docs: reconcile account-scoped execution decisions

.project-docs/30-worklog/current-state.md

@@ -26,10 +26,12 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
 - Merge commit `336ca6e` integrating source commit `b26001e` from task `20260902-account-permission-ui-6c9e21ad` for a scroll-safe account task-permission editor layout and focused regression coverage.
 - Merge commit `e4fd916` integrating source commit `b5c727b` from task `20260902-diagnose-parse-error-7f3a9c2d` for native non-empty ERP product search in scatter-plan creation and independent batch-order creation, synchronized as extension `0.5.165`.
 - Integration task `20260902-integrate-product-search-3b7f6a20` for canonical product-search promotion, full release verification, and normal non-force synchronization to `origin/main`.
+- Merge commit `bbbb44d` integrating source commit `d09b303` from task `20260902-per-account-queue-hard-delete-a6d9f2c1` for account-scoped ERP FIFO, strict assignee-only executable routing, and explicit lifecycle-independent physical force deletion.
+- Integration task `20260903-integrate-account-routing-9f2c7a61` for AUTH-002 acceptance, canonical queue/removal reconciliation, full repository verification, and normal non-force synchronization to `origin/main`.
 
 ## Current Focus
 
-Operate the repository's current `0.5.165` extension baseline and fixed-scope account model safely, bind each enabled AgentBus channel to one employee/ERP identity, provision narrow route grants, use explicit leadership-dashboard filters, and preserve Program/AI plus organization-wide ERP execution boundaries. Migration 018, extension reload, guarded product-search retry, and service rollout remain separately authorized runtime work.
+Operate the repository's current `0.5.165` extension baseline and fixed-scope account model safely, bind each enabled AgentBus channel to one employee/ERP identity, provision narrow route grants, use explicit leadership-dashboard filters, and preserve Program/AI plus per-assigned-account ERP execution boundaries. Same-account tasks remain FIFO and single-active; distinct accounts are independent, and administrator visibility never enters another account's executable event/result path. Migration 018, extension reload, guarded product-search retry, and service rollout remain separately authorized runtime work.
 
 ## Recently Completed
 
@@ -51,25 +53,29 @@ Operate the repository's current `0.5.165` extension baseline and fixed-scope ac
 - 2026-09-02: Reworked leadership-dashboard reads into a bounded one-connection transaction with business SQL prefiltering, selective message hydration, page-only detail hydration, request/database deadlines, and 20-row pages; metric cards are now display-only and explicit filters default to all results.
 - 2026-09-02: Corrected the account-management task-permission editor so opening it expands a dedicated five-row layout, keeps the account list below the editor, and allows vertical page scrolling on desktop and narrow screens without changing authorization semantics.
 - 2026-09-02: Integrated extension `0.5.165`: scatter-plan creation and independent batch-order creation now try loaded product candidates, then the form's native non-empty `S_chanpinming` search, and finally one bounded empty-query compatibility reload. A user-authorized search-only ERP check returned exactly one target row in both forms without selecting or saving it; zero or multiple local matches continue to fail closed.
+- 2026-09-03: Accepted AUTH-002 and integrated account-scoped ERP queues. Each immutable assignee now owns one FIFO/single-active claim partition, different accounts no longer block one another, and executable SSE/results/cleanup commands are owner-only even when an administrator is signed in.
+- 2026-09-03: Restored explicit permanent force deletion as a separate operation from reversible archive/restore. It bypasses lifecycle-state gates, physically removes task-owned platform records, retains a minimal deletion audit marker, performs post-commit cleanup best effort, and warns that prior ERP effects are not rolled back.
 
 ## In Progress
 
 - The standard database currently contains one administrator account and no non-administrator task grants. Multi-account operational smoke testing remains for an administrator-led staging window.
-- Migration `018_agentbus_account_workers`, employee ERP identities/channel bindings, extension `0.5.165`, and the merged dashboard/runtime changes have not been applied to or restarted on the standard service in this integration task.
+- Migration `018_agentbus_account_workers`, employee ERP identities/channel bindings, extension `0.5.165`, account-scoped queue/routing changes, force-delete behavior, and the merged dashboard/runtime changes have not been applied to or restarted on the standard service in this integration task.
 
