@micha.bigler/ui-core-micha 2.41.0 → 2.41.2

package/tests/packageTreeShaking.test.js

@@ -0,0 +1,126 @@
+import { cp, mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { gzipSync } from 'node:zlib';
+
+import { build } from 'vite';
+import { afterAll, expect, test } from 'vitest';
+
+const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const packageManifest = JSON.parse(
+  await readFile(path.join(packageRoot, 'package.json'), 'utf8'),
+);
+const packageName = packageManifest.name;
+let temporaryRoot;
+
+async function bundlePackageExport({ caseName, exportName, manifestField }) {
+  temporaryRoot ||= await mkdtemp(path.join(tmpdir(), 'ui-core-tree-shaking-'));
+  const consumerRoot = path.join(temporaryRoot, caseName);
+  const installedPackageRoot = path.join(
+    consumerRoot,
+    'node_modules',
+    ...packageName.split('/'),
+  );
+
+  await mkdir(installedPackageRoot, { recursive: true });
+  await cp(
+    path.join(packageRoot, 'dist'),
+    path.join(installedPackageRoot, 'dist'),
+    { recursive: true },
+  );
+  const installedFontRoot = path.join(
+    consumerRoot,
+    'node_modules',
+    '@fontsource',
+    'dm-sans',
+  );
+  await mkdir(path.dirname(installedFontRoot), { recursive: true });
+  await cp(
+    path.join(packageRoot, 'node_modules', '@fontsource', 'dm-sans'),
+    installedFontRoot,
+    { recursive: true },
+  );
+  await writeFile(
+    path.join(installedPackageRoot, 'package.json'),
+    JSON.stringify({
+      name: packageName,
+      version: packageManifest.version,
+      [manifestField]: packageManifest[manifestField],
+      sideEffects: packageManifest.sideEffects,
+    }),
+  );
+
+  const entryPath = path.join(consumerRoot, 'entry.js');
+  await writeFile(entryPath, `export { ${exportName} } from '${packageName}';\n`);
+
+  const result = await build({
+    configFile: false,
+    logLevel: 'silent',
+    root: consumerRoot,
+    build: {
+      minify: true,
+      rollupOptions: {
+        input: entryPath,
+        preserveEntrySignatures: 'strict',
+        external: (id) => (
+          id !== packageName
+          && !id.startsWith('@fontsource/dm-sans')
+          && !id.startsWith('.')
+          && !path.isAbsolute(id)
+        ),
+        output: {
+          format: 'es',
+        },
+      },
+      write: false,
+    },
+  });
+  const outputs = Array.isArray(result)
+    ? result.flatMap((buildResult) => buildResult.output)
+    : result.output;
+  const entryChunk = outputs.find((output) => output.type === 'chunk' && output.isEntry);
+
+  expect(entryChunk, `${manifestField} entry should produce a bundle`).toBeDefined();
+  return {
+    code: entryChunk.code,
+    css: outputs
+      .filter((output) => output.type === 'asset' && output.fileName.endsWith('.css'))
+      .map((output) => output.source.toString())
+      .join('\n'),
+    rawBytes: Buffer.byteLength(entryChunk.code),
+    gzipBytes: gzipSync(entryChunk.code).byteLength,
+  };
+}
+
+afterAll(async () => {
+  if (temporaryRoot) await rm(temporaryRoot, { recursive: true, force: true });
+});
+
+test('built package entries resolve and unused translation bundles tree-shake', async () => {
+  const authOnly = await bundlePackageExport({
+    caseName: 'auth-main',
+    exportName: 'authTranslations',
+    manifestField: 'main',
+  });
+  const aggregate = await bundlePackageExport({
+    caseName: 'aggregate-module',
+    exportName: 'uiCoreTranslations',
+    manifestField: 'module',
+  });
+
+  expect(authOnly.code).toContain('Auth.LOGIN');
+  expect(authOnly.code).not.toContain('ChartFrame.LOADING');
+  expect(authOnly.css).toContain('DM Sans');
+  expect(aggregate.code).toContain('ChartFrame.LOADING');
+  expect(aggregate.rawBytes).toBeGreaterThan(authOnly.rawBytes);
+  expect(aggregate.gzipBytes).toBeGreaterThan(authOnly.gzipBytes);
+
+  const rawDelta = aggregate.rawBytes - authOnly.rawBytes;
+  const gzipDelta = aggregate.gzipBytes - authOnly.gzipBytes;
+  console.info(
+    `tree-shaking measurement: auth=${authOnly.rawBytes} B raw/${authOnly.gzipBytes} B gzip; `
+      + `aggregate=${aggregate.rawBytes} B raw/${aggregate.gzipBytes} B gzip; `
+      + `delta=+${rawDelta} B raw/+${gzipDelta} B gzip`,
+  );
+}, 15_000);

package/work-orders/AUTH-5.md

@@ -0,0 +1,154 @@
+# AUTH-5 — `addPublicPath` muss dynamische Routen ausdrücken können
+
+**Target repo:** `ui-core-micha` (branch `main`)
+**Tier:** 3 — shared-core. Die Änderung betrifft die Login-Weiterleitung jeder konsumierenden App.
