solution-erp/.claude/agent-memory/cicd-monitor/MEMORY.md

CI/CD Monitor Agent — Persistent Memory

Persistent diary cross-session. Auto-injected first ~200 lines at spawn (L1 HOT). Update BEFORE every stop. Tiered Memory v1: L1 HOT soft-cap ~30KB · L2 archive/ on-demand · L3 RAG search_memory just-in-time. Keep entry ≤ 1.5K chars (gotcha #53). Full verbatim run history pre-S40 → git d2f52ba + archive/2026-05-{runs,q2,q3,q4}.md + archive/2026-06.md. 🗺️ Lookup map: archive/_INDEX.md — 1 dòng/bản-ghi + con-trỏ substring (sha-keyed, Ctrl-F fallback); đọc verbatim + 2026-0{5,6}.gist.md theo nhu cầu. S80 curate: moved 3 huge run-entries (#330/#318/#325) → archive.

---

🎯 Role baseline

Read-only CI/CD + post-deploy verifier SOLUTION_ERP. Polls Gitea Actions API, verifies test gate + deploy ship + prod health. Tools: Read, Grep, Glob, Bash, WebFetch + 5 RAG MCP. Output: PASS/FAIL + evidence <500 words. Skills: iis-deploy-runbook + dependency-audit-erp + ef-core-migration. Spawn ~150K — trade-off catch fail tự động.

---

🚨 Recurring CI/CD bug patterns (catch priority)

• #39 act_runner github.com TCP timeout — run hang "Set up job" 21s. Log dial tcp github.com:443 i/o timeout. Fix: manual checkout bypass hardcoded .gitea/workflows/deploy.yml. KHÔNG revert.
• #40 npm cache tsc not found — build_fe_admin fail post cache: npm. DISABLED rolled back a21790d. KHÔNG re-enable.
• #41 paths-ignore docs-only skip — code commit không trigger CI? Check git diff --name-only HEAD~1 HEAD vs paths-ignore: ['docs/**','**/*.md','.claude/skills/**']. Gitea evaluates push range — ≥1 commit có non-ignored file → toàn range build.
• #25 IIS WebSocket — notification-hub/negotiate 401/404 prod. Fix: WebSocket module enable web.config site api (skill iis-deploy-runbook).
• #48 SQLite tie-break — OrderByDescending(CreatedAt).First() pick wrong khi 2+ .Add() cùng frozen-clock. Fix: discriminator filter BEFORE OrderBy.
• Bundle hash unchanged = ship FAIL — push+action success nhưng prod không đổi. Verify via INDEX.HTML ref (curl -s https://admin.solutions.com.vn/ | grep -oE '/assets/index-[A-Za-z0-9_-]+\.(js|css)'), NOT by GETting a hash-named asset directly. ⚠️ verify MUST sau status=success (Run #242 false-positive: check khi "running" → stale hash).
  • 🔴 #69 (S72 Run #312) — FE bundle hash NON-DETERMINISTIC per rebuild. deploy.yml Remove-Item fe-*\* -Exclude web.config + Copy-Item dist\* runs UNCONDITIONALLY every run (path-filter gates whole-workflow trigger, NOT per-step). Identical FE source ⟹ DIFFERENT hash each deploy (Vite/rolldown non-reproducible chunk-id). PROVEN: governance-only 18fced6 (0 files in fe-*/src) rotated BOTH bundles. ⟹ "BE-only/governance ⟹ bundle frozen" is FALSE; rotation EXPECTED every deploy. To detect REAL FE change, diff fe-*/src in commit/range, NOT hash delta.
  • ⚠️ SPA-fallback 200 trap (S72): server rewrites /*→/index.html so GET /assets/index-<ANYTHING>.js returns 200 even for fake hash (control ZZdoesnotexist0.js→200, size~919b text/html). Old-hash-still-200 MEANINGLESS. RELIABLE signal = parse index.html <script src>, GET that exact path + check size_download LARGE (real ~1.6MB vs fake ~919b) + Last-Modified in deploy window + 2nd-fetch byte-stable (no mid-deploy transient).
  • 🟢 #69-REFINE (S83 Run #333) — hash can stay IDENTICAL across deploy when fe-*/src 0-change. #69 said "rotates EVERY deploy" — NOT absolute. Run #333 (BE+tests+governance, ZERO fe-*/src diff) shipped FE (Last-Modified 17:10:35/17:11:27 BOTH in run-window 17:06→17:11) but hash UNCHANGED (admin CsJetgZH/user BVS0ApIm = #330 baseline). ⟹ identical Vite source ⟹ byte-identical output ⟹ same content-hash. Rolldown chunk-id apparently MORE deterministic than #69 feared (or only rotates on real src delta). MOST RELIABLE ship-proof = Last-Modified header on the real bundle file IN deploy-window, NOT hash-delta (hash-delta has false-NEGATIVE when src unchanged + false-POSITIVE risk noted in #69). Always cross-ref git diff fe-*/src scope: 0-FE-change ⟹ expect SAME hash + fresh Last-Modified.
• Migration drift prod vs repo — compare ls .../Persistence/Migrations/*.cs vs sqlcmd __EFMigrationsHistory. Fix: check Program.cs/DbInitializer app.MigrateDatabase() + app pool recycle. Mig-applied proof = __EFMigrationsHistory top==repo-HEAD; stuck-old ⟹ pool didn't recycle ⟹ FAIL even if status=success+bundle-rotated.

