docs: migrate project memory governance

.project-docs/40-domain/business-rules.md

@@ -0,0 +1,22 @@
+# Business Rules
+
+## Durable Rules
+
+- `agent设计规范/business-adaptation-registry.md` is the cross-session business entry; each business maps user input, Skill/action, ERP flow, contracts, implementation, fixtures, and verification status.
+- Manual and AgentBus tasks share the same 18 machine routes, task-scoped parser mode snapshot, and organization automation rules.
+- The two passenger-list import routes are Program-only and wait for exactly one `.xls` or `.xlsx` attachment before deterministic normalization.
+- Passenger overwrite requires confirmation when target ERP rows are occupied; after `full_replace + confirmed=true`, every attachment-specified sequence is written even when values are unchanged.
+- A single strict `领队` row supplies leader contact; ambiguous, incomplete, duplicate, or structurally inconsistent leader data fails closed.
+- Shared-mother-plan `整团游客信息` export is only `shared_plan + visitor-list + tid-only`; independent and concrete shared-child visitor lists remain `did+tid`.
+- Real writes require unique resolution, exact page identity, ownership, write projection, explicit server response, and action-specific completion evidence.
+- Current business capability and verification status come from active source/contracts and the lifecycle release gate, never from archive wording.
+
+## Open Questions
+
+- Fresh authorized runtime read verification remains for the shared-mother-plan whole-visitor export branch.
+- Authorized current-version ERP write verification remains for SGL/TWN and four independent-order headcount categories.
+- AgentBus OSS DNS fallback must preserve private/reserved-network SSRF blocking.
+
+## Last Reviewed
+
+2026-08-28