docs: reconcile AgentBus and dashboard integration

.project-docs/30-worklog/current-state.md

@@ -19,10 +19,14 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
 - Integration task `20260902-dashboard-mobile-integration-e28c` for canonical reconciliation of the mobile leadership-dashboard behavior.
 - Merge commit `a1b2d2f` integrating source commit `e68fcc1` from task `20260901-roster-header-error-a4f7` for exact ERP-semantic passenger-workbook header detection across rows 1–100, approved aliases, arbitrary column order, and the synchronized `0.5.125` lifecycle Skill and business-instruction DOCX.
 - Integration task `20260902-merge-all-restart-b7e3c91f` for local-branch/worktree reconciliation, canonical roster-contract promotion, full repository/release verification, and the authorized standard-panel restart.
+- Commit `3062ed5` from task `20260902-kanban-filter-7e3a91c4` for bounded single-connection leadership-dashboard queries, SQL business prefiltering, selective search hydration, 20-row pages, cancellation propagation, and timeout feedback.
+- Merge commit `b5f5847` integrating source commit `6f9fd0f` from task `20260902-agentbus-account-routing-b62f19e4` for employee-owned AgentBus channels, immutable task assignees, matching single-browser ERP workers, migration 018, and extension `0.5.164`.
+- Merge commit `cc09506` integrating source commit `b1fe533` from task `20260902-dashboard-metrics-static-a91c` for display-only dashboard metric cards and explicit status filtering.
+- Integration task `20260902-integrate-all-push-c93a7f21` for all-worktree reconciliation, semantic merge resolution, canonical promotion, full verification, and synchronization of `main` to `origin/main`.
 
 ## Current Focus
 
-Operate the current `0.5.163` extension baseline and the deployed fixed-scope account model safely, provision roles and task grants through administrator workflows, use the aggregate-first leadership dashboard for business oversight, and preserve Program/AI plus ERP execution boundaries.
+Operate the repository's current `0.5.164` extension baseline and fixed-scope account model safely, bind each enabled AgentBus channel to one employee/ERP identity, provision narrow route grants, use explicit leadership-dashboard filters, and preserve Program/AI plus organization-wide ERP execution boundaries. Migration 018, extension reload, and service rollout remain separately authorized runtime work.
 
 ## Recently Completed
 
@@ -40,22 +44,28 @@ Operate the current `0.5.163` extension baseline and the deployed fixed-scope ac
 - 2026-09-02: Adapted the authenticated leadership dashboard for direct phone and portrait-tablet use, retained the desktop overview, unified the first metric card with the remaining cards, and removed the separate visible “待跟进” category by presenting those internal states as “进行中”.
 - 2026-09-02: Integrated passenger-workbook normalizer `v1.3.0`; one unique complete ERP-semantic header may appear on row 1 through 100 with arbitrary column order and finite approved aliases, while unknown columns, duplicate semantics, multiple candidates, unsafe formulas, and non-passport data continue to fail closed.
 - 2026-09-02: Restarted the standard `127.0.0.1:8786` control plane from current local `main` after the roster integration; liveness, database readiness, schema migration 017, and repeated listener stability checks passed. AgentBus remained enabled but disconnected, matching the pre-restart observation.
+- 2026-09-02: Integrated migration 018 and extension `0.5.164` so each enabled AgentBus channel binds one non-admin employee, each task keeps an immutable execution assignee, administrators cannot execute another assignee's work, and only one fresh browser with the matching ERP account is execution-ready.
+- 2026-09-02: Reworked leadership-dashboard reads into a bounded one-connection transaction with business SQL prefiltering, selective message hydration, page-only detail hydration, request/database deadlines, and 20-row pages; metric cards are now display-only and explicit filters default to all results.
 
 ## In Progress
 
 - The standard database currently contains one administrator account and no non-administrator task grants. Multi-account operational smoke testing remains for an administrator-led staging window.
+- Migration `018_agentbus_account_workers`, employee ERP identities/channel bindings, extension `0.5.164`, and the merged dashboard runtime have not been applied to or restarted on the standard service in this integration task.
 
 ## Next Recommended Steps
 
-1. With explicit authorization, run a live read-only ERP verification of the shared-mother-plan `tid-only` whole-visitor export path.
-2. With explicit authorization, perform ERP write verification for independent-order SGL/TWN and adult/child/leader headcount mappings.
-3. Through the administrator UI, create representative team-lead and ordinary accounts, assign narrow task grants, and verify owner isolation, leadership dashboard reads, grant/revoke behavior, and denial prompts without ERP writes.
+1. In an explicitly authorized staging/rollout window, back up PostgreSQL, apply migration 018, restart the control plane, load extension `0.5.164`, configure employee ERP identities and channel bindings, and run the multi-cloud-PC/identity/failover matrix before production assurance.
+2. Through the administrator UI, create representative team-lead and ordinary accounts, assign narrow task grants, and verify owner isolation, leadership dashboard reads, grant/revoke behavior, and denial prompts without ERP writes.
+3. With explicit authorization, run a live read-only ERP verification of the shared-mother-plan `tid-only` whole-visitor export path.
+4. With explicit authorization, perform ERP write verification for independent-order SGL/TWN and adult/child/leader headcount mappings.
 
 ## Open Questions / Blockers
 
 - Shared-mother-plan whole-visitor export has historical read evidence and static coverage but lacks a fresh authorized runtime ERP read verification.
 - Independent-order SGL/TWN and four headcount categories lack authorized current-version ERP write evidence.
-- The restarted service now runs current local `main`; a live internal AgentBus attachment verification remains separately unperformed.
+- The standard service was last restarted before commits `3062ed5`, `b5f5847`, and `cc09506`; its runtime schema/extension/dashboard behavior must not be represented as the newly integrated repository state until an authorized rollout.
+- AgentBus account-worker routing still lacks a live two-employee/two-cloud-PC staging matrix covering mismatched ERP login, same-account device conflict, 90-second stale failover, and both manual and automatic channel work.
+- A live internal AgentBus attachment verification remains separately unperformed.
 
 ## Risky Areas
 
@@ -63,6 +73,7 @@ Operate the current `0.5.163` extension baseline and the deployed fixed-scope ac
 - Passenger workbook normalization, encrypted attachment persistence, leader-contact projection, and native ERP row capacity.
 - AgentBus channels and their upstream bridge are now a trusted network boundary because attachment URLs may target internal HTTPS hosts.
 - Account role changes, session revocation, creator-based task-route revocation, cross-user dashboard projection, and encrypted input audit are security-sensitive boundaries.
+- AgentBus channel ownership, immutable task assignment, expected ERP identity, browser-worker freshness/failover, and administrator non-execution are security- and write-safety-sensitive boundaries.
 - Release synchronization across extension source, minimum platform version, mapping, ZIP, Skills, DOCX, and `dist/release-manifest.json`.
 
 ## Last Updated