 ## Next Recommended Steps
 
-1. In an explicitly authorized staging/rollout window, back up PostgreSQL, apply migration 018, restart the control plane, load extension `0.5.165`, verify its runtime handshake, configure employee ERP identities and channel bindings, and run the multi-cloud-PC/identity/failover matrix before production assurance.
+1. In an explicitly authorized staging/rollout window, back up PostgreSQL, apply migration 018, restart the control plane, load extension `0.5.165`, verify its runtime handshake, configure employee ERP identities and channel bindings, and run the multi-cloud-PC/identity/failover plus account-queue matrix before production assurance.
 2. Through the administrator UI, create representative team-lead and ordinary accounts, assign narrow task grants, and verify owner isolation, leadership dashboard reads, grant/revoke behavior, and denial prompts without ERP writes.
-3. With explicit authorization, run a live read-only ERP verification of the shared-mother-plan `tid-only` whole-visitor export path.
-4. With explicit authorization, perform ERP write verification for independent-order SGL/TWN and adult/child/leader headcount mappings.
+3. In the same authorized staging window, verify that an administrator receives no employee executable events/results, then force-delete disposable waiting and active employee tasks and confirm database absence plus cleanup only in the owning employee plugin.
+4. With explicit authorization, run a live read-only ERP verification of the shared-mother-plan `tid-only` whole-visitor export path.
+5. With explicit authorization, perform ERP write verification for independent-order SGL/TWN and adult/child/leader headcount mappings.
 
 ## Open Questions / Blockers
 
 - Shared-mother-plan whole-visitor export has historical read evidence and static coverage but lacks a fresh authorized runtime ERP read verification.
 - Independent-order SGL/TWN and four headcount categories lack authorized current-version ERP write evidence.
-- The standard service was last restarted before commits `3062ed5`, `b5f5847`, `cc09506`, `336ca6e`, and `e4fd916`; its runtime schema, extension, account UI, and dashboard behavior must not be represented as the newly integrated repository state until an authorized rollout.
-- AgentBus account-worker routing still lacks a live two-employee/two-cloud-PC staging matrix covering mismatched ERP login, same-account device conflict, 90-second stale failover, and both manual and automatic channel work.
+- The standard service was last restarted before commits `3062ed5`, `b5f5847`, `cc09506`, `336ca6e`, `e4fd916`, and merge `bbbb44d`; its runtime schema, extension, account UI, queue/routing, force-delete, and dashboard behavior must not be represented as the newly integrated repository state until an authorized rollout.
+- AgentBus account-worker routing still lacks a live two-employee/two-cloud-PC staging matrix covering mismatched ERP login, same-account device conflict, 90-second stale failover, same-account FIFO, cross-account independence, administrator executable-feed isolation, and both manual and automatic channel work.
+- Lifecycle-independent force deletion has repository regression evidence but lacks an authorized runtime smoke test for waiting/active deletion, database absence, OSS cleanup, and owner-plugin-only cleanup.
 - A live internal AgentBus attachment verification remains separately unperformed.
 
 ## Risky Areas
@@ -79,8 +85,9 @@ Operate the repository's current `0.5.165` extension baseline and fixed-scope ac
 - AgentBus channels and their upstream bridge are now a trusted network boundary because attachment URLs may target internal HTTPS hosts.
 - Account role changes, session revocation, creator-based task-route revocation, cross-user dashboard projection, and encrypted input audit are security-sensitive boundaries.
 - AgentBus channel ownership, immutable task assignment, expected ERP identity, browser-worker freshness/failover, and administrator non-execution are security- and write-safety-sensitive boundaries.
+- Account-scoped advisory locking, per-assignee FIFO queries, executable SSE/result routing, and irreversible force deletion are concurrency-, authorization-, and evidence-sensitive boundaries.
 - Release synchronization across extension source, minimum platform version, mapping, ZIP, Skills, DOCX, and `dist/release-manifest.json`.
 
 ## Last Updated
 
-2026-09-02
+2026-09-03