fix(kuasa-pajak): restore BPHTB preparation and navigation Closes #1932. Closes #1930. ## Changes Kuasa pajak could be sent back to role selection when opening personal PBB registration links and could reach BPHTB steps with personal-profile guards or missing controls. This PR routes delegated object registration through an explicit taxpayer chooser and shares the complete BPHTB preparation UI with the dashboard. - Restore "Tambah Objek" on the kuasa dashboard and combined object list. Bridge only the finite legacy personal object entry routes for accounts without a personal taxpayer profile. Show each eligible active taxpayer explicitly, preserve PBB and other tax selections, and resolve omitted IDs from the server catalog without choosing an arbitrary taxpayer. - Share BPHTB lists, creation forms, requirement progress, recipient management, acquisition and object steps, calculation, payment codes, and history. Keep direct object navigation and searches for additional recipients. - Restore delegated KTP and employment editing, NIB and incorporation documents, shareholders, family submissions, MBR evidence and previews, and ownership certificates. - Require approved, in-date kuasa for delegated targets. Private party and object operations require the exact taxpayer's grant. Recheck grants, identities, financial snapshots, and object assignments under transaction locks after uploads; reuse existing payment codes. All five regular object creation flows now hold current own-link or grant authority through the write transaction. - Repair native account, contact completion, object profiling, SPTPD, payment-letter, and breadcrumb navigation. Use the existing government eligibility rule consistently in chooser, entry, form, and submission guards. Official requirement review, assessment, research creation, and TTE signing remain restricted to Bapenda staff, as confirmed in the requested scope. Family changes retain pending Admin review. The ordinary personal registration flow keeps its own taxpayer context; delegated targets use the existing protected kuasa routes. ## Release impact Patch. Restores and consolidates existing BPHTB, object registration, and kuasa-pajak functionality. It adds no distinct business workflow or integration. ## Migration notes No schema, dependency, or environment changes. Delegated BPHTB uses explicit kuasa scope. The legacy object bridge is limited to navigation into the existing guarded kuasa routes. Existing approved, in-date grants remain the authorization source. Production changes require merge and deployment. ## Validation - Read-only production inspection reproduced #1930: the reported PBB link returned the fully onboarded demo kuasa account to role selection. No tax records, payments, uploads, or messages were created. - No-emit TypeScript: 377 changed TS/TSX roots and their dependencies, zero diagnostics. - ESLint: 398 changed source and fixture files, zero warnings or errors. - UI policy: 376 source files with zero violations; foreground, 248 shared table cards, and page-header checks pass. - Drizzle query policy: 376 changed source files, zero violations or exceptions. - Changed-source and full React Doctor audits pass with zero errors or warnings, complete reports, and no skipped checks. Reviewed graph-loader contracts are current. - Added regression fixtures for scope boundaries, recipient and taxpayer selection, revoked grants, government eligibility, legacy entry/layout guards, uploads, MBR proofs, map assignments, financial snapshots, and payment-code reuse. Fixtures were not executed. - During the initial implementation, builds, tests, and dev servers were not run, as instructed. The patched UI has not been runtime-tested in a preview deployment. ## CI repair The Production build job stopped before compilation because the native RSC fixture exceeded its 25-second child-process deadline. Its enclosing test allowed 30 seconds while the workflow allowed 60 seconds. The isolated fixture passed locally before the repair. Raise only this fixture's child deadline to 50 seconds and its enclosing deadline to 55 seconds, preserving the workflow bound and all 18 native cache and authorization scenarios. Update only the matching reviewed loader fingerprint. The isolated fixture and ESLint pass after the change. The full React Doctor audit passes with zero errors or warnings and complete graph coverage. No local build or dev server was run. The CI deadline repair was confirmed by the successful Production build in [run 41139729335](https://github.com/rafadlis/sapada/actions/runs/41139729335). ## Recipient authorization review repair Recipient mutations previously