excel唯一逻辑修复

.project-docs/30-worklog/tasks/20260915-latest-roster-target-01a0858b.md

@@ -0,0 +1,26 @@
+# Latest pending roster task attachment association
+
+## Scope and gate
+- Feature task on `main`, sole worktree `/Users/andy/IdeaProjects/LWLT-AIBOT`, base `ede1d47c4710b4d8d6976bdb37baaf5c316ccd07`. Main thread only.
+- Existing untracked `.idea/` and `dist/ltjt-order-assistant-0.5.184.zip` are unrelated and preserved. No overlapping tracked changes or other worktrees. Overlap: Clear.
+- User authorizes selecting the newest waiting roster task when an attachment arrives without a task ID; historical waiting tasks are expected during debugging. Users continue sending business text and a workbook.
+- Own attachment target selection in `control-plane/src/task-service.ts`, focused tests, AgentBus reply contract and this task record. Canonical project memory is read-only.
+- No real attachment downloads, database access, task submission, ERP writes, deployment, restart, external messages or historical task cleanup.
+
+## Evidence and plan
+- Supplied production logs show attachment download and size/hash validation succeeding, followed by `task_selection_required`. The existing selection query orders pending tasks by last update and rejects more than one candidate.
+- Select the newest created eligible roster task, with a deterministic ID tie-break, within existing organization, owner, channel and conversation boundaries. Explicit task selection retains precedence.
+- Preserve transactional state/access rechecks and idempotency protections. Do not fall back to an older task after a selected task changes state during validation.
+- Test target selection, explicit selection, missing candidates, transaction state changes and duplicate delivery; run required repository, type, control-plane, legacy and build checks.
+
+## Results
+- Attachment-only intake now selects one unarchived `awaiting_attachment` roster task by `created_at DESC, id DESC`, using the existing organization, owner, channel and conversation filters. Both independent and shared-child roster routes are eligible. The multiple-pending-task rejection is removed only from this attachment path.
+- Explicit task IDs retain precedence, including selection of an older task. Text and attachment in the same message still use that message's created task. Historical waiting tasks are not mutated or archived by target selection.
+- Existing target-row locking, state/access checks and message idempotency remain intact. A selected task that changes state during validation fails without selecting another task. Replaying a message already linked to another task still rejects the conflicting association without writing an attachment or updating that task.
+- Added four regression tests for SQL selection/scope contracts, explicit selection and mismatches, missing targets, and the real attachment transaction with mocked storage/normalization. Transaction checks cover successful routing, state races and cross-task replay rejection; no live database or ERP was used.
+- Focused intake/target tests 10/10; full control-plane 245/245 and legacy 402/402 (647 total); type check and build PASS. Repository checks 10/10 in a 2702-file byte-verified isolated copy excluding secrets and pre-existing unrelated residue. Legacy HTTP tests used approved local loopback access. Existing `.idea/`, ignored residue and release ZIP are preserved.
+- Main-thread final read-only review PASS. No plugin changes, migration, task replay, ERP write, deployment, restart, commit or push. Service deployment/restart is required before this server-side selection rule takes effect.
+- [Verification evidence](../../../archive/evidence/2026-09-15/latest-roster-target-01a0858b/README.md).
+
+## Promotion candidates
+- After integration, document attachment-only selection by newest task creation time in canonical roster intake guidance. User has approved this product rule; no user-visible task ID is required for normal use.

