Details).ThenInclude(Quotes) :48-49). (e) no partial-create: codegen self-commits seq per-call (Serializable tx :37/52) → later-winner throw wastes seq numbers (gap, acknowledged) but no contract Add'd, final SaveChanges not reached = clean. Positional record arg-order (spec's #1 skeptic-ask) VERIFIED across all 3 sites — DTO PurchaseEvaluationListItemDto ends IsUrgentByPro, IsUrgentByCcm, WinnerSupplierNames (Dtos:41-45); all 3 projections (ListPE:616, Inbox:705, ListApprovedPE:178) append the winner-names subquery as FINAL positional arg after identical-shape preceding args → no misorder. Controller :297 {contractIds} (was {contractId}); grep confirms ONLY 2 byte-identical PeDetailTabs read {contractIds:string[]}, ZERO stale .data.contractId readers. FE mirror: PeDetailTabs+PeListPanel SHA-256 byte-identical both apps; PeListItem type block diff=0 (winnerSupplierNames:string[] identical, only pre-existing PHASE_BADGE color/comment drift remains = documented intentional). winnerSupplierNames?.length>0 optional-chain safe (undefined>0=false). S89-bis loop CLOSED: CreateContractDialog now renders suppliers.filter(isWinner).map(supplierName).join(', ')||selectedSupplierName (no blank); approved-pending-contract endpoint has ZERO FE consumer (picker dead → joint-blank moot). Verify: build slnx 0-err · fe-admin+fe-user tsc exit 0 · full suite 45+374=419 PASS 0-skip (S90 413 +6) · 2 new test classes 6/6 PASS via REAL ContractCodeGenerator Serializable-on-SQLite + REAL SQLite collection-subquery translation (NoOp-vacuous explicitly avoided: single-winner test asserts GiaTri=800 budget NOT 140 quote; 2-winner asserts 140/260 with budget 800 DIFFERENT) · mock-grep clean · no migration in diff (Mig 58 pre-committed S87) · agent-memory diff .md-only. Anti-pattern positive-validation: cardinality single→multi conversion now propagated through ALL layers consistently (FE visibility predicate isWinner + BE action precondition winners.Count + 3 financial-total sites + dialog render) — the exact FE-shows/BE-blocks mismatch I flagged S89-bis resolved by aligning the BE action on the same IsWinner source-of-truth, not by hiding the button.
• S90 (2026-06-25) Adversarial PE stability-fix batch D1 (5 changes + 11 tests, FROZEN module, NOT-deployed) — PASS (genuine, 0 blocking): Closes my own S89/S89-bis flagged latent bugs. (1) Block B financials re-key SelectedSupplierId→Suppliers.Where(IsWinner) (PurchaseEvaluationFeatures.cs:840/855): single-winner UNCHANGED proven — sole writer PurchaseEvaluationDetailFeatures.cs:427/431 sets IsWinner=selectedIds.Contains(SupplierId) AND SelectedSupplierId=Count==1?First():null in same action ⇒ for 1 winner both predicates select identical row-set (even survives duplicate-SupplierId-rows since :427 flags all). ≥2 → sums all (approved fix). EF-safe: peers is IQueryable (db.PE.AsNoTracking().Where) so Any(s=>IsWinner)+CountAsync/SumAsync translate server-side; currentProposalTotal uses already-Included e.Suppliers in-mem + 1 SumAsync = no N+1. Matches submit-guard WorkflowService:189-191 byte-for-shape + winnerQuoteTotal:1093 (Quote→Detail FK mandatory so in-mem e.Details.SelectMany(Quotes) == direct query set). (2) CEO-notify SaveChanges (UrgentFeatures.cs:100): NotificationService confirmed Add-only (no internal SaveChanges) → pre-fix Director rows Add'd-but-never-flushed (only :75 flush BEFORE notify block) → silent drop + no SignalR; new SaveChanges inside try/catch = best-effort, gate :80 !wasUrgent snapshot@:52 = no double-notify. (3) HoSoLink null-safe+clear-via-empty (:280-281): contract coherent — BOTH UpdatePeDraft FE forms OMIT hoSoLink (PeHeaderForm.tsx:112-120 + InfoTab.save PeDetailTabs:817) → preserve; ONLY HoSoLinkRow:2023 sends .trim() ("" clears, value sets); PeWorkspaceCreateView ||null is CREATE (api.post) not Update; NO other UpdatePeDraft caller sends null-as-clear. (4) Setter relocation PeSuggestedPrice→PeWorkItemBudget