diff --git a/TESTER_TRACKER.md b/TESTER_TRACKER.md
new file mode 100644
index 00000000..92d0abea
--- /dev/null
+++ b/TESTER_TRACKER.md
@@ -0,0 +1,154 @@
+# QA Tester Tracker — Post-Fix Regression Testing
+
+> Generated: 2026-03-13 | Source: Wave 1-3 code fixes across 22 services
+> Status: IN PROGRESS
+
+---
+
+## Test Strategy
+
+Sau khi fix 202 files across 22 services, cần regression test để đảm bảo:
+1. Auth changes không block legitimate users
+2. Handler bug fixes hoạt động đúng
+3. Response format changes không break frontend
+4. Template artifact fixes không break DB connections
+
+---
+
+## Test Environment
+
+- **Frontend**: http://localhost:3001 (Blazor WASM POS)
+- **Backend BFF**: http://localhost:3001/api/bff/
+- **IAM**: http://localhost:5001
+- **Merchant**: http://localhost:5005
+- **Booking**: http://localhost:5020
+- **Docker**: `docker compose` in deployments/local/
+
+### Test Accounts
+| Account | Password | Role |
+|---------|----------|------|
+| hongochai10@icloud.com | Velik@2026 | Admin/Owner |
+| tranvanb@goodgo.vn | Staff@2026 | Cashier |
+| tranvanc@goodgo.vn | Staff@2026 | Waiter |
+| tranvand@goodgo.vn | Staff@2026 | Kitchen |
+| tranvane@goodgo.vn | Staff@2026 | Manager |
+
+---
+
+## P0 — Critical Path Tests (Must Pass)
+
+### T1: Admin Login + Dashboard
+- [ ] Navigate to /auth/login/admin
+- [ ] Login with hongochai10@icloud.com / Velik@2026
+- [ ] Dashboard loads without errors
+- [ ] Sidebar navigation works (all menu items)
+- [ ] Shop selector works
+
+### T2: Staff Login + Dashboard
+- [ ] Navigate to /auth/login/staff
+- [ ] Login with tranvanb@goodgo.vn / Staff@2026 (Cashier)
+- [ ] Staff dashboard loads
+- [ ] Sidebar shows correct role-based menu
+- [ ] User name displays correctly (not "Guest")
+
+### T3: Admin → Shop Management
+- [ ] Navigate to /admin/shop/{shopId}
+- [ ] Shop details load
+- [ ] Staff list loads with names and roles
+- [ ] Can view staff attendance records
+
+### T4: Admin → Schedule Management
+- [ ] Navigate to /admin/shop/{shopId}/schedule
+- [ ] Schedule table loads with staff names + roles
+- [ ] Can add new schedule (Thêm ca)
+- [ ] Can delete schedule
+- [ ] Time displays correctly (HH:MM format, no seconds)
+
+### T5: Staff → Schedule View
+- [ ] Login as staff (tranvanb)
+- [ ] Navigate to /staff/schedule
+- [ ] Week view shows correct shifts
+- [ ] Shift detail section shows grouped schedules
+- [ ] "Nghỉ" shown for days without shifts
+
+### T6: Staff → Attendance
+- [ ] Navigate to /staff/attendance
+- [ ] Attendance records load
+- [ ] Check-in/Check-out buttons work
+- [ ] Time displays in local timezone
+
+### T7: Staff → Leave Requests
+- [ ] Navigate to /staff/leave
+- [ ] Leave request list loads
+- [ ] Can submit new leave request
+- [ ] Status displays correctly
+
+### T8: Admin → Leave Request Approval
+- [ ] Navigate to /admin/shop/{shopId}/leave-requests
+- [ ] Pending requests display
+- [ ] Can approve/reject requests
+
+---
+
+## P1 — Functional Tests (Should Pass)
+
+### T9: API Response Format
+- [ ] Check browser DevTools Network tab
+- [ ] All API responses have { success: true, data: ... } format
+- [ ] Error responses have { success: false, error: { code, message } }
+
+### T10: Auth Token Flow
+- [ ] Login → token stored in localStorage (aPOS_token_admin / aPOS_token_staff)
+- [ ] Navigate between pages → token persists
+- [ ] Logout → token cleared
+- [ ] Re-login → fresh token works
+
+### T11: Multiple Role Sessions
+- [ ] Login as admin in one tab
+- [ ] Login as staff in another tab
+- [ ] Both sessions work independently (no token conflict)
+
+---
+
+## P2 — Edge Case Tests (Nice to Pass)
+
+### T12: Unauthorized Access
+- [ ] Try accessing /admin/* without login → redirects to login
+- [ ] Try accessing /staff/* without login → redirects to login
+
+### T13: Empty States
+- [ ] Staff with no schedules → "Chưa có lịch làm việc" message
+- [ ] Staff with no attendance → empty state message
+- [ ] Staff with no leave requests → empty state
+
+### T14: Error Handling
+- [ ] Stop a backend service → frontend shows error gracefully
+- [ ] Invalid API response → no crash, error notification shown
+
+---
+
+## Progress Tracking
+
+| Test | Status | Tester | Notes |
+|------|--------|--------|-------|
+| T1: Admin Login | ✅ PASS | Claude | Dashboard loads, user "hongochai10" correct |
+| T2: Staff Login | ✅ PASS | Claude | "Xin chào, Văn Bình!", role Cashier, shop Cobic Coffee |
+| T3: Shop Management | ✅ PASS | Claude | Cobic Coffee overview, 18 SP, 2 NV, sidebar full |
+| T4: Admin Schedule | ✅ PASS | Claude | 5 ca, 2 NV, time 08:00-17:00, T2-T6 correct |
+| T5: Staff Schedule | ✅ PASS | Claude | Week view T2-T6, T7+CN Nghỉ, today highlighted |
+| T6: Staff Attendance | ✅ PASS | Claude | 13/03 T6 vào 14:02, "Đang làm" |
+| T7: Staff Leave | ✅ PASS | Claude | Empty state + "+ Xin nghỉ phép" button |
+| T8: Admin Leave Approval | ✅ PASS | Claude | Empty state "Chưa có yêu cầu nghỉ phép nào" |
+| T9: API Response Format | 🔄 TODO | — | Need DevTools Network check |
+| T10: Auth Token Flow | ✅ PASS | Claude | Both admin+staff tokens persist across pages |
+| T11: Multiple Role Sessions | ✅ PASS | Claude | Admin + Staff tabs independent, no conflict |
+| T12: Unauthorized Access | 🔄 TODO | — | — |
+| T13: Empty States | ✅ PASS | Claude | Leave empty states verified on both admin+staff |
+| T14: Error Handling | 🔄 TODO | — | — |
+
+---
+
+## Known Issues (Pre-existing)
+- mkt-facebook-service: No EF migrations (needs `dotnet ef migrations add`)
+- ads-billing-service: InvoiceId1 shadow FK (needs new migration to drop)
+- Payment UI not wired to real gateway