---

📋 5-stage checklist (EVERY run)

• Stage 0 RAG infra: Get-Service Qdrant Running + http://localhost:6333/healthz. Collection proj_solution_erp.
• Stage 1 Push+filter: git log -1 --format='%H %s' + git log origin/main..HEAD empty + diff vs paths-ignore (docs-only → SKIPPED-DOCS return).
• Stage 2 Gitea poll (max 10 iter × 60s): API .../actions/tasks?limit=5 (NOT /runs 404). Match head_sha (NOT run_number — cancelled runs shift numbering). ⚠️ updated_at stale ~2min (gotcha #46) → cross-check VPS mtime. Foreground-sleep BLOCKED Windows → Monitor-style busy-wait-curl-spin ~30s/iter.
• Stage 3 Test gate: baseline 413 PASS (45 Domain + 368 Infra; S88-quad #347 — 402 + 11 D1 [PeHoSoLinkTests+PeWorkItemBudgetTests EXTEND + new PeUrgentNotifyDirectorTests]; prior S88 #345 402, S87 #344 395). CI runs both proj BEFORE build/deploy → status=success ⟹ test gate passed (tasks terminal=status:success, conclusion NOT populated — trust success NOT log-numeric). Local grep undercounts (Theory/InlineData). Phase 9 UAT skip OK.
• Stage 4 Post-deploy (if SUCCESS): auth login bearer (admin + nv.test gotcha #44; token=accessToken route /api/auth/login) → 3-5 endpoint smoke 2XX (incl new — NEW-endpoint bodyless-POST returns 411 IIS Length-Required pre-auth NOT 404; re-probe WITH body → 401 confirms wired) → FE bundle hash 2 app (per #69 = real-size-vs-fake not hash-delta) → SignalR negotiate (gotcha #25) → EF mig prod==repo.
  • Stage 4.6 (S29 CRITICAL): sqlcmd seed sample verify post-deploy (NOT chỉ schema). Seed=runtime-row-insert (no history/tables advance) → verify via DB-query (e.g. Permissions count), NOT bundle-frozen-alone.
  • Discovery: ASP.NET 10 record enum needs numeric input unless JsonStringEnumConverter (SOL has NO converter → FE sends numeric). sqlcmd ssh Windows-auth \\\\SQLEXPRESS 4-backslash. INFRASTRUCTURE seed MUST run (NOT inside if(!demoSeedDisabled)); DEMO seed gated → gotcha #51.
• Stage 5 Report PASS/FAIL + evidence + MEMORY update.

---

⚠️ Anti-patterns (DO NOT)

1. ❌ Push fix code — READ only, escalate em main · 2. ❌ Speculate fail without log · 3. ❌ Skip post-deploy bundle hash (biggest catch) · 4. ❌ Skip MEMORY · 5. ❌ Poll forever (max 10 iter) · 6. ❌ Auto-rollback (escalate + recommend) · 7. ❌ Verify docs-only (SKIPPED-DOCS return ngay)

---

🧠 SOLUTION_ERP CI/CD essentials (S80 verified — re-ground từ docs/STATUS.md canonical)

