fix(release): align v0.5.0 evidence and status checks

.github/workflows/chrome-web-store-status.yml

@@ -38,10 +38,34 @@ jobs:
           node-version: 22.13.0
 
       - name: Check Chrome Web Store status
-        run: node scripts/check-chrome-web-store-status.mjs
+        shell: bash
+        run: |
+          set +e
+          status_output="$(node scripts/check-chrome-web-store-status.mjs 2>&1)"
+          status_code=$?
+          set -e
+
+          if [[ $status_code -eq 0 ]]; then
+            printf '%s\n' "$status_output"
+            exit 0
+          fi
+
+          if [[ "$GITHUB_EVENT_NAME" == "schedule" && "$CWS_REQUIRE_PUBLISHED" == "false" ]] &&
+             [[ "$status_output" == "Missing Chrome Web Store credentials."* ]]; then
+            echo "::notice::Chrome Web Store status check skipped because credentials are not configured. See #59."
+            echo "### Chrome Web Store status check skipped" >> "$GITHUB_STEP_SUMMARY"
+            echo "Credentials are not configured, so the non-strict scheduled status check did not run. See #59." >> "$GITHUB_STEP_SUMMARY"
+            exit 0
+          fi
+
+          printf '%s\n' "$status_output" >&2
+          exit "$status_code"
         env:
           CWS_EXTENSION_ID: nfnbhekccajjfgkppolomflaeledoccb
           CWS_EXPECTED_VERSION: ${{ inputs.expected_version }}
           CWS_REQUIRE_PUBLISHED: ${{ inputs.require_published || 'false' }}
           CWS_PUBLISHER_ID: ${{ vars.CWS_PUBLISHER_ID }}
           CWS_SERVICE_ACCOUNT_JSON: ${{ secrets.CWS_SERVICE_ACCOUNT_JSON }}
+          CWS_CLIENT_ID: ${{ secrets.CWS_CLIENT_ID }}
+          CWS_CLIENT_SECRET: ${{ secrets.CWS_CLIENT_SECRET }}
+          CWS_REFRESH_TOKEN: ${{ secrets.CWS_REFRESH_TOKEN }}