accepted personal ticket membership through the shared BPHTB scope API, although the personal recipient page is read-only. The common recipient mutation guard now accepts only `dasbor` and `kuasa-pajak` before reading ticket data. This covers replace, add, make-primary, and remove actions and rejects malformed caller-provided scopes. Staff defaults retain the existing dashboard authorization. Kuasa-pajak retains the shared preparation UI, current-actor and ticket checks, exact target taxpayer grants, and transaction-time rechecks of approved, in-date grants. The general personal BPHTB helper and all unrelated actions are unchanged. Added 20 focused regression cases across the four real actions using the real scope and target-grant helpers: personal and forged scope denial, staff defaults, active delegated targets, invalid actors, foreign targets, and grants revoked before a write. The Production build workflow now runs just these recipient cases immediately after dependency setup. Static validation passed: recipient action and imported dependencies have no TypeScript diagnostics; ESLint, `node --check`, Drizzle policy, workflow YAML/shell syntax, full React Doctor with complete coverage and no findings, and diff checks pass. Tests, builds, and dev servers were not run locally; the user requested execution through CI. The focused recipient authorization step passed in [GitHub Actions run 41148385720](https://github.com/rafadlis/sapada/actions/runs/41148385720/job/124378769450) on head `b9d4f09a93`. The build and generated public-shell checks passed; the later offline Home profiler failed during native browser startup, addressed below. Production advanced while this repair was in progress, and GitHub blocked pull-request CI on a loader-contract conflict. Merged production commit `8830ec2d9f` and retained both fixture changes, the scoped taxpayer profile reader, and delegated contact navigation. Updated only the conflicting fixture fingerprint. Changed-source and full React Doctor audits, merged-page/action TypeScript, lint, and workflow syntax checks pass after resolution. Tests remain delegated to CI. ## Home profiler startup repair [Run 41148385720](https://github.com/rafadlis/sapada/actions/runs/41148385720/job/124378769450) compiled Next.js and passed the public-shell and recipient authorization checks. The offline Home artifact recorded a native Chromium `SIGSEGV` before its DevTools endpoint, while starting the scripts-enabled case. Positive-control and scripts-disabled cases had already completed. The Home profiler called the raw browser starter, bypassing the repository's existing `startBrowserWithRetry` used by the public-shell checker. Reuse that helper only at the launch call. It permits one fresh private runtime after a trusted startup segmentation fault and successful owned cleanup. The existing case deadline, cancellation, second-crash failure, connection failures, trace/content checks, and cleanup rules remain enforced. The cause of Chromium's native crash is not established. Validation: `node --check scripts/check-home-startup-profile.mjs`, file-scoped ESLint, and `git diff --check` pass. An independent source review found no lifecycle regression. The existing startup-recovery tests passed in the failing CI run, including successful retry, second-crash failure, and cleanup/cancellation vetoes. No local tests, builds, or dev servers were run, per the request to leave execution to CI. The updated profiler awaits the new CI run. ## Navigation acknowledgement deadline repair [Run 41154760569](https://github.com/rafadlis/sapada/actions/runs/41154760569/job/124399003702) passed 502 of 503 web-vitals regressions. The remaining CSS-transport fixture failed at the first Home navigation before it reached the CSS-bearing route. Its owned diagnostic was `command-timeout` for `Page.navigate`, with no pending Fetch requests and a live browser. The ten-second navigation reply deadline expired before the thirty-second document-load barrier; the checker already permits one complete restart. The native cause of the stall is not established. Allow twenty seconds only for `Page.navigate` replies. Other commands retain ten seconds, and the document-load barrier, single restart, overall inspection deadline, cancellation, cleanup, and strict CSS/content checks remain enforced. Give the deliberately repeated-timeout fixture the existing two-inspection 180-second test allowance, retaining its exact two-attempt assertion. Updated exact timeout-boundary coverage and added mock-clock controls through both static-shell and Home-profile connectors using the actual connection sender and load waiter. They