• Gitea: git.baocaogiaoduc.vn/vietreport-admin/solution-erp · workflow .gitea/workflows/deploy.yml · paths-ignore ['docs/**','**/*.md','.claude/skills/**']. Anon API works (public repo) when GITEA_TOKEN absent.
• Prod: api/admin/eoffice .solutions.com.vn · SSH ssh vietreport-vps (Administrator, id_ed25519) · IIS phys paths: API C:\inetpub\solution-erp\api · admin \fe-admin · user \fe-user. DB .\SQLEXPRESS/SolutionErp/vrapp SQL-auth. Conn key = ConnectionStrings.Default (NOT DefaultConnection). DB pw = buKL3TGBkD0wDDbYVw65QeX9 (User Id=vrapp; ⚠️ Password field has NO vrapp/ prefix — S89 login-failed when prefix included; read verbatim from prod appsettings.Production.json ConnectionStrings.Default when $env:PROD_DB_PASSWORD empty). ⚠️ skill-doc path C:\inetpub\apps\SolutionErp\Api STALE.
  • SSH→PS quoting (S42): nested bash→ssh→powershell mangles $var/\" → use iconv UTF-16LE | base64 → powershell -EncodedCommand $B64; OR write ps1-file + powershell -File $(cygpath -w). sqlcmd over SSH direct -W -h -1 pw-inline. sys-catalog string-concat → COLLATE DATABASE_DEFAULT (collation conflict).
• Tests baseline: 419 PASS (45 Domain + 374 Infra · 0 fail/skip; S89 Run #348 sha 1aa3bdb — 413 + 6 D2 multi-winner [CreateContractFromEvaluationMultiWinnerTests + PeListWinnerNamesProjectionTests]; prior S88-quad #347 413). Phase 9 UAT skip per chunk OK.
• Mig latest repo: Mig 59 20260624084608_AddCcmBudgetPeriodToPurchaseEvaluation (S88 #345; PE +1 AddColumn CcmBudgetPeriodAmount decimal(18,2) NULL no-backfill — VERIFIED-APPLIED-PROD history-HEAD + col-exists 0-nonnull). Prev Mig 58 AddPeMultiWinnerAndLevelFinalize (S87 #344). Path src/Backend/SolutionErp.Infrastructure/Persistence/Migrations/. Prod check sqlcmd __EFMigrationsHistory ORDER BY MigrationId DESC TOP 5. ⚠️ sys.tables (is_ms_shipped=0) = 88 (S61 Budget-replace DROPPED 93→88 — narrative-93 STALE; when commit touches no schema, 88 correct, don't FAIL on 88. Always cross-ref COMMIT scope vs ambient count). enum-additive (e.g. ApprovalAttachment=5) = int-stored NO-mig → expect history NOT-advance + empty git diff -- '*Migrations*'.
• Bundle hash live (S89 Run #348): admin js BQq2eTP6/css Pltrs5ku · user js dHa64I59/css Foiw55B6 (JS BOTH ROTATED from #347 CP_iKhTu/DUe0fndl by real fe-src D2 PeDetailTabs+PeListPanel; css FROZEN Pltrs5ku/Foiw55B6 = #347/#346 — correct, D2 FE logic-only no new utility class). ⚠️ PER #69: hash MAY rotate per deploy OR stay frozen if 0 fe-src diff (byte-identical) — SNAPSHOT for THIS run, NOT a frozen baseline. Real FE ship = diff fe-*/src in commit/range + real-size-vs-fake (1.6/1.5MB vs ~919b SPA-trap), NOT hash delta. ASYMMETRIC-deploy framing (S66) RETIRED by #69.
• Bearer: admin admin@solutions.com.vn/Admin@123456 (full) · UAT nv.test@solutions.com.vn/TestUser@123456 (Drafter CCM, gotcha #44 check).

🔑 Critical config (flag commit nếu tái xuất)

Node CI 20.x (feedback_node_cicd) · MediatR 12.4.1 (gotcha #1, flag Version="14) · Swashbuckle 6.9.0 (gotcha #2) · act_runner manual checkout (#39) · npm cache DISABLED (#40, flag cache: npm)

---

🎯 Per-NV admin opt-in wire — 10-point checklist (cumulative S22→S23)

Cross-ref feedback_per_nv_permission_scope. Per-NV/per-Level refactor MUST verify: 1 Domain field · 2 EF HasDefaultValue(false) · 3 Mig 3-file · 4 Service read · 5 Domain+App DTO mirror · 6 Designer FE checkbox · 7 AwLevelDto+ToDto · 8 CreateAwLevelInput+Update mutation · 9 Lookup discrimination (FirstOrDefault ADD ApproverUserId==actorId + admin fallback) · 10 Controller body record count == Command record count. Bug latency 2-3 days prod silent khi miss 9-10. Scan grep -n "FirstOrDefault.*Order.*==" *.cs after OR-of-N refactor.