+
+**Kein Prototyp.** Diese Work Order hat keine Oberfläche — sie erweitert eine Registrierungs-API.
+
+**Auslöser:** `jg-ferien` PUB-7 Teil 2. Diese WO ist dessen Vorbedingung; nach der Veröffentlichung
+zieht jg seinen Pin von **`2.37.1`** hoch.
+
+---
+
+## A. Envelope
+
+### Goal
+
+`apiClient` leitet bei 401/403 per hartem `window.location.assign("/login")` um — **ausser** der
+aktuelle Pfad steht auf einer Allowlist (`redirectToLoginOnce`, `src/auth/apiClient.jsx`). Der
+Mechanismus ist richtig gebaut: auf einer öffentlichen Seite unterbleibt die Weiterleitung und der
+401 wird an die Komponente durchgereicht.
+
+**Was er nicht kann, ist dynamische Routen.** `matchesPublicPath` vergleicht mit `startsWith`, ausser
+bei `/`, wo Gleichheit verlangt wird. Eine App mit öffentlichen Seiten unter einem **variablen
+Segment** — `/<slug>`, `/<slug>/team` — kann ihre öffentliche Fläche damit nicht beschreiben. Ein
+konkreter Slug lässt sich eintragen; der nächste, den jemand anlegt, fällt wieder heraus.
+
+**Warum das mehr ist als eine Unbequemlichkeit.** Fehlt der Pfad in der Liste, landet ein anonymer
+Besucher beim ersten 401 auf `/login` — auf einer Seite, die öffentlich sein soll. Von aussen ist das
+nicht von „diese Seite gibt es nicht" zu unterscheiden, und der Fehler zeigt sich erst, wenn ein
+zweites Department existiert. Er sieht dann aus wie ein Zufall, nicht wie eine Lücke.
+
+**Erwartetes Ergebnis.** Eine konsumierende App kann ihre öffentliche Fläche vollständig beschreiben,
+auch wenn Teile davon aus variablen Segmenten bestehen.
+
+### Scope
+
+- **`addPublicPath` nimmt zusätzlich ein `RegExp` entgegen** (String bleibt unverändert gültig).
+- **`matchesPublicPath` unterscheidet nach Typ**: String wie bisher (`/` exakt, sonst `startsWith`),
+  `RegExp` per `test()` gegen **ausschliesslich `window.location.pathname`** — nie gegen Query oder
+  Fragment, damit ein Muster nicht versehentlich über den Pfad hinaus greift.
+- **`removePublicPath` funktioniert für beide Formen.** Bei `RegExp` über Identität des übergebenen
+  Objekts; das gehört dokumentiert, weil zwei gleich aussehende Literale nicht dasselbe Objekt sind.
+- **`BUILTIN_PUBLIC_PATHS` bleibt eingefroren und rein string-basiert.** Kein Muster in der
+  Bibliotheks-Liste — sie darf sich nicht durch eine Konsumenten-Erweiterung verschieben.
+- **Die Dokumentation am Aufruf sagt, was der Konsument nun selbst trägt**: ein zu weites Muster
+  unterdrückt die Weiterleitung dort, wo sie gebraucht wird, und ein abgelaufener Login endet dann in
+  einer stillen Fehlerseite statt am Login. Muster gehören verankert (`^…$`).
