docs: finalize account routing integration

.project-docs/30-worklog/tasks/20260903-finalize-account-routing-7c4e2a91.md

@@ -0,0 +1,58 @@
+# Task: Finalize account-scoped ERP routing and force delete
+
+## Identity
+
+- Task ID: 20260903-finalize-account-routing-7c4e2a91
+- Mode: Integration
+- Branch: codex/20260903-finalize-account-routing-7c4e2a91-finalize-account-routing
+- Worktree: /Users/inmanx/Documents/lwltAPI-finalize-account-routing-7c4e2a91
+- Base commit: d09b3032c0d7b997e6974ff16b9210e9c04bacd3
+- Owner: codex
+- Status: Ready for integration
+
+## Scope
+
+- Use completed feature commit `d09b3032c0d7b997e6974ff16b9210e9c04bacd3` as the Integration baseline for account-scoped ERP queues, explicit force deletion, and assignee-only executable routing.
+- Reconcile the user-confirmed product decision into accepted ADRs, canonical architecture, domain rules, current state, evidence, commitments, and the cross-business registry.
+- Run the complete repository, control-plane, legacy, build, project-document, and task-drift verification gates.
+- Push the verified integration tip to remote `main` with a normal non-force update while preserving the separately occupied local `main` worktree.
+
+## Intent And Constraints
+
+- The user explicitly authorized merging and pushing, and explicitly superseded AUTH-001's organization-wide ERP FIFO and archive-only removal clauses.
+- Same-account tasks remain serialized in deterministic FIFO order; different assigned accounts must not block one another.
+- Administrator-wide read visibility does not authorize receiving or processing another account's executable SSE, plugin result, browser claim, or cleanup command.
+- Archive/restore remains available as a reversible workflow; force delete is an irreversible platform-record deletion regardless of task state and cannot roll back ERP effects already written.
+- Do not touch the occupied local `main` worktree, adopt its untracked task record, deploy, restart services, mutate runtime tasks, operate ERP, or inspect secrets.
+- Before pushing, verify the remote branch has not advanced unexpectedly; never force-push.
+
+## Outcome
+
+- Used completed source commit `d09b3032c0d7b997e6974ff16b9210e9c04bacd3` as the integration baseline, preserving its task record and the local-main-only diagnosis commit `69ea6d2` in ancestry.
+- Accepted AUTH-002, partially superseding AUTH-001's organization-wide FIFO and archive-only clauses. Canonical state now records per-assignee FIFO/single-active execution, cross-account independence, and strict separation of administrator reads from executable SSE, claims, plugin results, and browser cleanup commands.
+- Promoted reversible archive/restore and explicit permanent force delete as separate behaviors. Force delete is lifecycle-independent platform-record removal with minimal audit evidence, post-commit best-effort cleanup, and no claim of ERP rollback.
+- Updated architecture, data flow, business rules, success criteria, current state, evidence, rollout commitments, and the cross-business registry without changing extension source/version or release artifacts.
+- The integrated tree passed the complete repository suite and is ready for a fresh remote-ancestry check and normal non-force push to `origin/main`.
+- No deployment, service restart, extension reload, live task mutation, ERP operation, or secret access occurred.
+
+## Verification
+
+- `node --run check:repo` — passed, 10/10.
+- `node --run check` — passed.
+- `node --run test:control-plane` — passed, 162/162.
+- `node --run test:legacy` — passed, 268/268.
+- `node --run build` — passed.
+- `git diff --check` — passed.
+- `check_project_docs.py` — passed.
+- `check_doc_drift.py --task-id 20260903-finalize-account-routing-7c4e2a91` — passed with the source task record correctly inside the recorded base.
+- The isolated worktree reused the source worktree's byte-identical locked dependencies through a temporary `node_modules` symlink; the symlink was removed after verification.
+
+## Follow-ups
+
+- Before pushing, fetch and prove that the latest remote `main` remains an ancestor of this verified integration tip; never force-push.
+- Deployment, service restart, migration 018 application, extension reload, and the administrator-plus-two-employees runtime matrix remain separate work requiring explicit authorization.
+- The future runtime matrix should cover same-account FIFO, cross-account independence, administrator executable-feed isolation, mismatched ERP identity, same-account worker conflict, stale failover, and waiting/active force-delete cleanup.
+
+## Promotion Candidates
+
+- None. The user-confirmed queue, routing, and deletion decisions were promoted by this Integration task.