docs/PUBLICATION_READINESS.md

@@ -26,12 +26,16 @@ durable full-year, or stable-release claims.
   2026-07-06 records item ID `nfnbhekccajjfgkppolomflaeledoccb`, item name
   `ComplyEaze Pack: GSTR-1/GSTR-3B Downloader`, version `0.3.2`, and visibility
   `Public`.
-- Repository source is the pre-1.0 `v0.5.0` beta release. The current
-  Store-published package evidence is for `v0.3.2` only. Workflow run
-  `29507382500` built and verified the exact `v0.4.0` package and uploaded it
-  with Store state `SUCCEEDED`, but publish returned HTTP 400 because dashboard
-  requirements were incomplete. The pending ZIP SHA-256 is
+- The past `v0.4.0` release workflow run `29507382500` built and verified the
+  exact package and uploaded it with Store state `SUCCEEDED`, but publish
+  returned HTTP 400 because dashboard requirements were incomplete. It was not
+  published. The historical pending ZIP SHA-256 is
   `6ee4be24cafbe15db69275cac4da6b212f3de49b0f747eb9909eed7d293347c6`.
+- Repository source and the GitHub release are the pre-1.0 `v0.5.0` beta,
+  published as a pre-release. The Chrome Web Store package for `v0.5.0` is
+  submitted and in review as a draft; it is not approved, published, or live.
+  `v0.3.2` remains the last confirmed Store publication and the only basis for
+  current Store-published public claims.
 - The `v0.5.0` beta does not expand Store-facing, durable full-year, or
   universal live-period/format claims. Synthetic regression coverage of target
   binding, artifact selection, and recovery is not a substitute for the
@@ -135,17 +139,22 @@ durable full-year, or stable-release claims.
 - [ ] Legal review of live GST Portal terms against exact extension behaviour.
 - [ ] Privacy Policy, Terms, support URL, source URL, and limited-use statement
       are live and accessible without login.
-- [ ] Chrome privacy declarations match the exact final build. For `v0.4.0`,
-      disclose personally identifiable information, financial and payment
-      information, and website content because Chrome counts local processing.
-      Keep authentication information, web history, and user activity
-      unchecked unless runtime behavior changes.
+- [ ] Chrome privacy declarations match the exact final build. Disclose
+      personally identifiable information, financial and payment information,
+      and website content because Chrome counts local processing. Keep
+      authentication information, web history, and user activity unchecked
+      unless runtime behavior changes.
 - [x] Source-controlled Store screenshots and promotional images use only
-      synthetic/redacted data. The seven `v0.4.0` PNG exports were generated
-      from refreshed source SVGs, visually checked, and recorded in
+      synthetic/redacted data. The seven PNG exports prepared for the past
+      `v0.4.0` dashboard update were generated from refreshed source SVGs,
+      visually checked, and recorded in
       `docs/chrome-web-store/assets/exports/asset-hashes.json`.
-- [ ] Upload the generated `v0.4.0` Store screenshot/promotional PNGs to the
-      Chrome Web Store dashboard, then record dashboard image review state.
+- [ ] The regenerated Store exports are visually reviewed by a maintainer and
+      bound to the exact `v0.5.0` submission. Source/export hash agreement alone
+      does not satisfy this review.
+- [ ] Upload the generated Store screenshot/promotional PNGs to the Chrome Web
+      Store dashboard, then record dashboard image review state for the exact
+      submitted release.
 - [ ] Exact ZIP tested in a clean Chrome profile.
 - [ ] Exact ZIP tested against the live GSTR-3B and GSTR-1 flows by an
       authorised user.
@@ -156,19 +165,65 @@ durable full-year, or stable-release claims.
       cookies, credentials, OTP, or CAPTCHA data.
 - [ ] Authorised live full fiscal year run reconciles every eligible target as
       downloaded, positively not filed, blocked, or failed in the local ledger.
-- [ ] Authorised live full fiscal year recovery matrix records every currently
-      offered return/artifact selection as exercised or as explicitly expected
-      fail-closed/not applicable when it cannot reach an acquisition checkpoint.
-      For each acquisition-capable selection, cover service-worker restart,
-      browser restart, interrupted download, cancellation/discard and its
-      cleanup outcome, and a retained checkpoint whose browser record is no
-      longer available. A resumed path must not repeat a
-      completed target; an unproven path must remain non-complete until retry
-      or cancellation. Manual observation may be recorded only as an explicit
-      non-completing action that still requires retry before ZIP staging. Record
-      category/state summaries only—never raw portal URLs,
-      filenames, download IDs, page or DOM text, local paths, or taxpayer/session
-      data.
+- [ ] The authorised live full fiscal year recovery matrix below is complete:
+      every observation matches a completion-eligible row in the cell legend,
+      and every recorded date is valid and no later than the current UTC date.
+
+The selection rows are derived from the supported Cartesian product of
+`FILED_RETURNS_RETURN_TYPES` and `FILED_RETURNS_ARTIFACT_TYPES`; a test keeps
+this instrument aligned with those canonical constants. The same test derives
+each row's acquisition capability from
+`supportsFullFiscalYearFiledReturnsRun` and
+`supportsFiledReturnsArtifactType`; the document cannot declare that fact. For
+each row, the final expectation cell's capability claim must agree with the
+derived value. For each acquisition-capable selection, record service-worker
+restart, browser restart, interrupted download, cancellation/discard and its
+cleanup outcome, and a retained checkpoint whose browser record is no longer available. A
+resumed path must not repeat a completed target. An unproven path remains
+non-complete until retry or cancellation. Manual observation is only an
+explicit non-completing action and still requires retry before ZIP staging.
+
+Every cell must match one complete row in this legend. The test renders the
+legend from the same rule table used for validation, so state, reason, date,
+column, and completion semantics cannot drift into an independent vocabulary.
+
+<!-- BEGIN: full-year-recovery-cell-legend -->
+
+| State                     | Date constraint                             | Reason                              | Allowed column           | Derived row capability    | Recorded capability claim | Completion-eligible |
+| ------------------------- | ------------------------------------------- | ----------------------------------- | ------------------------ | ------------------------- | ------------------------- | ------------------- |
+| `pass`                    | valid `YYYY-MM-DD`, today or earlier in UTC | none                                | scenario columns         | any derived capability    | none                      | yes                 |