+
+### Non-goals / do not touch
+
+- **Keine Änderung am Weiterleitungsverhalten selbst** — weder Ziel, noch `?next=`, noch der
+  einmalige Sperrmechanismus (`redirectingToLogin`).
+- **Keine Änderung an der eingefrorenen Builtin-Liste** und keine an `isPublicSitePath`.
+- **Keine Änderung am Per-Request-Opt-out** für Bootstrap-Proben.
+- **Keine neue Prüfung gegen Query oder Fragment.**
+
+### Risks
+
+- **Die Verantwortung wandert zum Konsumenten.** Ein unverankertes Muster wie `/team` trifft auch
+  `/admin/team`. Das ist der Preis der Flexibilität und muss in der Dokumentation stehen, nicht nur
+  im Kopf des Autors.
+- **Geteilter Code**: jede konsumierende App bekommt die Änderung. Deshalb rein additiv — bestehende
+  String-Registrierungen müssen sich zeichengenau gleich verhalten.
+- **Ein Muster, das zu eng greift, ist unsichtbar**, bis jemand die betroffene Seite anonym öffnet.
+  Deshalb gehört die Gegenrichtung mitgetestet.
+
+### Required tests to WRITE
+
+- **Regression, nicht verhandelbar:** String-Registrierungen verhalten sich exakt wie bisher — `/`
+  nur bei Gleichheit, andere Einträge per Präfix.
+- Ein registriertes `RegExp` trifft die passenden Pfade; ein nicht passender Pfad **löst weiterhin
+  die Weiterleitung aus**.
+- Das Muster wird gegen `pathname` geprüft, nicht gegen Query oder Fragment.
+- `removePublicPath` entfernt einen `RegExp`-Eintrag; ein Builtin-Pfad lässt sich weiterhin **nicht**
+  entfernen.
+- Ein `RegExp` in `CONSUMER_PUBLIC_PATHS` bricht die bestehende Auswertung der String-Einträge nicht.
+- **Affected set** (laufen, nicht schreiben): die vorhandenen `apiClient`-Tests.
+
+---
+
+## B. Implementation map
+
+**Selbst umgesetzt (nicht per Codex)** — laufende Operator-Anweisung für diese Session.
+
+### Design-Entscheidungen
+
+- **`addPublicPath`/`removePublicPath`** akzeptieren jetzt zusätzlich `instanceof RegExp` neben
+  `string`; `CONSUMER_PUBLIC_PATHS` bleibt ein `Set`, das für `RegExp`-Objekte automatisch
+  Identitäts-Löschung liefert (`Set.delete` nutzt SameValueZero) — kein Sonderfall nötig.
+- **`matchesPublicPath`** prüft `entry instanceof RegExp` zuerst und ruft `entry.test(pathname)` —
+  ausschliesslich gegen `window.location.pathname`, nie gegen `search`/`hash`, da die Funktion
+  ohnehin nur `pathname` als Parameter erhält (kein Risiko einer versehentlichen Konkatenation).
+- **`BUILTIN_PUBLIC_PATHS` unverändert** — bleibt string-only und eingefroren, keine Berührung.
+- Dokumentation an `addPublicPath`/`removePublicPath` erweitert: Anker-Pflicht (`^…$`) für
+  `RegExp`-Muster und Identitäts-Hinweis für `removePublicPath`.
+
+### Kontextpaket
+
+- `src/auth/apiClient.jsx` — einzige geänderte Quelldatei.
+
+### Tests
+
+`tests/apiClientPublicPaths.test.js` (neu, 11 Fälle) — fährt durch den echten
+Response-Interceptor (nicht durch eine Nachbildung von `matchesPublicPath`), damit ein Fehler in
+der Verdrahtung selbst auffällt, nicht nur ein Fehler im Matcher. Jeder Test importiert das Modul
+frisch (`vi.resetModules()` + dynamisches `import()`), weil `redirectingToLogin` ein
+Modul-Level-Riegel ist, der sich in jsdom nie durch echte Navigation zurücksetzt.
