fix: require exact ERP account identity

mappings/lifecycle.mapping.json

@@ -1,7 +1,7 @@
 {
   "contract_version": "ltjt-lifecycle-v2.9-roster-leader-contact-2026-08",
   "current_agent_parse_prompt_version": "ltjt-agent-prompt-v1.8-independent-headcount-categories",
-  "current_extension_version": "0.5.167",
+  "current_extension_version": "0.5.168",
   "historical_test_marker": "TEST-202609",
   "scope": "/System/Business/",
   "erp_session_keepalive": {
@@ -31,6 +31,17 @@
       "failure_policy": "record structured recovery status and require manual login/inspection; an interrupted MV3 service worker recovery is normalized out of running and the next successful read-only probe returns the recovery state to idle; never retry a business operation"
     }
   },
+  "erp_account_identity": {
+    "source": "the unique #Lable_UserName node in the existing ERP Mainlt.asp document",
+    "comparison": "NFKC-normalized, whitespace-normalized, case-insensitive exact equality with the platform account's configured ERP identity",
+    "forbidden_fallbacks": [
+      "whole-page substring matching",
+      "matching an expected account against unrelated ERP business text",
+      "accepting a missing or duplicate login identity node"
+    ],
+    "privacy": "only matched/present/node-count booleans are returned to the platform; the observed ERP account text remains inside the extension session probe",
+    "failure_policy": "missing, duplicate, blank, or non-equal ERP identity is not execution-ready"
+  },
   "operation_timing": {
     "schema_version": "ltjt-operation-timing-v1",
     "scope": "all plugin business executions through the shared result state machine",