fix: support internal AgentBus attachments

.project-docs/30-worklog/current-state.md

@@ -4,42 +4,47 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
 
 ## Integrated Through
 
-- Commit `7b5d855b093af39bf834fab4f41f41b37be1170d` as the inspected repository baseline.
-- Integration task `20260828-migrate-project-docs-6f1a9c2d` for the project-documentation migration.
+- Commit `c4c469f4441d744627af2d34abe693b6783e833c` for the independently advanced remote deployment/extension line.
+- Commit `cd45ce17d0fcd25f7fa89ab9f8a391d3e904ecdf` for WeChat attachment correlation and privacy-safe server diagnostics.
+- Integration task `20260831-integrate-server-diagnostics-8b42c6d1` for mainline reconciliation and trusted-intranet attachment compatibility.
 
 ## Current Focus
 
-Operate the current `0.5.157` release baseline safely, keep Program/AI routing and ERP execution boundaries synchronized, and close the remaining authorization-dependent validation gaps.
+Operate the current `0.5.163` extension release baseline safely, keep Program/AI routing and ERP execution boundaries synchronized, and prepare the integrated control-plane revision for a separately authorized deployment.
 
 ## Recently Completed
 
 - 2026-08-28: Initialized `.project-docs/`, migrated durable project memory, and retired the root Planning with Files system into date-scoped history.
-- 2026-08-28: Released Chrome extension `0.5.157`, Program parser `v1.0.6`, input contract/DOCX `0.5.123`, and five business Skills `0.5.125`.
+- 2026-08-30: Advanced the synchronized Chrome extension/runtime release to `0.5.163`; Program parser remains `v1.0.6`, input contract/DOCX `0.5.123`, and five business Skills `0.5.125`.
 - 2026-08-28: Added narrow shared-mother-plan whole-visitor export using `shared_plan + visitor-list + tid-only` while preserving child/independent `did+tid` behavior.
 - 2026-08-28: Restarted the standard 8786 control plane under authorization and observed AgentBus 4/4 channels ready across repeated samples.
+- 2026-08-31: Integrated strict WeChat envelope conversation fallback, placeholder-only attachment rejection before task ingestion, and safe attachment error summaries while preserving the original `awaiting_attachment` task.
+- 2026-08-31: Integrated structured privacy-safe diagnostics across service, HTTP, task/audit, parser, AgentBus, attachment, database, and cleanup stages, with bounded Docker stdout retention and a read-only server diagnostic command.
+- 2026-08-31: Confirmed from the supplied production log that attachment correlation succeeded and the failure was private/reserved DNS rejection; removed that rejection for the trusted internal deployment while retaining credential-free HTTPS, DNS pinning, redirect validation, size, timeout, and SHA-256 controls.
 
 ## In Progress
 
-- No separate repository feature task is recorded at this integration snapshot.
+- No separate repository feature task is recorded at this integration snapshot; deployment and restart remain unperformed.
 
 ## Next Recommended Steps
 
 1. With explicit authorization, run a live read-only ERP verification of the shared-mother-plan `tid-only` whole-visitor export path.
 2. With explicit authorization, perform ERP write verification for independent-order SGL/TWN and adult/child/leader headcount mappings.
-3. Design a controlled public-DNS or host-allowlist fallback for AgentBus OSS attachments without weakening private-network SSRF blocking.
+3. Under separate deployment authorization, publish the integrated control-plane image with `DEPLOYMENT_REVISION` set and verify one real internal AgentBus roster attachment through the new diagnostic stages.
 
 ## Open Questions / Blockers
 
 - Shared-mother-plan whole-visitor export has historical read evidence and static coverage but lacks a fresh authorized runtime ERP read verification.
 - Independent-order SGL/TWN and four headcount categories lack authorized current-version ERP write evidence.
-- Some AgentBus OSS attachment URLs can be rejected when local DNS resolves them to private or reserved addresses.
+- The repository fix for internal attachment URLs is not active on the server until a separately authorized image build/deployment/restart occurs.
 
 ## Risky Areas
 
 - Any ERP write, uncertain post-write state, automatic retry, or scope widening.
 - Passenger workbook normalization, encrypted attachment persistence, leader-contact projection, and native ERP row capacity.
+- AgentBus channels and their upstream bridge are now a trusted network boundary because attachment URLs may target internal HTTPS hosts.
 - Release synchronization across extension source, minimum platform version, mapping, ZIP, Skills, DOCX, and `dist/release-manifest.json`.
 
 ## Last Updated
 
-2026-08-28
+2026-08-31