+`window.location` wird durch ein rein synthetisches Objekt ersetzt (jsdoms echtes
+`location.assign` ist nicht konfigurierbar, und `pushState` bindet nicht an ein ersetztes
+`location`-Objekt) — deckt exakt das ab, was der Interceptor liest (`pathname`) und aufruft
+(`assign`). Affected set: `authApiRegistration.test.js`, `AuthContext.test.jsx`,
+`feedApi.test.js`, `messagingApi.test.js`, `notificationsApi.test.js` — alle grün.
+
+---
+
+## C. Orchestrator only
+
+> **STOPP — wer diesen Auftrag als eigene Spezifikation liest, ist mit diesem Abschnitt nicht
+> gemeint.** Er beschreibt dem Orchestrator, wie er dich aufruft, wie das Ergebnis geprüft und wie es
+> verbucht wird. **Du BIST dieser Aufruf — starte kein `codex exec`, spawne keine Reviewer, pflege
+> das Register nicht, committe nicht.** Deine Aufgabe endet beim Diff.
+
+### Execution directive
+
+`.claude/codex-status.md` im Workspace-Root vor dem Aufruf prüfen. Ohne Zeile für den
+Ausführungstag Codex verwenden — direkt per Bash, nie über die `debugger`/`*_coder`-Wrapper, mit
+BEIDEN Flags `--skip-git-repo-check` und `--dangerously-bypass-approvals-and-sandbox`. Der Rückfall
+auf direkte Umsetzung dreht die Autorschaft und macht den unabhängigen `reviewer` zwingend.
+
+### Review routing
+
+Tier 3 (shared-core): **`reviewer` und `sec_reviewer`**, gleichzeitig in einem Hintergrund-Batch vor
+dem Commit. `ui_reviewer` entfällt — es gibt keine Oberfläche. `sec_reviewer` prüft die Kernfrage:
+kann ein registriertes Muster die Weiterleitung dort unterdrücken, wo sie gebraucht wird, und ist die
+Auswertung auf `pathname` beschränkt.
+
+### Verification
+
+Kein Prototyp, kein Zwei-Breiten-Abgleich. Der Nachweis sind die Tests, insbesondere die
+Regressionsfälle für die String-Registrierung.
+
+Nach grünem Review: Version anheben und veröffentlichen. **Die WO ist erst abgeschlossen, wenn die
+Version veröffentlicht ist** — jg-ferien PUB-7 hängt daran und kann ohne sie nicht landen.
+
+### Register + commit
+
+Zeile `AUTH-5` erreicht `done` nur mit beiden Reviewern samt Verdikt in der `Notiz` und der
+veröffentlichten Version. Auf grün nach `main` committen und pushen.
+
+### Mini-handover
+
+Repo: `ui-core-micha` (`C:\Users\biglmi\Documents\webapps\ui-core-micha`), Branch `main`.
+WO: `work-orders/AUTH-5.md`. Konsument: `jg-ferien` PUB-7 Teil 2 (Pin heute `2.37.1`).
+`git pull`, WO lesen, dann `orchestrate-codex` folgen.

package/work-orders/DX-2.md

@@ -0,0 +1,188 @@
+# DX-2 — Declare `sideEffects` so consumers can tree-shake the kit
+
+**Target repo:** `ui-core-micha` (branch `main`)
+**Tier:** 3 — shared-core, and it changes what every consumer's bundler is permitted to discard.
+
+---
+
+## A. Envelope
+
+### Goal
+
+`package.json` declares **no `sideEffects` field**. Without it a bundler must assume every module in the
+package can have an import side effect and therefore cannot drop unused exports. **Twelve consumers ship the
+whole kit regardless of what they import.**
+
+This is not a theory. `hram/THEME-2` switched hram from three named translation bundles to the full
+`uiCoreTranslations` aggregate and measured the built-size delta at **−11 bytes** — not the increase everyone
+expected, because the three-bundle import was already pulling all seven.
+
+### Why this is worth a Tier-3 change
+
+Two decisions currently rest on a number that this defect makes meaningless:
+
+- **`I18N-1` measured `+28,943 B` raw / `+7,327 B` gzip** for an auth-only app switching to the aggregate.
