docs: reconcile AgentBus and dashboard integration

.project-docs/30-worklog/current-state.md

@@ -19,10 +19,14 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
 - Integration task `20260902-dashboard-mobile-integration-e28c` for canonical reconciliation of the mobile leadership-dashboard behavior.
 - Merge commit `a1b2d2f` integrating source commit `e68fcc1` from task `20260901-roster-header-error-a4f7` for exact ERP-semantic passenger-workbook header detection across rows 1–100, approved aliases, arbitrary column order, and the synchronized `0.5.125` lifecycle Skill and business-instruction DOCX.
 - Integration task `20260902-merge-all-restart-b7e3c91f` for local-branch/worktree reconciliation, canonical roster-contract promotion, full repository/release verification, and the authorized standard-panel restart.
+- Commit `3062ed5` from task `20260902-kanban-filter-7e3a91c4` for bounded single-connection leadership-dashboard queries, SQL business prefiltering, selective search hydration, 20-row pages, cancellation propagation, and timeout feedback.
+- Merge commit `b5f5847` integrating source commit `6f9fd0f` from task `20260902-agentbus-account-routing-b62f19e4` for employee-owned AgentBus channels, immutable task assignees, matching single-browser ERP workers, migration 018, and extension `0.5.164`.
+- Merge commit `cc09506` integrating source commit `b1fe533` from task `20260902-dashboard-metrics-static-a91c` for display-only dashboard metric cards and explicit status filtering.
+- Integration task `20260902-integrate-all-push-c93a7f21` for all-worktree reconciliation, semantic merge resolution, canonical promotion, full verification, and synchronization of `main` to `origin/main`.
 
 ## Current Focus
 
-Operate the current `0.5.163` extension baseline and the deployed fixed-scope account model safely, provision roles and task grants through administrator workflows, use the aggregate-first leadership dashboard for business oversight, and preserve Program/AI plus ERP execution boundaries.
+Operate the repository's current `0.5.164` extension baseline and fixed-scope account model safely, bind each enabled AgentBus channel to one employee/ERP identity, provision narrow route grants, use explicit leadership-dashboard filters, and preserve Program/AI plus organization-wide ERP execution boundaries. Migration 018, extension reload, and service rollout remain separately authorized runtime work.
 
 ## Recently Completed
 
@@ -40,22 +44,28 @@ Operate the current `0.5.163` extension baseline and the deployed fixed-scope ac
 - 2026-09-02: Adapted the authenticated leadership dashboard for direct phone and portrait-tablet use, retained the desktop overview, unified the first metric card with the remaining cards, and removed the separate visible “待跟进” category by presenting those internal states as “进行中”.
 - 2026-09-02: Integrated passenger-workbook normalizer `v1.3.0`; one unique complete ERP-semantic header may appear on row 1 through 100 with arbitrary column order and finite approved aliases, while unknown columns, duplicate semantics, multiple candidates, unsafe formulas, and non-passport data continue to fail closed.
 - 2026-09-02: Restarted the standard `127.0.0.1:8786` control plane from current local `main` after the roster integration; liveness, database readiness, schema migration 017, and repeated listener stability checks passed. AgentBus remained enabled but disconnected, matching the pre-restart observation.
+- 2026-09-02: Integrated migration 018 and extension `0.5.164` so each enabled AgentBus channel binds one non-admin employee, each task keeps an immutable execution assignee, administrators cannot execute another assignee's work, and only one fresh browser with the matching ERP account is execution-ready.
+- 2026-09-02: Reworked leadership-dashboard reads into a bounded one-connection transaction with business SQL prefiltering, selective message hydration, page-only detail hydration, request/database deadlines, and 20-row pages; metric cards are now display-only and explicit filters default to all results.
 
 ## In Progress
 
 - The standard database currently contains one administrator account and no non-administrator task grants. Multi-account operational smoke testing remains for an administrator-led staging window.
+- Migration `018_agentbus_account_workers`, employee ERP identities/channel bindings, extension `0.5.164`, and the merged dashboard runtime have not been applied to or restarted on the standard service in this integration task.
 
 ## Next Recommended Steps
 
-1. With explicit authorization, run a live read-only ERP verification of the shared-mother-plan `tid-only` whole-visitor export path.
-2. With explicit authorization, perform ERP write verification for independent-order SGL/TWN and adult/child/leader headcount mappings.
-3. Through the administrator UI, create representative team-lead and ordinary accounts, assign narrow task grants, and verify owner isolation, leadership dashboard reads, grant/revoke behavior, and denial prompts without ERP writes.
+1. In an explicitly authorized staging/rollout window, back up PostgreSQL, apply migration 018, restart the control plane, load extension `0.5.164`, configure employee ERP identities and channel bindings, and run the multi-cloud-PC/identity/failover matrix before production assurance.
+2. Through the administrator UI, create representative team-lead and ordinary accounts, assign narrow task grants, and verify owner isolation, leadership dashboard reads, grant/revoke behavior, and denial prompts without ERP writes.
+3. With explicit authorization, run a live read-only ERP verification of the shared-mother-plan `tid-only` whole-visitor export path.
+4. With explicit authorization, perform ERP write verification for independent-order SGL/TWN and adult/child/leader headcount mappings.
 