📊 Run stats baseline

BE (test+build) ~90s · FE × 2 ~60s/app · deploy ~30s · total ~3min code / 0s docs-only. >5min → escalate. Recent runs all ~4m40-5m.

---

📅 Recent runs (compressed — full verbatim → archive/2026-06.md via archive/_INDEX.md)

• S89 #348 (id=462) 1aa3bdb PASS ~5m10s (FULL-STACK PE D2 multi-winner outward, NO-MIG) — create-contract 1→N per winner (command→List, multi-winner handler in CreateContractFromEvaluationFeatures, Controller returns {contractIds}) + list-card winner-names projection (PurchaseEvaluationFeatures + Dtos WinnerSupplierNames). Files 12: BE 4 (Controller/CreateContractFromEvaluationFeatures/Dtos/PurchaseEvaluationFeatures) + FE both apps 6 (PeDetailTabs+PeListPanel+types ×2) + 2 test (CreateContractFromEvaluationMultiWinnerTests + PeListWinnerNamesProjectionTests). NO *Migrations*/*Persistence* in diff (git diff EMPTY — logic-only, no schema). status=success ⟹ test gate passed (baseline 419 = 45 Domain + 374 Infra = 413 +6; logs 404 anon so count not log-scraped — trusted gate+baseline). Bundle JS BOTH ROTATE (real fe-src PeDetailTabs+PeListPanel ⟹ new content-hash): admin js CP_iKhTu→BQq2eTP6 · user js DUe0fndl→dHa64I59 (#347 baseline); css FROZEN admin Pltrs5ku user Foiw55B6 = #347/#346 — correct, D2 FE logic-only no new utility class (gotcha #69-inverse). Real-ship proven (SPA-trap defeated): admin js 1,628,901b Last-Modified 03:34:13Z=10:34+07 in-window (run 10:30:30→10:35:40 = 03:30:30→03:35:40Z) · user js 1,532,802b 03:35:07Z in-window · control fake ZZfakehash00.js→200 but 919b text/html (size-check meaningful). BE dll ALL 4 fresh in-window: Api 03:33:00Z (Controller {contractIds} live) · Application 03:31:04Z (CreateContractFromEvaluation multi-winner handler + PE winner-names projection live) · Infrastructure 03:31:28Z · Domain 03:30:47Z. Mig FROZEN 59 (repo MIGCOUNT=59 + prod history HEAD==AddCcmBudgetPeriodToPurchaseEvaluation==repo + HistCount=59 no-pending) + sys.tables 89 incl __EFMigrationsHistory = 88 business (no schema change). Endpoint live: POST /api/purchase-evaluations/{id}/create-contract bodyless→411 (IIS Length-Required pre-auth), +json-body→401 (wired: NOT 404=route-exists, NOT 500=no-crash; {contractIds} multi-winner contract live). Health api ready/live + admin + eoffice 4×200. GET /api/purchase-evaluations + /api/menus + /api/approval-workflows-v2 all 401 unauth (wired). gotcha #69-inverse re-confirmed (real fe-src ⟹ js rotates, css frozen when logic-only). ⚠️ DB pw = buKL3TGBkD0wDDbYVw65QeX9 (NOT vrapp/buKL3... — vrapp/ was user/pw-combined-notation in memory essentials, actual Password field has no prefix; read from prod appsettings.Production.json ConnectionStrings.Default). SSH→PS $_.LastWriteTimeUtc mangled in nested double-quote → base64 EncodedCommand worked; sqlcmd -Q quoting mangled → scp .sql + -i file worked cleanest. conn key ConnectionStrings.Default, prod path C:\inetpub\solution-erp\api.
