Deferred review findings from the overnight run

[lamemustafa]

Four findings raised on #145 and #169 that were read and assessed but deliberately not fixed. With
an hour left in an unattended session they would have landed unreviewed, and review found something
real in nearly every round that night — including in four fixes made during it.

Each is genuine. None blocks its PR.

1. Numeric-looking strings may reach the exact total — #145

src/connectors/gst/filed-returns-full-year-workbook.ts:120. A mapped amount arriving as a
numeric-looking JSON string (txval: "100") is correctly marked Non-numeric value in its month,
but may still pass its value into the exact-total computation.

Related to, but distinct from, the array-count fix: that covered a row whose numeric column held a
count. This is a row whose value is a string that parses.

Should reuse the same marked-cell treatment so the month and the total agree.

2. CSV rows carry no financial year — #145

src/connectors/gst/filed-returns-summary-sheet.ts:35. full-year-summary.csv has a fixed filename
and its rows identify period, return type and artifact — but not the financial year. Extracted from
its ZIP, or handed to the machine consumer the README describes, the file cannot say which year it
covers.

This is a schema change to a published artifact, so it needs a deliberate decision about column
order and whether anything already parses the current shape.

3. Bundle-reference parsing is narrower than HTML allows — #169

scripts/verify-extension-package.mjs:317. The regexes added for the page-bundle check match only
double-quoted attributes and require a stylesheet's rel to precede its href. Single-quoted or
reordered attributes would slip past the check.

The current build emits double-quoted, rel-first markup, so the gate works today — but a guard
that depends on the emitter's formatting is not a guard. Worth parsing rather than pattern-matching.

4. Presets keep an April basis if the page stays mounted — #169

src/entrypoints/panel/panel-surface.tsx:29. Presets are memoised with an empty dependency list, so
a panel page mounted in April keeps April-normalised presets into May.

Same family as the portal-context staleness already fixed: the panel is long-lived where the popup
was not. The fix needs a recompute trigger that does not reintroduce a timer.

Sequencing

None of these is urgent. 1 and 2 touch the summary artifact and should land together with their own
verification; 3 and 4 are independent.

[lamemustafa]

5. Panel detail text is below the documented minimum — #169

src/styles/panel.css:124. At a 16px root, 0.6875rem renders preset details and blocking reasons
at 11px, below the explicit 12px minimum stated in DESIGN.md.

This is a contradiction between two files in the same PR, which is the drift pattern that lane exists
to remove — the design contract says one thing and the stylesheet implementing it says another.

Deferred rather than fixed because raising type size changes layout: the panel's control budget is
three or four items in a 420px surface, and a size change interacts with wrapping in exactly the
place the lane spent effort constraining. It wants a look, not a one-character edit at the end of an
unattended session.

Either the stylesheet rises to 12px or DESIGN.md records a deliberate exception with its reason —
but not silence in both directions.

[lamemustafa]

Item 1 is done — fixed in 423d376 on #145, not deferred. I had misjudged the remaining time; once I checked the clock there was room to do it and get it reviewed.

The fix differs from what this issue proposed. Excluding the non-numeric month from the sum — the obvious reading — makes it worse: the total then asserts a figure that silently omits a month. A row with a non-numeric month has no total, and now says so explicitly.

Items 2 through 5 remain as written.

[lamemustafa]

Further deferred findings (end of the overnight run)

Eight more raised in the final rounds, read and assessed but not fixed. Each is genuine.

#145

6. filed-returns-summary-identity.ts — required identity paths are matched after alias
   normalisation, so a path that normalises to the canonical one could satisfy the requirement
   without being it. Narrower than the decoy case already fixed, and in the same guard.
7. core/json-flat-table.ts — unpaired surrogates are not rejected before CSV encoding.

