# Task: Finalize account-scoped ERP routing and force delete

## Identity

- Task ID: 20260903-finalize-account-routing-7c4e2a91
- Mode: Integration
- Branch: codex/20260903-finalize-account-routing-7c4e2a91-finalize-account-routing
- Worktree: /Users/inmanx/Documents/lwltAPI-finalize-account-routing-7c4e2a91
- Base commit: d09b3032c0d7b997e6974ff16b9210e9c04bacd3
- Owner: codex
- Status: Integrated and pushed

## Scope

- Use completed feature commit `d09b3032c0d7b997e6974ff16b9210e9c04bacd3` as the Integration baseline for account-scoped ERP queues, explicit force deletion, and assignee-only executable routing.
- Reconcile the user-confirmed product decision into accepted ADRs, canonical architecture, domain rules, current state, evidence, commitments, and the cross-business registry.
- Run the complete repository, control-plane, legacy, build, project-document, and task-drift verification gates.
- Push the verified integration tip to remote `main` with a normal non-force update while preserving the separately occupied local `main` worktree.

## Intent And Constraints

- The user explicitly authorized merging and pushing, and explicitly superseded AUTH-001's organization-wide ERP FIFO and archive-only removal clauses.
- Same-account tasks remain serialized in deterministic FIFO order; different assigned accounts must not block one another.
- Administrator-wide read visibility does not authorize receiving or processing another account's executable SSE, plugin result, browser claim, or cleanup command.
- Archive/restore remains available as a reversible workflow; force delete is an irreversible platform-record deletion regardless of task state and cannot roll back ERP effects already written.
- Do not touch the occupied local `main` worktree, adopt its untracked task record, deploy, restart services, mutate runtime tasks, operate ERP, or inspect secrets.
- Before pushing, verify the remote branch has not advanced unexpectedly; never force-push.

## Outcome

- Used completed source commit `d09b3032c0d7b997e6974ff16b9210e9c04bacd3` as the integration baseline, preserving its task record and the local-main-only diagnosis commit `69ea6d2` in ancestry.
- Accepted AUTH-002, partially superseding AUTH-001's organization-wide FIFO and archive-only clauses. Canonical state now records per-assignee FIFO/single-active execution, cross-account independence, and strict separation of administrator reads from executable SSE, claims, plugin results, and browser cleanup commands.
- Promoted reversible archive/restore and explicit permanent force delete as separate behaviors. Force delete is lifecycle-independent platform-record removal with minimal audit evidence, post-commit best-effort cleanup, and no claim of ERP rollback.
- Updated architecture, data flow, business rules, success criteria, current state, evidence, rollout commitments, and the cross-business registry without changing extension source/version or release artifacts.
- A fresh fetch proved remote `main` was an ancestor with divergence `0 4`; a normal non-force push advanced `origin/main` from `d57e0ee` to verified integration commit `397f515037fc09f1a2a2eeedd4b788fae190f842`.
- No deployment, service restart, extension reload, live task mutation, ERP operation, or secret access occurred.

## Verification

- `node --run check:repo` — passed, 10/10.
- `node --run check` — passed.
- `node --run test:control-plane` — passed, 162/162.
- `node --run test:legacy` — passed, 268/268.
- `node --run build` — passed.
- `git diff --check` — passed.
- `check_project_docs.py` — passed.
- `check_doc_drift.py --task-id 20260903-finalize-account-routing-7c4e2a91` — passed with the source task record correctly inside the recorded base.
- The isolated worktree reused the source worktree's byte-identical locked dependencies through a temporary `node_modules` symlink; the symlink was removed after verification.
- Fresh pre-push fetch showed divergence `0 4` and proved both `origin/main` and local `main` were ancestors of the integration tip.
- After the normal push, local `HEAD`, the `origin/main` tracking ref, and `git ls-remote origin refs/heads/main` all returned `397f515037fc09f1a2a2eeedd4b788fae190f842`; source fix `d09b303` and local-main diagnosis `69ea6d2` were both confirmed as remote ancestors.
- This task record is finalized in a documentation-only follow-up commit after that remote-equality check.

## Follow-ups

- Deployment, service restart, migration 018 application, extension reload, and the administrator-plus-two-employees runtime matrix remain separate work requiring explicit authorization.
- The future runtime matrix should cover same-account FIFO, cross-account independence, administrator executable-feed isolation, mismatched ERP identity, same-account worker conflict, stale failover, and waiting/active force-delete cleanup.

## Promotion Candidates

- None. The user-confirmed queue, routing, and deletion decisions were promoted by this Integration task.