byte-identical (only comment header added), same namespace ⇒ MediatR resolves, controller:125 unchanged, source file ends clean. (5) FE #70 guard ||peFetching added to the EXACT 2 PRO cells (1548/1649) that lacked it — now consistent w/ all siblings; peFetching in scope @1268; PeDetailTabs.tsx sha256 byte-identical both apps. Tests RED-pre-fix (logic-proven all): joint-winner Current=200/Prev=100 (pre-fix 0/0 via null gate); HoSoLink null→PRESERVE (old test asserted BeNull — assertion flipped); CEO-notify asserts db.Notifications has Director row via REAL Add-only service (NoOp would pass vacuously — explicitly avoided). Verify: build slnx 0-err/0-warn · full suite 45+368=413 PASS 0-skip · 3 affected classes 52 PASS · fe-admin+fe-user tsc exit 0 · mock-grep clean · agent-memory diff .md-only. Joint-winner number change is the approved frozen-spec exception (soft-warning proposalOver:1380 now fires correctly for joint, no hard-gate keys off it). Anti-pattern positive-validation: the impl chose the behavior-PRESERVING fix shape I prescribed in S89 — HoSoLink option(b)-equivalent (null-safe + "" clear) keeps HoSoLinkRow-clear working WITHOUT touching its FE send, resolving the option(a)-breaks-clear nuance I flagged; and Block B re-key picks IsWinner (the new source-of-truth) over SelectedSupplierId consistently across all 3 winner-total sites.
• S89-bis (2026-06-25) Adversarial AREA-6 FE-consumers (PE FROZEN audit, investigator verify) — 4/4 finding confirmed + 1 NEW miss: All 4 investigator findings hold under independent Read. #1 (list-panel PeListPanel.tsx:168 blank winner label when ≥2 joint winners) CONFIRMED — list DTO carries only selectedSupplierName projected from SelectedSupplierId (PurchaseEvaluationFeatures.cs:615/706), BE nulls it for ≥2 (PurchaseEvaluationDetailFeatures.cs:431 selectedIds.Count==1?First():null); detail-side fully converted to isWinner (verified 14 call-sites grep). do-not-touch (DTO-extend + render = behavior). #2 (#70 stale-echo asymmetry) CONFIRMED PRECISE — ONLY lines 1548+1649 (PRO adjustMut absolute-set pair echoing un-edited sibling from ev.budgetPeriodAmount/ev.expectedRemainingAmount 1551/1652) gate bare {adjustMut.isPending}; CCM sibling 1563 + suggested-price 1736 + notes all add || peFetching. Adding ||peFetching = behavior-preserving (gates Save btn during refetch only) = SAFE fix. #3 (stale AddItemDialog giữ (dead) comment line 2507, fn deleted grep=0) CONFIRMED safe drop. #4 (mirror clean) CONFIRMED ACCURATE — 6 PE components SHA-256 byte-identical both apps (verified), type-file diff is LINE-NUMBER-only on structural fields (isWinner/ccmBudgetPeriodAmount/winnerQuoteTotal/allowApproverFinalize content-identical, fe-user shifted by extra comment lines). NEW catch investigator MISSED (same null-when-≥2 class, HARDER consequence): create-contract joint-winner DEAD-END. FE canCreateContract gate (PeDetailTabs.tsx:1900) shows "Tạo HĐ từ phiếu" button on suppliers.some(isWinner) (≥1 incl joint ≥2) + dialog header 2171 even renders joint names; but BE CreateContractFromEvaluationCommandHandler (CreateContractFromEvaluationFeatures.cs:52) hard-blocks if (pe.SelectedSupplierId is null) throw ConflictException("Phiếu chưa chọn NCC thắng") = EXACTLY joint-winner case. Submit-guard (WorkflowService:180 IsWinner ≥1) lets ≥2-winner reach DaDuyet → user clicks Tạo → 409 despite chosen winners. ListApprovedPE picker join (CreateContractFromEvaluationFeatures.cs:137) also blanks supplier for joint. Anti-pattern: cardinality single→multi conversion stops at the DETAIL display layer — the FE button-VISIBILITY predicate was migrated to isWinner but the BE ACTION it triggers + its precondition still resolve single SelectedSupplierId → FE-shows/BE-blocks mismatch. Fix = behavior decision (block earlier / pick-winner / multi-contract) → do-not-touch in this area, flag em-main. Mirror byte-identical so fe-user has IDENTICAL bug.