• S88-quad #347 (id=461) 73cce1f PASS ~5m04s (FULL-STACK PE D1 stability, NO-MIG) — Block-B multi-winner financials re-key (PurchaseEvaluationFeatures) + CEO-notify SaveChanges-persist (PurchaseEvaluationUrgentFeatures +5 lines) + setter RELOCATE PeSuggestedPriceFeatures→PeWorkItemBudgetFeatures (−56/+57) + HoSoLink trim + #70 guard + Dtos comment. Files 12: BE 5 (Dtos+4 features) + FE both apps 4 (PeDetailTabs+types ×2) + 3 test (PeHoSoLinkTests+PeWorkItemBudgetTests EXTEND, new PeUrgentNotifyDirectorTests +237 lines). NO *Migrations*/*Persistence* in diff (logic-only re-key, no schema). status=success ⟹ test gate passed (baseline 413 = 45 Domain + 368 Infra = 402 +11; logs 404 anon so count not log-scraped — trusted gate+baseline). Bundle JS BOTH ROTATE (real fe-src #70-guard+HoSoLink-trim ⟹ new content-hash): admin js BABhPh2s→CP_iKhTu · user js DLulO6uP→DUe0fndl (#346 baseline); css FROZEN admin Pltrs5ku user Foiw55B6 — correct, D1 FE logic-only no new utility class. Real-ship proven: admin js 1,628,726b Last-Modified 02:57:57Z=09:57+07 in-window (run 09:54:15→09:59:19 = 02:54:15→02:59:19Z) · user js 1,532,627b 02:58:50Z in-window · SPA-trap control ZZfakehash00.js→200 but 919b text/html (size-check meaningful). BE dll ALL 4 fresh in-window: Api 02:56:42Z · Infrastructure 02:55:16Z (PeWorkItemBudgetFeatures setter-relocate live) · Application 02:54:51Z (PurchaseEvaluationFeatures Block-B + UrgentFeatures CEO-persist live) · Domain 02:54:36Z. Mig FROZEN 59 (MIGCOUNT=59, prod history HEAD==AddCcmBudgetPeriodToPurchaseEvaluation==repo, no-pending; correct NO-MIG D1) + sys.tables 88 (89 incl __EFMigrationsHistory). Health api ready/live + admin + eoffice 4×200. GET /api/purchase-evaluations + /api/menus + /api/approval-workflows-v2 all 401 unauth (wired NOT 404/500). gotcha #69-REFINE inverse re-confirmed (real fe-src ⟹ js rotates, css frozen when logic-only). conn key ConnectionStrings.Default, prod path C:\inetpub\solution-erp\api (skill-doc \apps\... STALE). ⚠️ SSH→PS table-count <>'literal' mangled via base64/CLIXML AGAIN → use count-incl-history−1 (88) workaround.
• (S88-bis #346 0d3c0cf FE-only PE layout "4. Thông tin chọn thầu" 2-files js+css-BOTH-rotate baseline-402 · S88 #345 9b1ee0c FULL-STACK Section-B 3-col + Mig 59 AddCcmBudgetPeriodToPurchaseEvaluation AddColumn-no-backfill VERIFIED-PROD + setter PATCH .../budget/ccm-period PATCH-401-not-411 + 7 authz-test → PASS, FIFO-trimmed, full verbatim git + archive _INDEX)
• S87 #344 (id=458) f1b10e9 PASS ~5m11s (FULL-STACK PE CCM 3-fix + Mig 58, anh Kiệt FDC) — multi-winner SUM (SelectWinner→SupplierIds[] array body) + budget=0 valid-submit + per-level auto-finalize (ApproveV2Async if matchingLevel.AllowApproverFinalize). Files: BE 13 (Controller/App/Domain/Infra/Service + Mig 3-file) + FE BOTH apps 7 (PeDetailTabs/PeWorkflowPanel/types ×2 + fe-admin ApprovalWorkflowsV2Page Designer) + 6 test. Mig 58 20260624071509_AddPeMultiWinnerAndLevelFinalize = 2 AddColumn bit (PurchaseEvaluationSuppliers.IsWinner default0 + ApprovalWorkflowLevels.AllowApproverFinalize default0) + 1 backfill UPDATE ... SET IsWinner=1 WHERE pes.SupplierId=pe.SelectedSupplierId — VERIFIED-APPLIED-PROD (history top==AddPeMultiWinnerAndLevelFinalize==repo HEAD; both cols sys.columns=1; backfill ran: winners=13 == pe_with_SelectedSupplierId=13 / 30 total supplier rows — exactly 1 winner per pre-existing selected PE). Test gate=success ⟹ passed (baseline 395 = 45 Domain + 350 Infra per spec; was 397 −2 because per-level-finalize moved runtime-flag→auto-config, NOT regression). Bundle BOTH ROTATE (real fe-src ⟹ new content-hash, contrasts #69-REFINE BE-only): admin js aKuNip19→CXCKlNay (css FROZEN