docs: reconcile dashboard query integration

.project-docs/20-architecture/data-flow.md

@@ -15,7 +15,7 @@
 | WeChat roster attachment | Strict transport envelope plus one structured `payload.attachments[]` entry | Existing `awaiting_attachment` task | Explicit conversation ID wins; otherwise strict `Conversation:` supplies the fallback. Placeholder text alone never creates a task. |
 | Internal attachment download | Credential-free HTTPS URL | Bounded in-memory workbook bytes | Internal/private DNS answers are allowed; the selected address is pinned, every redirect is revalidated, and URL/host/IP/bytes are omitted from logs. |
 | Operational diagnostics | Service, request, task, parser, AgentBus, attachment, database, and cleanup stages | Structured stdout/stderr and bounded Docker logs | Correlation identifiers, codes, outcomes, and durations only; no secrets or business payloads. |
-| Platform operations oversight | Durably assigned manual/AgentBus task, encrypted instruction history, and readable outcome | Team-lead-only leadership projection | Immutable assignee is the employee dimension; unassigned historical AgentBus rows are excluded. Display-only summaries plus explicit filters drive an aggregate-first task/person/input/output/time/type/completion view, with bounded list reads and page-only detail hydration. |
+| Platform operations oversight | Durably assigned manual/AgentBus task, encrypted instruction history, and readable outcome | Team-lead-only leadership projection | Immutable assignee is the employee dimension; unassigned historical AgentBus rows are excluded. Display-only summaries plus explicit filters drive an aggregate-first task/person/input/output/time/type/completion view. Range-wide candidate reads exclude complete operation JSON; only unresolved legacy classification receives compact action/kind/mode fields, while complete payload hydration stays limited to keyword search and the current 20-row page. |
 | Leader task summary | Future stable manual/AgentBus task outcome for a durably assigned non-admin employee | Privacy projection → encrypted organization/revision outbox → fixed external Webhook → leader group | Independent from AgentBus task replies and ERP execution; strict success means accepted, not delivered, and rejected/uncertain attempts terminate without automatic retry. |
 | Shared-child batch creation | Inclusive departure range plus exact product/customer/counts | Complete read-only parent enumeration → validated date/tid target list → sequential single-child adapter reuse | All targets are known before the first write; execution is deterministic and stops at the first blocked, failed, or uncertain result with remaining targets not started. |
 | Browser worker selection | Immutable task assignee | One fresh account-bound browser connection | The heartbeat must prove the expected ERP identity from one unique login node by normalized exact equality; missing, duplicate, blank, substring-only, or mismatched identity is non-executable, with failover only after staleness. |