• S89 (2026-06-25) Adversarial AREA-4 workflow-edit (PE FROZEN audit, investigator verify) — 3 confirm / 1 confirm-but-do-not-touch: Investigator finding #1 (HoSoLink #73-class clear-on-partial-edit) CONFIRMED real high-sev latent bug: UpdatePeDraftHandler PurchaseEvaluationFeatures.cs:280 absolute-set entity.HoSoLink=request.HoSoLink (record default null line 222) while header-edit forms OMIT hoSoLink → set link via HoSoLinkRow then edit header = silent wipe. NEW catch investigator MISSED: a 2nd destructive call-site — PeDetailTabs.tsx:817 InfoTab.save (Panel-1 pencil inline-edit, both fe-admin+fe-user) PUTs {tenGoiThau,diaDiem,moTa,paymentTerms,budgetPeriodAmount,expectedRemainingAmount} NO hoSoLink. Team comment 823-825 "echo … để PUT update không xóa nhầm" PROVES they knew absolute-set hazard + defended budget but missed hoSoLink. fixRisk nuance: investigator's option(a) (make HoSoLink null-safe) BREAKS HoSoLinkRow clear — HoSoLinkRow sends hoSoLink||null (empty→null to clear) line 2020; null-safe guard would ignore the clear. Spec FROZEN → behavior-preserving fix = option(b) only (echo hoSoLink in both header forms), option(a) needs HoSoLinkRow→empty-string change = behavior touch. Anti-pattern: "echo-all-siblings" mitigation convention silently rots when a NEW absolute-set field (Mig 52 HoSoLink) is added but not back-filled into every sibling-echo call-site. Finding #3 (SetPeCcmBudgetPeriod misplaced in PeSuggestedPriceFeatures.cs:153 not PeWorkItemBudgetFeatures) CONFIRMED low-sev org-debt, functional+tested (PeCcmBudgetPeriodSetterAuthzTests). Finding #4 (require-workflow NON-dup: CREATE-validator NotEmpty line 48 + submit-guard WorkflowService:237 + UPDATE-validator-omit = 3 distinct lifecycle, intentional defense-in-depth) CONFIRMED accurate verification, no patchwork. Finding #2 (no HoSoLink preserve test) CONFIRMED gap but test-before only AFTER picking the behavior-safe fix.
