fix(gst): restore returns dashboard and GSTR-2B download

[lamemustafa]

Summary

• Restore the canonical post-login landing handoff for GSTR-3B when its sole exact portal-owned dashboard target is not rendered.
• Keep rendered-and-enabled-only selection for every duplicate-target surface, including Services Dashboard.
• Bind a GSTR-2B summary download to a uniquely rendered scope-label pair when that identity is intentionally outside the download control's ancestor chain.

Root Cause / Decision Record

The first dashboard fix correctly rejected duplicate exact targets unless one was rendered and enabled. Applied universally, that rule regressed the established post-login landing: its only exact portal target is structural rather than rendered, and no visible equivalent exists.

The corrected dashboard rule is route-gated and target-bound. It permits that non-rendered click only on the canonical landing route, only for exactly one resolved portal-owned target, and only when the anchor and its ancestors are not semantically disabled. All other pages remain rendered-and-enabled-only.

The GSTR-2B summary has a distinct observed layout: the selected scope is rendered in a separate surface from the already armed download control. The final-click guard now proves the exact summary route and exactly one rendered, enabled scope-label pair. It neither reads broad page text nor anonymous inline portal state; missing, duplicate, hidden, inert, transparent, collapsed, zero-area, or mismatched evidence denies the click.

Scope

• Runtime: canonical landing-route predicate; semantic-enabled versus rendered-actionable control checks; route-gated fallback; narrow GSTR-2B separated-scope proof.
• Tests: landing fallback, non-landing rejection, disabled ancestor rejection, duplicate-target selection, separated-scope success and rejection cases, main-world serialization, and durable state.
• Docs/governance: structural-only integration findings.
• Explicitly out of scope: new origins, generic authenticated-page acceptance, constructed navigation, permissions, host permissions, download-correlation changes, and portal data capture.

Pack Workflow Preflight

• The original live diagnosis preceded the branch; final pnpm workflow:preflight passed before pushing.
• This PR was opened from a Pack branch, not master.
• I checked latest master Pack AGENTS guidance.
• PR body keeps the required Pack privacy/review/verification checklist visible.

Sanchika Adoption Gate

• This PR does not consume @sanchika/* packages or copied Sanchika guidance.
• This PR does not import ../sanchika, sanchika/packages/*/src, or parent source paths.

Privacy And Data-Flow Impact

• No new browser permissions or host permissions.
• No new network calls, analytics, telemetry, or session replay.
• No credential, OTP, CAPTCHA, cookie, token, GST file, or taxpayer-data capture.
• The final-click guard reads only the uniquely bounded, rendered scope labels needed for target proof; it does not read page-wide text, inline state, or script text.
• Documentation is structural-only.

Sensitive Surface Review

• Target binding remains exact and portal-owned; no navigation URL is constructed.
• Duplicate targets require exactly one rendered and enabled candidate.
• The landing fallback requires one exact target, the canonical route, and no semantic disabled state.
• The GSTR-2B exception requires the expected summary route, one armed control, and one matching rendered scope pair; all ambiguity fails closed before the click.
• A click is not success: origin transition and content-script availability are verified before acquisition.
• Download completion remains evidence-backed and fail-closed.
• No real taxpayer data, local paths, raw URLs/referrers, or portal HTML are in the diff.

Chrome Web Store Impact

• This PR does not expand the existing listing or change store copy.
• Full fiscal year remains out of scope.
• Release artifacts, provenance, and publishing gates are not claimed.

Verification

• Focused affected-flow suite: 4 files, 122 tests passed.
• pnpm exec eslint . --max-warnings 0
• pnpm exec tsc --noEmit
• pnpm exec wxt build
• node scripts/verify-extension-package.mjs .output/chrome-mv3
• git diff --check
• pnpm workflow:preflight
• pnpm exec prettier --check . — blocked by three unchanged formatter-baseline files.
• pnpm exec vitest run — two asset-exporter tests fail immediately and the runner does not terminate; no final full-suite summary was available.
• Strict pnpm review:gate — GitHub reachable, but no review exists for the current head.
• Release-only ZIP, provenance, GitHub-release, and Web Store checks were not run.

Artifact Evidence

• CI run: pending.
• ZIP artifact / SHA-256: release-only, not produced.
• Head: 8cf0bf0.

PR Review Follow-Up

• GitHub Actions completed.
• Automated current-head review inspected after checks complete.
• Local privacy and security reviews completed.
• Findings were fixed before the latest push.

Thread/comment	Disposition	Commit or evidence
Local review: indeterminate or disabled visible candidate	fixed	2501167 and ac3b77f
Local review: landing regression from universal rendered-box rule	fixed	80d5fbf; route-gated regression tests
Local review: separated GSTR-2B scope surface	fixed	30c6de4; 80 focused connector tests
Automated current-head review	follow-up	No review exists for 6afc9a6

Screenshots

Not applicable; authenticated portal evidence is not attached.

DCO

• Existing commits do not carry Signed-off-by trailers; add the required signed commits without rewriting pushed history if the repository's DCO gate requires them.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8cf0bf0881

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[lamemustafa]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 38fdf6a5d4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[lamemustafa]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5d59637ba8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[lamemustafa]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 223ff24fd2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[lamemustafa]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 2209bd39a0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".