 ## Open Questions / Blockers
 
 - Shared-mother-plan whole-visitor export has historical read evidence and static coverage but lacks a fresh authorized runtime ERP read verification.
 - Independent-order SGL/TWN and four headcount categories lack authorized current-version ERP write evidence.
-- The restarted service now runs current local `main`; a live internal AgentBus attachment verification remains separately unperformed.
+- The standard service was last restarted before commits `3062ed5`, `b5f5847`, and `cc09506`; its runtime schema/extension/dashboard behavior must not be represented as the newly integrated repository state until an authorized rollout.
+- AgentBus account-worker routing still lacks a live two-employee/two-cloud-PC staging matrix covering mismatched ERP login, same-account device conflict, 90-second stale failover, and both manual and automatic channel work.
+- A live internal AgentBus attachment verification remains separately unperformed.
 
 ## Risky Areas
 
@@ -63,6 +73,7 @@ Operate the current `0.5.163` extension baseline and the deployed fixed-scope ac
 - Passenger workbook normalization, encrypted attachment persistence, leader-contact projection, and native ERP row capacity.
 - AgentBus channels and their upstream bridge are now a trusted network boundary because attachment URLs may target internal HTTPS hosts.
 - Account role changes, session revocation, creator-based task-route revocation, cross-user dashboard projection, and encrypted input audit are security-sensitive boundaries.
+- AgentBus channel ownership, immutable task assignment, expected ERP identity, browser-worker freshness/failover, and administrator non-execution are security- and write-safety-sensitive boundaries.
 - Release synchronization across extension source, minimum platform version, mapping, ZIP, Skills, DOCX, and `dist/release-manifest.json`.
 
 ## Last Updated

.project-docs/30-worklog/task-history.md

@@ -7,3 +7,5 @@ This is integrated history. Feature tasks write only their task-scoped records;
 | 2026-08-28 | Project documentation migration | `.project-docs/` became the sole active project-memory system; legacy root planning files were preserved in date-scoped history. | [Integration task](tasks/20260828-migrate-project-docs-6f1a9c2d.md) |
 | 2026-08-28 | AgentBus reconnect | Authorized control-plane restart completed; database, migration 014, and 4/4 channels were repeatedly ready. | [Archived legacy progress](../../archive/project-history/2026-08-28/legacy-planning-with-files-progress-final.md) |
 | 2026-08-28 | Shared mother-plan whole-visitor export | Released strict `shared_plan + visitor-list + tid-only` routing and execution boundaries in extension `0.5.157`. | [Release gate](../../agent设计规范/test-fixtures/lwlt-lifecycle/release-gate.md) |
+| 2026-09-02 | AgentBus account workers | Integrated one-to-one employee channel ownership, immutable task assignment, expected ERP identity, single-fresh-worker enforcement, migration 018, and extension `0.5.164`. | [Integration task](tasks/20260902-integrate-all-push-c93a7f21.md) |
+| 2026-09-02 | Leadership dashboard query and filter contract | Integrated bounded single-connection reads, 20-row paging, cancellation/timeout feedback, display-only metrics, and explicit result filtering. | [Integration task](tasks/20260902-integrate-all-push-c93a7f21.md) |