+  That measured a real difference in *source* reachability which the build never realises. As a decision input
+  it is void.
+- **`I18N-2` is `blocked` on exactly this.** It was framed as a bundle-size optimisation via
+  self-registration, and its stated input is a size delta that cannot be measured until the package can
+  tree-shake at all. **This WO is its unblocker**, and it is a far smaller change than reworking how twelve
+  consumers resolve strings.
+
+### Scope
+
+1. **Prove it first, per module.** Walk every module reachable from the package root and establish that
+   importing it has **no** side effect: no top-level statement with an observable effect, no polyfill or
+   registry mutation, no `import './x.css'` or equivalent, no module-scope singleton creation whose existence
+   something depends on. **This is the work**; the field is one line.
+2. **`package.json`** — add `"sideEffects": false` if step 1 holds for everything. If it does **not** hold for
+   some module, add the array form listing exactly those files rather than the blanket `false`.
+3. **Re-measure the delta `I18N-1` got wrong**: the built size of an auth-only app importing only
+   `authTranslations` versus the full aggregate, against a package that can now tree-shake. Report the number.
+4. Update `I18N-2`'s register note with that number, so it is either authorable or droppable on evidence.
+
+### Non-goals / do not touch
+
+- **No `exports` map.** It would allow subpath imports and give a further size win, but it changes which
+  import paths resolve at all — a breaking-change risk for twelve consumers in the same commit. Separate
+  decision, and this WO's measurement is its input.
+- **No component, theme, chart or i18n change.** Nothing in `src/` is edited for its own sake; the only source
+  changes permitted are ones step 1 proves are needed to make a module genuinely side-effect-free, and each
+  must be reported rather than folded in silently.
+- **No consumer pin bumps.** Apps pick this up when they next bump.
+- **`I18N-2` itself.** This unblocks it; it does not implement it.
+
+### Risks
+
+- **The real failure mode is a false `sideEffects: false`.** If a module *does* have an import side effect and
+  the field says otherwise, a bundler silently drops it and the consuming app breaks at runtime in a way no
+  test here will catch. That is why step 1 is the scope and the field is an afterthought. **If any module is
+  uncertain, use the array form and list it** — a partial declaration that is true beats a blanket one that is
+  nearly true.
+- **`side effect` includes the theme.** `createAppTheme`, the token module and the registry are the places to
+  look hardest: a module that builds an object at import time is fine, but one that *registers* itself
+  somewhere is not.
+- **Every consumer's bundle changes shape**, even though no source behaviour changes. That is the intent, and
+  it is why this is Tier 3 rather than a chore.
+
+### Required tests to WRITE
+
+- **A test asserting the field matches reality** is not really possible in-repo — a bundler is what enforces
+  it. So instead: **one build-level check** that the package builds and its entry points still resolve after
+  the declaration, plus the measurement in scope item 3 recorded as a number in the register note.
+- If step 1 finds a module needing a source change to become side-effect-free, that change gets a test.
+- Otherwise **no new unit tests** — and saying so is the correct answer for a `package.json` field.
+
+Scoped run: the existing suite, to confirm nothing regressed. Not a full-estate exercise.
+
+### Parity guardrail
+
+No API, behaviour or visual change. Every currently-working import must keep working; what changes is only
+what a consumer's bundler may discard.
+
+---
+
+## B. Implementation map
+
+*Filled by the Orchestrator on `git pull` — see `AGENTS.md` → "Work Order".*
+
+**Repo root:** `ui-core-micha` (this is the package root — `package.json` lives here, `src/index.js` is
+the package entry per `"main"`/`"module"`). Build: `pnpm run build` (tsc, `tsconfig.build.json`,
+`rootDir: src` → `outDir: dist`). Tests: `pnpm test` (vitest run), config likely under `tests/` or
+`vite.config.mjs`.