• S86 (2026-06-24) PE Section B THỰC HIỆN tách 3 cột Dự án|PRO|CCM (Mig 59 CcmBudgetPeriodAmount) — lane [authz] PASS: role-gate đúng — handler SetPeCcmBudgetPeriod byte-mirror UpdatePeSuggestedPriceCcm (NotFound→Forbidden order; fail-closed !Admin && !CostControl→ForbiddenException→403 via GlobalExceptionMiddleware TRƯỚC mọi set/changelog). FE gate bs.canEditCcm (BE-computed PurchaseEvaluationFeatures.cs:812 isAdmin||CostControl) KHỚP BIT-EXACT BE endpoint gate → no FE-show-BE-block mismatch + no FE-hide-BE-allow hole. PRO cột giữ drafterEditable (/budget-adjust unchanged) · Dự-án cột hardcode — (chưa wire, an toàn). Budget=0 hợp-lệ (GTE(0).When(HasValue), test ZeroValue_IsValid). Submit-guard PROOF untouched: grep CcmBudgetPeriod trong Infrastructure/Services = ZERO; missingForApproval chỉ build trên BudgetPeriodAmount(PRO)+ProInitial fallback (Mig 58 "0 valid only null block"). Class [Authorize] any-auth controller (gotcha #44 N-A: write-endpoint fine-grained Forbidden). 7/7 new authz test PASS (Admin/CCM allow · Drafter/Procurement deny · null-clear absolute-set · NotFound-before-authz). Full suite 45+357=402 PASS (395+7). fe-admin+fe-user tsc 0 + 2-app byte-identical (§3.9) + Mig 3-file OK. Lane [math] (sibling, kept): per-cột độc-lập đúng — colCalc(periodAmount,colFull,remaining) đóng-gói r3/r5/r7/r8/r9+3 cmp KHÔNG cross-cột (pro=colCalc(draftRow3,proFull,draftRow8) · ccm=colCalc(draftCcmRow3,ccmFull,null)); số chung row1/2/4/6 KHÔNG nhân per-cột (r5=row1+r3 cột, cmpPeriod=r3-row4 chung, cmp56=r5-row6 chung). Div-by-0 safe: fmtPct(num,denom)=denom>0?...:null + consumer {pct&&...} guard → cột full=0/null KHÔNG NaN/Infinity; Dự-án cột hardcode "—" KHÔNG vào colCalc. CCM r8=default(r7) đúng spec (chưa có field CCM-remaining). #70 note: new ccmPeriodMut single-field body (no sibling echo) + thêm ||peFetching gate = clean; PRO adjustMut 2-field-echo KHÔNG peFetching-gate = PRE-EXISTING (base HEAD unchanged, spec "PRO giữ luồng hiện có") không phải regression. Authz mirror byte-exact UpdatePeSuggestedPriceCcm (NotFound→Forbidden order, fail-closed Admin|CostControl). Build slnx 0-err + test-proj rebuild 0-err (MSB3030/3026 = Dropbox bin-lock flake, benign) + 7/7 new authz test PASS + fe-admin tsc 0 + 2 app byte-identical (mirror §3.9). Mig 3-file OK. DTO positional slot line-up OK.
• S82 (2026-06-21) Harness-15-v2 adopt review (governance delta, 0 code) — 3/3 lane PASS: floor-completeness + faithfulness + honesty-regression, all clean ("genuine PASS not courtesy"). Caught 3 MINOR (đã fix): volume "~42K" stale trong mark · mark What-cell mang nội-dung S82 mà status ghi "anh-confirm S81" → flag pending-confirm · _index pending. Memory-note (chống false-alarm): broadcasts/_index.md sha = notify's self-declared content_sha256 (frontmatter), KHÔNG recompute full-file/body → đừng flag index-vs-file "mismatch" trước khi đọc frontmatter field. Stamped-mark mid-session edit OK khi chỉ refresh What-cell content của decision đã-confirm + status flag pending (KHÔNG mint RC-sig mới, KHÔNG đổi tier) = accuracy-keeping, không phải frozen-record breach.
• S76 (2026-06-19) PE budget ma-trận 3 cột Mig 56 + badge display-only — PASS: MAJOR race = 2 PRO cell cùng-cột share mutation + echo sibling từ bs + fire-and-forget invalidate() → data-loss window (fixed gotcha #70 useIsFetching gate). Badge role-set MUST mirror gate bit-for-bit (đảo-chiều set-lookup = forward Roles.Contains). SURPRISE: spec "KHÔNG migration" FALSE (diff bundle Part1+2+3) — đừng tin scope-framing em-main, đọc changed-set thật. → _INDEX S76 Part1/Part2+3.
• S72/S72bis/S72ter/Q2 (2026-06-18) Mig 54 PE giá-đề-xuất + CCM-finalize OPT-IN — financial go-live PASS: fail-closed guard ORDER = throw TRƯỚC mọi set Phase=DaDuyet; no-deadlock proof = submit-guard invariant (winnerQuoteTotal>0) forward-trace tới finalize candidate-set (FE length===0 branch unreachable); finalize-bypass = 3 gate trực-giao (approver-match ∩ role=CostControl ∩ amount<threshold) + server-recompute amount KHÔNG trust-client; isSystem-exempt = dead-branch single-caller-proof. → _INDEX S72*.