#169

8. panel-surface.tsx — the custom chooser's normal Start stays enabled while another scope needs
   recovery. Sibling of the preset guard already fixed; the presets consult the matrix and the
   chooser does not.
9. panel-surface.tsx — an artifact-unavailable:* signal on a completed run loses its safe
   message.
10. verify-extension-package.mjs — a bundle reference that escapes the package root
    () is resolved rather than rejected. Gap in the check added this session.
11. use-pack-popup-controller.ts — a mount-time context error is not cleared by a later successful
    refresh. The complement of the fix just made: that one stopped clearing unrelated errors, and
    the mount path sets the flag nowhere.
12. docs/DESIGN_TOKENS.md — claims one token source while literals remain outside :root.
    Related to Design docs assert measurement numbers nothing enforces #171, which tracks the absent detector.
13. panel-surface.tsx — presets stay enabled when the portal requires sign-in.

Several are siblings of fixes already made — items 8, 10 and 11 each complete a class where one
instance was closed and another was not. That pattern recurred throughout the session and is worth
treating as the unit of work rather than fixing instances.

[lamemustafa]

Finding 1 is closed — fixed later in the same session that raised it

Finding 1 (numeric-looking strings reaching the exact total) no longer reproduces on
tapish-codex/summary-sheet.

It was raised while the total path summed sourceText and gated on whether the text parsed as a
decimal. The non-numeric refusal that landed afterwards changed the gate to whether the cell was
marked numeric:

const hasNonNumericMonth = presentValues.some((value) => !value.numeric);

numeric is row.valueNumber !== undefined, and valueNumber is only set for valueKind === "number".
A JSON string "100" is valueKind: "text", so the whole row now resolves to NON_NUMERIC_TOTAL_TEXT
before exactTotalSpreadsheetValue is reached. The month cell and the total agree, which is what the
finding asked for.

Pinned by tests/connectors/filed-returns-full-year-workbook.test.ts:315, "refuses a total when a
month is a numeric-looking string", whose fixture is exactly the reported "txval":"100" and which
additionally asserts 100 never appears among the numeric cells.

No action needed. Findings 2, 3 and 4 remain open and are unaffected.

[lamemustafa]

Audited all four against master 01e3582 in a clean tree. Two are already fixed, one is superseded, and this issue reduces to finding 2.

1 — numeric-looking strings reaching the exact total: fixed. src/connectors/gst/filed-returns-full-year-workbook.ts:128 computes hasNonNumericMonth and suppresses the total when any month is non-numeric. The comment above it names this exact defect: "a JSON string like "100" parses as a decimal, so it was being added to a value the sheet had just marked unusable." Covered by refuses a total when a month is a numeric-looking string in the workbook tests.

Worth recording why it never reaches the total now, since the mechanism is not obvious from the call site: valueNumber is only set when the flattener reports valueKind === "number", so a JSON string never populates it, the row reports numeric: false, and the total is withheld.

4 — presets keeping an April basis: fixed. panel-surface.tsx no longer memoises with an empty dependency list. usePanelPresets snapshots the rendered presets with an identity, exposes refresh and isStale, and recomputes on useReturnToPage(refresh) rather than on a timer — which is what this issue asked for. The comment there describes the April-into-May case and one subtlety beyond it: the identity has to be snapshotted rather than recomputed, because presetPeriodCount reads the current date and would otherwise compare equal on both sides while the button still showed the old count.

3 — bundle-reference parsing: superseded by #197. That issue opens by stating this finding remains open, and records the six review rounds that caused a replacement to be withdrawn from #186. Tracking it in two places would mean fixing it twice or, more likely, each waiting on the other.

2 — CSV rows carry no financial year: open, and the only remaining item. FILED_RETURNS_SUMMARY_HEADERS is period, return_type, artifact, outcome, field_label, field_path, value_text, value_number; dataCsvRow at :527 emits exactly those. Nothing in the row names the year.

One fact that de-risks the schema question this issue raised. README.md:155-163 states these rules "are not assigned to any released Pack version because no release contains this format yet", and that a machine consumer "cannot identify the CSV format from the CSV alone and must be given the producing Pack version". So no released build emits this shape and no documented consumer parses it positionally — the column-order decision is free, and the compatibility question the issue flagged does not arise.

Retitling would be reasonable once finding 2 lands; leaving it as-is for now so the cross-references from #145 and #169 still resolve.