deliver an acknowledgement after fifteen seconds and a load event after twenty-five seconds, requiring both before completion. Existing semantic and repeated-failure cases remain. Local validation: `node --check` and file-scoped ESLint pass for all four edited scripts, and `git diff --check` passes. Independent source review found no blocking regression. Tests, builds, and dev servers were not run locally, per the request to leave execution to CI. The web-vitals regression step, including the delayed-acknowledgement controls, passed in [run 41157858307](https://github.com/rafadlis/sapada/actions/runs/41157858307/job/124408543002). ## MKN history fixture integration repair The same run then failed all six MKN owner-history tests during fixture initialization: the newer production fixture did not provide `@/lib/data/kuasa-pajak-access`, imported by this branch's shared profiling route resolver. No history assertion was reached. Merge current production `b3319cdd36` and add an explicit empty active-kuasa fixture to the MKN test's shared dependencies. This preserves its personal-owner fallback, staff checks, and every existing assertion without changing application authorization. Update only the matching reviewed loader fingerprint and its boundary explanation. Validation: `node --check lib/mkn-owner-history.test.mjs` passes. File-scoped ESLint reports no errors and one existing unused-variable warning from the unchanged deliberate `actorEmail` omission. The full React Doctor audit passes with zero errors or warnings, complete graph coverage, and no skipped checks. Diff checks pass, and an independent source review confirmed that no other runtime dependency is missing in the fixture. Local tests, builds, and dev servers were not run; the six history cases remain in the existing CI step for confirmation. ## Shareholder identity disclosure repair A company mandate and a caller-created shareholder association previously exposed canonical person/company profiles, including through existing fabricated links and name searches. Apply a shared SQL policy to shareholder detail, list, per-shareholder history, and combined history. For kuasa-pajak, canonical names, addresses, NIK and NIB require an independent approved, in-date grant for that identity's own taxpayer and the current actor. Company associations, creator IDs, zero/positive shares, and active/inactive status never grant identity access. The same protected expressions drive search, counts, and name sorting; delegated ties use the association ID. Company-mandate holders retain shareholder IDs, percentages, status, creation and management actions. Stored identity fields outside their independent grants return null. This also protects pre-existing fabricated associations, so no new identity-link verification or schema migration is required. Dashboard staff retain their existing access and original SQL field expressions. Added ten PGlite/Drizzle regression cases using all four real readers and the shared SQL policy. They cover individual/corporate and legacy/fabricated associations, search/sort inference, exact grants, invalid actor/status/dates, revocation, staff access, and company authorization. The existing shareholder mutation/scope fixture runs alongside these cases in a dedicated early CI step. The staff query-observation fixture retains its count-first boundaries and assertions; only its reviewed shareholder AST baseline and loader fingerprint were updated for the new delegated projections. Local validation passes: no-emit TypeScript for the readers, UI callers and imports; file-scoped ESLint and fixture syntax; static Drizzle query policy; workflow YAML/shell syntax; full React Doctor with zero findings, complete graph coverage and no skipped checks; diff checks. Independent investigation and bypass/regression review found no remaining path within the affected shareholder readers. Tests, builds, and dev servers were not run locally, as requested. The early shareholder identity privacy step passed in [CI run 41174811566](https://github.com/rafadlis/sapada/actions/runs/41174811566/job/124460062544) on head `bcd47f22bd`, executing the new disclosure cases and existing shareholder management/scope controls. The review thread is resolved. Subsequent compilation succeeded, but the build failed type checking at the Aipah shareholder summary caller. Its input now accepts nullable individual/company names, matching the privacy-protected reader; the existing null-safe output is unchanged. No-emit TypeScript covering the actual `lib/aipah/tools.ts` caller and imported readers, plus file-scoped ESLint, passes. The new Production build is pending.