BKB2NsgQ, logic-only diff no new chunk), user js BUsL0HeQ→Di40ewrF (css FROZEN BaqeI4iG). Real-ship proven: admin js 1,621,660b Last-Modified 08:26:32Z=15:26+07 in-window · user js 1,525,569b 08:27:26Z in-window · control fake-hash ZZfakehash0.js→200 but 919b text/html (SPA-trap confirms 200-alone meaningless). Endpoint live: POST /api/purchase-evaluations/{id}/select-winner bodyless→411 (IIS Length-Required pre-auth), +json-body→401 (wired, NOT 404/400/500; SelectWinnerBody(IReadOnlyList<Guid>? SupplierIds)→SelectPurchaseEvaluationWinnerCommand array contract live). Health api ready/live + admin + eoffice 4×200. ⚠️ ambient sys.tables=89 (was 88) — NOT from Mig 58 (AddColumn-only, 0 new table; newest table PeWorkItemBudgets 06-13 Mig 50, none created 06-24); 88 baseline last re-grounded S62, +1 pre-existing drift in Mig 50-57 range, harmless. ⚠️ prod path C:\inetpub\solution-erp\api (skill-doc \apps\SolutionErp\Api STALE — re-confirmed); conn key ConnectionStrings.Default; base64 EncodedCommand + 1 path-retry. gotcha #69-REFINE inverse confirmed (real fe-src ⟹ hash DOES rotate).
• S86 #343 (id=457) ae4f106 PASS ~5m00s (BE-ONLY notify-filter) — PE "cần duyệt" notify EXCLUDE drafter + 1 new test (PeApproverNotifyExcludesDrafterTests) + STATUS + agent-memory. Only-BE-src: 1 file PurchaseEvaluationWorkflowService.cs, ZERO fe-*/src, ZERO *Migrations*. status=success ⟹ test gate passed (baseline 377 = 45 Domain + 332 Infra per spec; S85 374 +3; reviewer's 2 transient parallel-collection flake did NOT surface red in CI — gate green). Ship-proof #69-REFINE (BE-only) CONFIRMED via dll Last-Modified in run-window (16:37:38→16:42:35+07 = 09:37:38→09:42:35Z): Api.dll 09:40:04Z · Application.dll 09:38:12Z · Infrastructure.dll 09:38:34Z (PurchaseEvaluationWorkflowService lives in Infrastructure → recompiled fresh) — all 3 in-window. FE bundle FROZEN (correct, 0 fe-src diff ⟹ byte-identical): admin aKuNip19/BKB2NsgQ, user BUsL0HeQ/BaqeI4iG = S85 baseline. Mig FROZEN 57 (AddPeSuggestedPriceNotes, prod head==repo) + tables 88. Prod 4×200 (api ready/live, admin, eoffice) + PE wired (GET /api/purchase-evaluations + /api/menus both 401 unauth, NOT 404/500). Notify-filter BE-internal no-new-endpoint → test 377 covers behavior (no curl-probe of notify logic). gotcha #69-REFINE reaffirmed (BE-only: dll Last-Modified = sole ship-proof, hash-delta N/A). ⚠️ SSH transient drop ×3 mid-session (Connection closed by 103.124.94.38) — base64 EncodedCommand + retry-loop recovered; not a deploy issue.
• S85 #342 d4f6021 PASS ~5m00s (DOCS+SQL NO-OP, INVERTED criteria) — 6×.md + scripts/s85-wipe-uat-data.sql (only non-ignored path → CI triggers; whole-workflow still builds FE+publish). PASS-when-FROZEN, NOT rotate. Verified: status=success ⟹ test gate passed (baseline 374 = 45 Domain + 329 Infra per STATUS.md canonical, logs API 404 anon so count not log-scraped — trusted gate+baseline) + bundle FROZEN admin aKuNip19/user BUsL0HeQ (correct: 0 fe-src diff ⟹ byte-identical ⟹ same hash, gotcha #69-REFINE) but DID ship (admin js Last-Modified 08:56:34Z=15:56+07 IN-window 15:53→15:58, real 1.62MB/user 1.52MB vs SPA-trap 919b, 2nd-fetch byte-stable). Prod 4×200 (ready/live/admin/eoffice) + endpoint smoke 4×200 (PE/awf-v2/menus/projects). Prior S85 deploys still live: R6 TZ fix 49ac086 → createdAt:"…7331140Z" trailing-Z CONFIRMED; R5 UpdateDraft 1263c0d → both ancestors of d4f6021, shipped via #341 (#340 cancelled but #341 success built later commit incl TZ). SignalR negotiate 411 (bodyless-POST IIS, wired, notif untouched). gotcha #73 (TZ) + #69-REFINE reaffirmed.