.project-docs/30-worklog/tasks/20260902-integrate-all-push-c93a7f21.md

@@ -0,0 +1,63 @@
+# Task: Integrate all completed changes and push main
+
+## Identity
+
+- Task ID: 20260902-integrate-all-push-c93a7f21
+- Mode: Integration
+- Branch: main
+- Worktree: /Users/inmanx/Documents/lwltAPI
+- Base commit: 3062ed5f0400d1b90319b58b79cd50445b94ad8e
+- Owner: codex
+- Status: In progress
+
+## Scope
+
+- Audit every local branch and linked worktree against current `main` and `origin/main`, preserving unknown or duplicate working-tree state.
+- Integrate source commits `6f9fd0f` (AgentBus account workers) and `b1fe533` (display-only dashboard metrics) with current `main` commit `3062ed5` (bounded dashboard filtering).
+- Resolve overlapping dashboard, authorization, AgentBus, release, and test changes semantically without regressing accepted mobile/dashboard behavior.
+- Promote accepted AgentBus worker-routing, dashboard display/filter, and bounded-query facts into canonical project memory.
+- Run repository, TypeScript, control-plane, legacy, build, extension/package, and project-doc checks; then push `main` to `origin` without force and verify the remote tip.
+
+## Intent And Constraints
+
+- The user explicitly authorized merging all current changes into the main branch and pushing the result to the repository.
+- Keep the fixed single-organization authorization model, leadership-only read dashboard, business-facing projection, organization-wide ERP FIFO, and existing write-safety gates.
+- Apply the source task's user-confirmed metric-card behavior: summary cards are display-only; explicit form controls own filtering and default to all results.
+- Apply the source task's user-confirmed AgentBus model: one channel binds one non-admin employee account; tasks keep an immutable assignee; only one fresh matching browser/ERP worker may execute for that account; administrators manage and inspect but do not claim another assignee's work.
+- Do not read `.env`, deploy or restart services, apply migration 018, reload the extension, access ERP, mutate runtime tasks/accounts/channels, or send external business data.
+- Do not modify source task records or task-prefixed supporting records. Keep duplicate or already-integrated dirty worktrees untouched after proving their effective changes are represented by commits reachable from `main`.
+- Use a normal non-force push only after all required checks pass and `origin/main` is confirmed not to have advanced unexpectedly.
+
+## Outcome
+
+- Audited all 13 linked worktrees and every local branch after fetching `origin`. The account-system, password, dashboard scale/mobile, roster, prior integration, and older branches are ancestors or patch-equivalent to changes already represented on `main`.
+- Compared every dirty path in the roster source worktree against source commit `e68fcc1`; all 23 paths matched byte-for-byte or matched the recorded deletion, proving that no unique roster product/release change remained outside the already merged history.
+- Kept source-task-only records and superseded/empty operational branches out of the integration tree. The older kanban selected-card commit was not replayed because its accepted status presentation was already carried by the mobile integration and its click-to-filter behavior is explicitly superseded by the display-only metric-card decision.
+- Finalized and reverified AgentBus source task `20260902-agentbus-account-routing-b62f19e4` as commit `6f9fd0f`, then merged it through `b5f5847` while retaining the dashboard query changes already on `main`.
+- Integrated display-only dashboard source commit `b1fe533` through merge commit `cc09506`, preserving the 20-row bounded query, abort/timeout feedback, mobile layout, rankings, business-facing attention-state merge, and explicit filter form.
+- Resolved both merge rounds' static-asset conflicts with one combined cache token instead of choosing either side mechanically. Source task records remain unchanged in their source commits/worktrees as required by Integration Gate ownership.
+- Advanced the synchronized Chrome extension release to `0.5.164`, archived `0.5.163`, added migration `018_agentbus_account_workers`, and retained manifest/source/ZIP consistency.
+- Promoted the accepted channel-owner → employee account → immutable task assignee → one matching fresh browser/ERP worker chain into AUTH-001, architecture, data flow, domain rules, current state, evidence, commitments, and integrated history.
+- Recorded the final dashboard contract: five summary cards are display-only, the explicit status filter defaults to all results, and dashboard reads use one bounded read-only transaction with selective hydration and page-only detail projection.
+- No database migration, service restart, extension reload, ERP access/write, runtime task/account/channel mutation, deployment, or external business-data transmission was performed.
+
+## Verification
+
+- Before source commits, `check_project_docs.py`, task-aware drift checks, `git diff --check`, repository hygiene, type checking, full control-plane/legacy suites, builds, extension JavaScript syntax, and package/source/hash checks passed for both the dashboard-filter and AgentBus worktrees.
+- AgentBus source verification passed repository hygiene 10/10, control-plane 158/158, legacy 264/264, TypeScript no-emit/build, extension/platform syntax, and release consistency.
+- The AgentBus merge passed TypeScript, repository hygiene 10/10, and focused account/AgentBus regression 29/29.
+- The combined dashboard merge passed focused dashboard regression 5/5, authorization regression 10/10, JavaScript syntax, and staged-diff checks.
+- Final integrated-tree verification passed: `node --run check:repo` 10/10, `node --run check`, `node --run test:control-plane` 158/158, `node --run test:legacy` 265/265, and `node --run build`.
+- `check_project_docs.py`, `check_doc_drift.py --task-id 20260902-integrate-all-push-c93a7f21`, conflict-marker scanning, and `git diff --check` passed on the reconciled tree.
+- Final `git cherry main <branch>` audit found only three patch-equivalent source commits and standalone `53a38f2`; that older selected-card patch is intentionally superseded as documented above. No unintegrated product/release commit remains.
+- After the initial fetch, `origin/main...main` reported `0 28`: the remote had no commits absent locally, and local `main` was 28 commits ahead before the documentation commit and push.
+- Remote push verification remains to be recorded before completion.
+
+## Follow-ups
+
+- Migration 018, service restart, extension `0.5.164` rollout, employee ERP/channel configuration, and the two-cloud-PC staging matrix require a separate explicitly authorized runtime task.
+- A live internal AgentBus attachment retry and the already recorded ERP read/write verification gaps remain separately authorized work.
+
+## Promotion Candidates
+
+- None recorded.