• S71 (2026-06-18) Harness-10 run-trace + finalize double-check — PASS/GAPS: "TRACKED" containment 2-level = check-ignore(eligible) vs git ls-files(committed) — model chỉ work post git add. "Hoàn chỉnh toàn bộ" audit phải check budget.json measured-bytes vs DISK (over-cap re-accumulate mỗi session). → _INDEX S71*.
• S69 (2026-06-17) Office re-skin + golive authz — PASS: re-skin logic-preservation proof = grep api-call + queryKey sorted -u byte-equal OLD-vs-NEW (nhanh+rigorous hơn đọc từng hunk); public-grant security = granted root NOT inherit-root (no sibling cascade gotcha#44-family) + menu-key KHÔNG dùng làm controller [Authorize(Policy=)] (Office=class-[Authorize]+Roles=Admin → CanCreate FE-only, không escalate API write). color-trap: accent thiếu -800 stop = silent no-class Tailwind v4. → _INDEX S69*.
• S65 (2026-06-16) public HRM Hồ sơ + PE mục E — PASS: upgrade-path phải MUTATE row (if(!row.CanRead){...}) KHÔNG skip-existing khi prior revoke pre-set flag false (fix S58-class); menu-hide ≠ API-lock (class-[Authorize] controller data reachable direct-URL bất kể menu). hyperlink free-text = no server-side XSS. → _INDEX S65*.
• S88 (2026-06-25) Fidelity-gate /sleep-recovery-memory-l2 gist distill (test-specialist L2) — FAIL (1 fabrication-by-merge): gist MERGE 2 episode gotcha#57 (S51-HRM + S52-Master) vào C-A cluster, KẾT-LUẬN span cả 2 Code-list {Departments|Projects|Suppliers|LeaveTypes|ShiftPatterns}.Code NHƯNG gán "in Mig 45" cho TOÀN cluster. Verbatim chỉ tie Mig 45→2 HRM config; S52-Master record CỐ Ý ghi "migration" KHÔNG số (vì fix ở mig riêng sau). Canonical CLAUDE.md xác nhận Master filtered-unique = Mig 47 không phải 45 → gán SAI affirmatively cho Master half. Anti-pattern: merge-distill fabricates false specificity — gán 1 token dùng-chung (Mig 45) cho cluster span N episode khi chỉ 1 episode mang số đó. Phase-3a deterministic token-PRESENCE pass (ratio 92%, 30 token present, mojibake-clean) BLIND tới cross-episode mis-attribution — đúng lý do QUALITY gate đứng SAU presence gate. Mọi thứ khác faithful: 2 episode-distinct fact (S51 2-GREEN-Vehicle/Driver-Mig44 + S52 3-ALL-RED) giữ riêng, HRM-ref correction active-count plain DbSet / all-count IgnoreQueryFilters() không embellish, FIFO caveat (185/191/200 flag episode-local), 4 back-resolve substring count=1 unique, OtWeighted=12.0m + SLA 4/8/24/72h + Serializable-SQLite-NON-ISSUE khớp. Fix hẹp = đừng gán Mig-number cho Master half (giữ vagueness verbatim hoặc split per-episode).

---

🔄 Curate trigger

• ~30KB → archive recent → L2 archive/<period>.md (byte-exact append) + _INDEX.md substring pointer. Stale >3mo → remove.

• Last curate: 2026-06-20 S80 (em-main, archive-gate keep-floor-hit → manual) (45.2→~14KB): moved 13 recent entries S65→S76 (lines 64-82 byte-exact via sed) → archive/2026-06.md (32.7→70KB, +13 entries) + _INDEX.md +13 substring pointers (all verified count=1). KEPT foundation + 5 compressed recent-summaries; UPDATED stale essentials (130→354 test, 55→71 gotcha, Mig 40→57, 84→88 tables, ~211→~253 endpoints) + 5-cat→6-cat (Cat-6 writing-quality). gist NOT updated (em-main distill later).
• Prev curate: 2026-06-18 S71 (36.7→24.2KB): moved 10 entries; KEPT foundation + newest cluster. Prev S70 (42.5→24.8KB): built _INDEX.md + .gist.md gen:1. Prev S40 (28.4→18KB).