+
+**Entry point to walk:** [`src/index.js`](../src/index.js) — every export re-exported from here is a
+module the audit must cover. Rough module groups, in the order they're exported: `theme/` (7 exports),
+`auth/` (AuthContext, UserMenu, apiClient, authApi, authService), `layout/` (PageLayout, SectionNav),
+`pages/` (7 page components), `components/` (12 components incl. charts subtree), `i18n/` (7 translation
+bundle modules, pure data objects), `notifications/` (7 exports incl. a `realtime` module — check for
+WebSocket/EventSource construction at module scope, not just component-body), `messaging/` (13 exports,
+same realtime-connection caution), `onboarding/` (8 exports).
+
+**Known non-trivial finding — do not silently "fix" this, report it:**
+[`src/theme/createAppTheme.js:1-3`](../src/theme/createAppTheme.js) has three top-level
+`import '@fontsource/dm-sans/400.css'` (+ `/500.css`, `/600.css`) — these ARE import-level side effects
+(CSS injected into the document on import, unconditionally, regardless of whether `createAppTheme` is
+even called). This module must be **excluded** from a blanket `sideEffects: false` — either list
+`src/theme/createAppTheme.js` explicitly in the array form, or (better, since it's a source-level fix
+consistent with the WO's "no false negatives" risk framing) move the three font-CSS imports into a
+separate module (e.g. `src/theme/fonts.css.js` or inline at the one leaf that needs them) so the rest of
+`theme/` stays tree-shakeable and only that one file is excluded. Whichever path is taken, it must be
+**reported explicitly** in the WO's audit output, not folded in silently (Envelope: "each must be
+reported rather than folded in silently").
+
+**Areas most likely to hide further side effects (audit these hardest, per the Envelope's own risk
+note):** `theme/` (registry singletons — `KIT_COMPONENT_SX_REGISTRY` is exported as a value; confirm it's
+a plain object literal built at import with no external registration call), `notifications/realtime.js`
+and `messaging/` (anything opening a socket/listener at module scope rather than inside a hook/effect),
+`auth/apiClient.js` (axios instance creation is fine — a side-effect-free object build — but check for
+any `axios.interceptors.*.use(...)` called at module scope outside a factory function, which would be a
+real side effect since it mutates a shared axios default instance).
+
+**Do-not-touch:** no `exports` map in `package.json` (Envelope non-goal). No component/theme/chart/i18n
+behaviour change — only source edits that make a module genuinely side-effect-free, each reported.
+
+**Progress contract:** emit `PLAN: …` first, then `PROGRESS: [n/total] <module-group>` before auditing
+each group above and `… done` after, and a final `RESULT: DONE` or `RESULT: BLOCKED <reason>`. No gap
+> ~2 min. Work from this package — open files only to verify specific claims, not a blind full-repo read.
+
+## Preamble
+
+The text above is the COMPLETE spec — the committed WO file's content, not a plan to refine; there is
+no separate plan file. Read the nearest `AGENTS.md`, the relevant `.codex/skills/<role>/SKILL.md`, and
+the app `MEMORY.md` ONLY for conventions. Stay in scope; do not touch auth/permissions/deps/schema/CI
+unless the spec says so; do not update `MEMORY.md`. **Do NOT edit `WORK_ORDERS.md`** — the register row
+and the review verdicts are the orchestrator's alone. Do NOT `git add`/`commit`/`push` — leave every
+change uncommitted in the working tree for the orchestrator's independent review. WRITE the tests the
+"Required tests to WRITE" section calls for AND **RUN the tests you just wrote** to confirm they execute
+and pass — that is the ONLY test run you do (NOT the app's affected/full suite, NOT any review). The
+orchestrator re-runs the authoritative set + does the independent review after you finish — those are
+the gate; your own run does not count as the gate.
+
+Narrate continuously: a `PLAN: <step1> | <step2> | …` line up front, then a single-line
+`PROGRESS: [<n>/<total>] <present-tense action>` before every relevant action (and `… done` on
+completion), spaced so no gap exceeds ~2 min, stdout unbuffered, plus exactly one final
+`RESULT: DONE|BLOCKED <reason>`.