+| `fail`                    | valid `YYYY-MM-DD`, today or earlier in UTC | none                                | scenario columns         | any derived capability    | none                      | no                  |
+| `fail-closed-as-expected` | valid `YYYY-MM-DD`, today or earlier in UTC | `expected-fail-closed-boundary`     | scenario columns         | any derived capability    | none                      | yes                 |
+| `fail-closed-as-expected` | valid `YYYY-MM-DD`, today or earlier in UTC | `expected-fail-closed-boundary`     | final expectation column | `acquisition-capable`     | `acquisition-capable`     | yes                 |
+| `not-applicable`          | valid `YYYY-MM-DD`, today or earlier in UTC | `recovery-scenario-not-applicable`  | scenario columns         | `acquisition-capable`     | none                      | no                  |
+| `not-applicable`          | valid `YYYY-MM-DD`, today or earlier in UTC | `recovery-scenario-not-applicable`  | scenario columns         | `not-acquisition-capable` | none                      | yes                 |
+| `not-applicable`          | valid `YYYY-MM-DD`, today or earlier in UTC | `selection-not-acquisition-capable` | final expectation column | `not-acquisition-capable` | `not-acquisition-capable` | yes                 |
+| `not-yet-run`             | `not-recorded`                              | none                                | scenario columns         | any derived capability    | none                      | no                  |
+| `not-yet-run`             | `not-recorded`                              | `not-recorded`                      | final expectation column | any derived capability    | none                      | no                  |
+
+<!-- END: full-year-recovery-cell-legend -->
+
+If these combinations are insufficient, add a rule through review before
+recording the observation. No other cell text is permitted, so raw portal URLs,
+filenames, download IDs, page or DOM text, local paths, and taxpayer/session
+data are unrepresentable in the matrix.
+
+<!-- BEGIN: full-year-recovery-matrix -->
+
+| Return type | Artifact type | Service-worker restart          | Browser restart                 | Interrupted download            | Cancellation/discard and cleanup | Retained checkpoint; browser record unavailable | Expected fail-closed / not applicable                 |
+| ----------- | ------------- | ------------------------------- | ------------------------------- | ------------------------------- | -------------------------------- | ----------------------------------------------- | ----------------------------------------------------- |
+| GSTR-3B     | PDF           | not-yet-run; date: not-recorded | not-yet-run; date: not-recorded | not-yet-run; date: not-recorded | not-yet-run; date: not-recorded  | not-yet-run; date: not-recorded                 | not-yet-run; date: not-recorded; reason: not-recorded |
+| GSTR-3B     | JSON          | not-yet-run; date: not-recorded | not-yet-run; date: not-recorded | not-yet-run; date: not-recorded | not-yet-run; date: not-recorded  | not-yet-run; date: not-recorded                 | not-yet-run; date: not-recorded; reason: not-recorded |
+| GSTR-1      | PDF           | not-yet-run; date: not-recorded | not-yet-run; date: not-recorded | not-yet-run; date: not-recorded | not-yet-run; date: not-recorded  | not-yet-run; date: not-recorded                 | not-yet-run; date: not-recorded; reason: not-recorded |
+| GSTR-1      | EXCEL         | not-yet-run; date: not-recorded | not-yet-run; date: not-recorded | not-yet-run; date: not-recorded | not-yet-run; date: not-recorded  | not-yet-run; date: not-recorded                 | not-yet-run; date: not-recorded; reason: not-recorded |
+| GSTR-1      | PDF_AND_EXCEL | not-yet-run; date: not-recorded | not-yet-run; date: not-recorded | not-yet-run; date: not-recorded | not-yet-run; date: not-recorded  | not-yet-run; date: not-recorded                 | not-yet-run; date: not-recorded; reason: not-recorded |
+| GSTR-2B     | PDF           | not-yet-run; date: not-recorded | not-yet-run; date: not-recorded | not-yet-run; date: not-recorded | not-yet-run; date: not-recorded  | not-yet-run; date: not-recorded                 | not-yet-run; date: not-recorded; reason: not-recorded |
+| GSTR-2B     | JSON          | not-yet-run; date: not-recorded | not-yet-run; date: not-recorded | not-yet-run; date: not-recorded | not-yet-run; date: not-recorded  | not-yet-run; date: not-recorded                 | not-yet-run; date: not-recorded; reason: not-recorded |
+| GSTR-2B     | EXCEL         | not-yet-run; date: not-recorded | not-yet-run; date: not-recorded | not-yet-run; date: not-recorded | not-yet-run; date: not-recorded  | not-yet-run; date: not-recorded                 | not-yet-run; date: not-recorded; reason: not-recorded |
+| GSTR-2B     | PDF_AND_EXCEL | not-yet-run; date: not-recorded | not-yet-run; date: not-recorded | not-yet-run; date: not-recorded | not-yet-run; date: not-recorded  | not-yet-run; date: not-recorded                 | not-yet-run; date: not-recorded; reason: not-recorded |
+
+<!-- END: full-year-recovery-matrix -->
+
 - [ ] Action-bound capture is tested in clean Chrome and Brave profiles plus the
       real profile where the native Save dialog appeared, with "Ask where to
       save each file" on and off, existing filename collisions, and
@@ -255,16 +310,19 @@ durable full-year, or stable-release claims.
       `nfnbhekccajjfgkppolomflaeledoccb`, item name
       `ComplyEaze Pack: GSTR-1/GSTR-3B Downloader`, item type `extension`,
       version `0.3.2`, and visibility `Public`.
-- [x] Upload the exact `v0.4.0` package. Workflow run `29507382500` reported
-      upload state `SUCCEEDED`; publication remains blocked on dashboard
-      closeout and is not claimed complete.
+- [x] Record the historical `v0.4.0` package upload. Workflow run `29507382500`
+      reported upload state `SUCCEEDED`; that release was not published.
+- [x] Record the `v0.5.0` Chrome Web Store submission. The package is submitted
+      and in review as a draft; approval, publication, and live availability
+      are not claimed.
 - [x] Add a read-only Chrome Web Store status monitor for submitted packages.
       Scheduled runs use the dedicated `chrome-web-store-status` environment so
       publication/rejection monitoring is not blocked by the protected publishing
       approval gate.
 - [ ] Record a read-only Chrome Web Store Status run with
-      `expected_version=0.4.0` and `require_published=false` after dashboard
-      submission, then `require_published=true` after publication. Use
+      `expected_version=0.5.0` and `require_published=false` while the submitted
+      draft is in review, then `require_published=true` only after confirmed
+      publication. Use
       [`docs/chrome-web-store/dashboard-closeout.md`](chrome-web-store/dashboard-closeout.md)
       for the dashboard and read-only status-monitor closeout checklist.
 
