Task: Finalize account-scoped ERP routing and force delete

Identity

Task ID: 20260903-finalize-account-routing-7c4e2a91
Mode: Integration
Branch: codex/20260903-finalize-account-routing-7c4e2a91-finalize-account-routing
Worktree: /Users/inmanx/Documents/lwltAPI-finalize-account-routing-7c4e2a91
Base commit: d09b3032c0
Owner: codex
Status: Integrated and pushed

Use completed feature commit d09b3032c0d7b997e6974ff16b9210e9c04bacd3 as the Integration baseline for account-scoped ERP queues, explicit force deletion, and assignee-only executable routing.
Reconcile the user-confirmed product decision into accepted ADRs, canonical architecture, domain rules, current state, evidence, commitments, and the cross-business registry.
Run the complete repository, control-plane, legacy, build, project-document, and task-drift verification gates.
Push the verified integration tip to remote main with a normal non-force update while preserving the separately occupied local main worktree.

The user explicitly authorized merging and pushing, and explicitly superseded AUTH-001's organization-wide ERP FIFO and archive-only removal clauses.
Same-account tasks remain serialized in deterministic FIFO order; different assigned accounts must not block one another.
Administrator-wide read visibility does not authorize receiving or processing another account's executable SSE, plugin result, browser claim, or cleanup command.
Archive/restore remains available as a reversible workflow; force delete is an irreversible platform-record deletion regardless of task state and cannot roll back ERP effects already written.
Do not touch the occupied local main worktree, adopt its untracked task record, deploy, restart services, mutate runtime tasks, operate ERP, or inspect secrets.
Before pushing, verify the remote branch has not advanced unexpectedly; never force-push.

Used completed source commit d09b3032c0d7b997e6974ff16b9210e9c04bacd3 as the integration baseline, preserving its task record and the local-main-only diagnosis commit 69ea6d2 in ancestry.
Accepted AUTH-002, partially superseding AUTH-001's organization-wide FIFO and archive-only clauses. Canonical state now records per-assignee FIFO/single-active execution, cross-account independence, and strict separation of administrator reads from executable SSE, claims, plugin results, and browser cleanup commands.
Promoted reversible archive/restore and explicit permanent force delete as separate behaviors. Force delete is lifecycle-independent platform-record removal with minimal audit evidence, post-commit best-effort cleanup, and no claim of ERP rollback.
Updated architecture, data flow, business rules, success criteria, current state, evidence, rollout commitments, and the cross-business registry without changing extension source/version or release artifacts.
A fresh fetch proved remote main was an ancestor with divergence 0 4; a normal non-force push advanced origin/main from d57e0ee to verified integration commit 397f515037fc09f1a2a2eeedd4b788fae190f842.
No deployment, service restart, extension reload, live task mutation, ERP operation, or secret access occurred.

node --run check:repo — passed, 10/10.
node --run check — passed.
node --run test:control-plane — passed, 162/162.
node --run test:legacy — passed, 268/268.
node --run build — passed.
git diff --check — passed.
check_project_docs.py — passed.
check_doc_drift.py --task-id 20260903-finalize-account-routing-7c4e2a91 — passed with the source task record correctly inside the recorded base.
The isolated worktree reused the source worktree's byte-identical locked dependencies through a temporary node_modules symlink; the symlink was removed after verification.
Fresh pre-push fetch showed divergence 0 4 and proved both origin/main and local main were ancestors of the integration tip.
After the normal push, local HEAD, the origin/main tracking ref, and git ls-remote origin refs/heads/main all returned 397f515037fc09f1a2a2eeedd4b788fae190f842; source fix d09b303 and local-main diagnosis 69ea6d2 were both confirmed as remote ancestors.
This task record is finalized in a documentation-only follow-up commit after that remote-equality check.

Deployment, service restart, migration 018 application, extension reload, and the administrator-plus-two-employees runtime matrix remain separate work requiring explicit authorization.
The future runtime matrix should cover same-account FIFO, cross-account independence, administrator executable-feed isolation, mismatched ERP identity, same-account worker conflict, stale failover, and waiting/active force-delete cleanup.

None. The user-confirmed queue, routing, and deletion decisions were promoted by this Integration task.