.project-docs/30-worklog/tasks/20260915-resolution-navigation-01a0858b.md

@@ -0,0 +1,28 @@
+# Read-only resolution navigation recovery
+
+## Scope and gate
+- Feature task; user authorizes fixing roster import `Frame with ID 0 was removed.`. Main thread only, no delegated agents.
+- Branch `main`; sole worktree `/Users/andy/IdeaProjects/LWLT-AIBOT`; base `ede1d47c4710b4d8d6976bdb37baaf5c316ccd07`; overlap Clear.
+- Preserve prior completed latest-roster-target task edits (task-service, reply contract, tests, task/evidence), unrelated `.idea/`, and the known current 0.5.184 release bytes. No concurrent worktree exists.
+- Own extension background resolution/error handling, focused regression tests, version synchronization, mapping/release documentation and release packaging. Canonical project memory remains read-only.
+- No real workbook import, ERP write, task replay, deployment, restart, external sending, commit or push.
+
+## Evidence and implementation plan
+- User screenshots show injection succeeded (334 ms), the following resolution action failed (1039 ms), and preflight was blocked at 0 ms. The catch-all labels resolution exceptions as preflight failures.
+- Workbook validation already succeeded for 20 rows. Supplementing an attachment does not directly reload ERP. A later keepalive recovery screenshot cannot establish the cause of this earlier navigation.
+- Retry only the observed top-frame removal error during read-only target resolution, at most once, while the same execution is still running before writing. Wait for two complete samples of the same approved top document within a bounded window, then inject fresh scripts and re-run unique lookup. Never replay saves or business-blocked lookups.
+- Preserve actual failure stage and safe action/step diagnostics, with a per-task snapshot of automatic recovery timing. Keep normal heartbeat logs quiet.
+- Add behavioral tests for retry limits, changed documents, execution/cancellation guards, ambiguity, permanent failures and stage reporting. Run required repository, type, control-plane, legacy, build and package/source verification.
+
+## Results
+- Extension 0.5.185 retries only a thrown top-frame removal during read-only resolution, once after two complete samples of the same approved document. The stable-document wait is bounded to 8 seconds and requires a non-empty Chrome documentId; fresh adapter injection and unique lookup still run. The same durable execution must remain running with no prior write boundary; missing/changed execution, cancellation, permissions, closed/unapproved tabs and persistent navigation stop recovery.
+- Resolution and route exceptions now keep their actual failure phase. A thrown resolution failure carries explicit read-only evidence and per-task attempt/step/recovery timing, compatible with the existing same-execution late no-write ingestion guard. Normal lookups and business no-match/ambiguity do not retry. Native saves still execute at most once and remain uncertain on frame loss.
+- Automatic recovery records the actual reload request timestamp and tab ID; failed queries project only safe status/codes/timestamps and same-tab evidence. Later keepalive updates cannot replace a stored task failure snapshot. Normal heartbeat logging remains quiet. This does not prove what initiated the user's earlier main-page destruction.
+- Added nine behavioral regressions (VM harness executing real background functions) covering injection and roundtrip failure, fresh document identity, wait bounds, cancellation/execution changes, permanent failures, actual timing phase, business ambiguity, diagnostic privacy and no save replay.
+- Type check, build and control-plane 245/245 passed. Final legacy/repository/package verification is recorded in the linked evidence. Checks use a byte-verified isolated source copy excluding secrets and pre-existing unrelated `.idea/`, `.DS_Store` and logs; original residue is preserved. Legacy HTTP tests use approved local loopback fixtures.
+- Main-thread read-only implementation review PASS: no generic scripting retry added, no route/save replay, no relaxed uniqueness or write boundary. Synchronized extension/platform versions, mapping, regression version assertions, current release gate and release manifest; prior 0.5.184 ZIP/manifest archived byte-for-byte. Existing latest-roster-target changes verified unchanged.
+- No real ERP execution, import, task replay, deployment, restart, commit or push. Production validation requires loading extension 0.5.185, publishing the platform minimum-version update and refreshing platform/ERP pages. This code recovers transient navigation; continued navigation or other page readiness failures still stop safely.
+- [Verification evidence](../../../archive/evidence/2026-09-15/resolution-navigation-01a0858b/README.md).
+
+## Promotion candidates
+- Promote the bounded pre-write resolution retry and actual-stage diagnostics after integration. Keep the cause of the original frame removal unconfirmed until contemporaneous recovery/navigation evidence is available. No canonical promotion in Feature mode.