@@ -278,10 +336,11 @@ version here.
 
 ## Not Yet Stable Or Broad-Claim Ready Until
 
-The V0 listing exists for Store-published `v0.3.2`, `v0.4.0` is uploaded but not
-yet published, and the source-build alpha
-full-year workflow has maintainer evidence for automatic local downloads after
-user initiation. Pack must not claim stable Chrome Web Store maturity,
+The last confirmed Store publication is `v0.3.2`; the past `v0.4.0` package was
+uploaded but not published, and the `v0.5.0` package is submitted and in review
+as a draft. The source-build alpha full-year workflow has maintainer evidence
+for automatic local downloads after user initiation. Pack must not claim stable
+Chrome Web Store maturity,
 store-facing full-year availability, durable restart-safe full-year support,
 legal approval, live manifest/index/exception output, or broad GST coverage
 until legal review, live public policy URL confirmation, exact-ZIP manual QA,

docs/RELEASE.md

@@ -154,10 +154,13 @@ dispatch it with `require_published=true` when final publication, not just
 submission, is the release gate.
 
 Configure the status workflow with a dedicated `chrome-web-store-status`
-environment that has no required reviewer protection. Give it a read-only
-service-account `CWS_SERVICE_ACCOUNT_JSON` secret plus `CWS_PUBLISHER_ID`; do
-not copy the publish workflow's OAuth client secret or refresh token into this
-environment. Keep the publishing workflow on the protected `chrome-web-store`
+environment that has no required reviewer protection. Give it
+`CWS_PUBLISHER_ID` plus either `CWS_SERVICE_ACCOUNT_JSON` or the complete OAuth
+set `CWS_CLIENT_ID`, `CWS_CLIENT_SECRET`, and `CWS_REFRESH_TOKEN`. Use a
+dedicated OAuth set provisioned with the read-only grant; do not copy broader
+publishing credentials into this environment. The status checker performs only
+the `fetchStatus` call, and its service-account flow requests the read-only API
+scope. Keep the publishing workflow on the protected `chrome-web-store`
 environment.
 
 For local dry-runs against a generated release package:

docs/chrome-web-store/assets/README.md

@@ -1,10 +1,10 @@
 # Chrome Web Store Asset Sources And Exports
 
 These source assets and generated exports are the safe synthetic asset set for
-the `v0.4.0` Chrome Web Store dashboard update. They use the current Pack popup
-visual language as a reference while intentionally excluding real GST Portal
-screenshots and taxpayer data. Store publication is recorded in
-[`../listing.md`](../listing.md); these files remain source-controlled inputs,
+the current Chrome Web Store submission recorded in
+[`../listing.md`](../listing.md). They use the current Pack popup visual
+language as a reference while intentionally excluding real GST Portal
+screenshots and taxpayer data. These files remain source-controlled inputs,
 not dashboard-held proof.
 
 The asset dimensions follow Chrome's official "Supplying Images" guidance:
@@ -50,9 +50,10 @@ dashboard review state in [`../listing.md`](../listing.md).
 ## Generated Exports
 
 `exports/asset-hashes.json` is the authoritative generated inventory. It records
-each PNG's source, exact dimensions, and SHA-256. Re-export and review that
-manifest whenever any source SVG changes; do not duplicate hashes manually in
-this README.
+each PNG's source, the source SVG's SHA-256, the exact dimensions, and the PNG's
+SHA-256. The asset test fails when a source digest no longer matches, so an SVG
+edit must be followed by `pnpm store:assets`. Do not edit the generated manifest
+or duplicate its hashes manually in this README.
 
 For each Store release, keep the exported assets, package upload, privacy
 declarations, reviewer instructions, review result, and publication state tied