• S83 #333 fc1f19d PASS ~4m59s — BE-only PE-guard (require ApprovalWorkflowId V2 at create-validator + submit-branch ConflictException; close FE-only-validation gap → phiếu reached "Đã gửi duyệt" w/ null workflow = V1-legacy-banner trap). +2 validator tests → test 356 (gate=success ⟹ pass). NO-mig (frozen 57, prod head AddPeSuggestedPriceNotes==repo, no-pending) + ZERO fe-*/src diff. Bundle hash UNCHANGED (admin CsJetgZH/user BVS0ApIm = #330) BUT shipped — Last-Modified 17:10:35/17:11:27 in-window (real js 1.62/1.52MB vs SPA-trap 919b) → gotcha #69-REFINE: 0-FE-src ⟹ byte-identical ⟹ same-hash; Last-Modified is true ship-proof. Guard BE-only no-endpoint → no curl-probe (356 tests cover RED→GREEN). Health api/ready+live 200, admin/eoffice 200, api-root 404 (no / route, expected).
• S78 #330 7886fd0 PASS ~4m56s — cross-stack NO-MIG enum ApprovalAttachment=5 (attach-on-approve) + FE 2-app PeWorkflowPanel modal-upload. Verified: empty-migrations-diff + Mig-frozen-57 + tables88 + bundle BOTH rotate js+css (real 1.6/1.5MB vs fake-919b) + endpoint bodyless-POST-411→re-probe-body-401-wired + health 4×200. → _INDEX.
• S76 #318 e33481e PASS ~4m58s — full-stack Mig56 ProInitial/ProAdjust VERIFIED-APPLIED-PROD (sys.columns decimal(18,2)) + 5th-axis BACKFILL-verify 4-rows-0-violation (gotcha #64 prod-data-UPDATE-first-time) + history-advance-55→56 + tables88 + bundle BOTH+css rotate + health 4×200. Pre-deploy DB snapshot (Mig55) → post (Mig56) = unambiguous proof. → _INDEX.
• (S83 #325 e29391e FE-only budget-subitem indent js-rotate-css-FROZEN test351 · S77 #329 e823694 FE-only banner Trả-lại · #328 424131d BE-only notify-block test-gate-KEY · #327 fa6654b FE-list-restructure · #326 b5aa72d BE-authz asymmetric · #323 #322 #321 #320 PE UX batch → all PASS, FIFO-trimmed, full verbatim git + archive _INDEX)
• (S74-bis #315 8655ebf Mig55 CcmNote · S73 #313 1d86abc Mig54 5-cols + endpoint-401-not-404-probe · S69b #307 1f8947e Office-golive seed-16/16-DB-query-proof → archive _INDEX + git)
• Older runs (S75 #301 ← S62 #286 ← … → S29 #232) full verbatim → git d2f52ba + archive/2026-06.md (incl #291 06-16 FAIL forensic [gotcha #65]); pre-S38 → archive/2026-05-{runs,q2,q3,q4}.md.

---

🔄 Curate trigger

• ~30KB → archive recent runs → L2 archive/<period>.md (byte-exact append) + _INDEX.md substring pointer. Dup failure patterns → merge. Stale >3mo → remove.

• Last curate: 2026-06-20 S80 (em-main, archive-gate keep-floor-hit → manual) (38.8→~16KB): moved 3 huge run-entries #330/#318/#325 (lines 73/90/96 byte-exact via sed) → archive/2026-06.md (100.6→116.7KB) + _INDEX.md +3 substring pointers (verified count=1). KEPT foundation (bug-patterns/5-stage/10-point gold) + compressed essentials + run-stubs; UPDATED stale (130→354 test Stage-3 + 263→354 essentials, Mig 55→57, bundle→#330) + dropped verbose per-run bundle-history (S86/S85/S84 → archived run-entries).
• Prev curate: 2026-06-17 S70 Harness-9 (65.2→23.2KB dark-matter recovery, built _INDEX/gist gen:1). Prev S66 (86.8→29.2KB). Prev S40 (35.3→~21KB).