+
+---
+
+## C. Orchestrator only
+
+> **STOP — if you are the implementer reading this work order as your own specification, this section is NOT
+> addressed to you. Skip it entirely.** It tells the Orchestrator how to invoke you. **You ARE that
+> invocation — do NOT shell out to `codex exec`, do NOT spawn reviewers, do NOT edit `WORK_ORDERS.md`, and do
+> NOT `git add`/`commit`/`push`.**
+
+### Execution directive
+
+Check `.claude/codex-status.md` first. **No line for the current date means use Codex.** A dated `unavailable`
+line for today means skip the attempt, implement directly in Claude and name the record — that flips
+authorship. Otherwise one probe, outcome written back either way.
+
+### Review routing
+
+Tier 3: **independent `reviewer`** — mandatory, and the substantive one here: ask it to **independently
+re-check the side-effect audit**, module by module, rather than accept the implementer's list. That audit is
+the entire safety argument. **No `ui_reviewer`** — nothing renders. No `sec_reviewer`.
+
+### Verification
+
+Nothing renders, so no gate. The verification is the audit plus the re-measured delta, both reported as
+findings rather than assertions.
+
+**A push to `main` here IS the npm publish** — `publish.yml` triggers on `push: branches: [main]` with `paths`
+covering `package.json` and `src/**`, and npm publishes cannot be undone. So decide the version deliberately
+before pushing: this is a **patch** by scope (no new capability, no API change), and it will go out the moment
+it lands.
+
+### Register + commit
+
+One row, `DX-2`. `done` only with the independent reviewer and verdict named, plus the measured delta.
+Update `I18N-2`'s note in the same commit — that cross-reference is half the point of this WO.
+
+### Mini-handover
+
+Repo: `ui-core-micha`, branch `main`. WO: `work-orders/DX-2.md`. The one-line field is trivial; **the
+per-module side-effect audit is the work**, and a wrong `false` breaks consumers silently at runtime. Use the
+array form if anything is uncertain. Re-measure the aggregate delta and write it into `I18N-2`. Tier 3,
+`reviewer` mandatory and asked to redo the audit. **Pushing to main publishes.** Follow `orchestrate-codex`.

package/work-orders/DX-3.md

@@ -0,0 +1,195 @@
+# DX-3 — `publish.yml` tests before it builds, so `2.41.2` cannot publish
+
+**Target repo:** `ui-core-micha` (branch `main`)
+**Tier:** 3 — CI is a Tier-3 surface regardless of diff size.
+
+Short-form WO: two steps swapped, then an operator-confirmed dispatch.
+
+---
+
+## A. Envelope
+
+### Goal
+
+`DX-2` landed on `main` (`31675d8`, `e75192f`) and **its publish failed**, so `@micha.bigler/ui-core-micha`
+is still at `2.41.1` on the registry while `package.json` says `2.41.2`. Nothing DX-2 produced can be
+consumed until this is fixed.
+
+Cause, from run
+[32029216699](https://github.com/bigler-webapps/ui-core-micha/actions/runs/32029216699) —
+`completed/failure`:
+
+```
+FAIL tests/packageTreeShaking.test.js > built package entries resolve and unused translation bundles tree-shake
+Error: ENOENT: no such file or directory, lstat '.../ui-core-micha/dist'
+Test Files  1 failed | 64 passed (65)
+      Tests  1 failed | 510 passed (511)
+```
+
+`publish.yml` runs **`Run tests` before `Build`**. `DX-2`'s new test copies the package's own `dist/` to
+assemble a fake installed consumer, and **`dist/` is gitignored** (`.gitignore:2`), so in a clean checkout
+it does not exist yet. The test is not flaky and it is not wrong — it inspects the built artifact, which is
+the whole point of it. **It simply cannot pass in the order the workflow runs.**
+
+It passed locally at 511/511 because a `dist/` from an earlier `pnpm run build` was lying around. That is
+the failure mode, not the test.
+
+### Scope
+
+1. **`.github/workflows/publish.yml`** — move the `Build` step **above** `Run tests`.
+   **Both steps carry `if: steps.version_check.outputs.should_publish == 'true'`; that condition must stay
+   on each.** Nothing else in the file changes.
+2. **Publish `2.41.2`** — see the dispatch note below, which is the part most likely to be missed.
+
+### The dispatch is required, and it is not automatic
+
+`publish.yml` triggers on `push` to `main` filtered to `package.json`, `pnpm-lock.yaml`, `src/**` and
+`tsconfig.build.json`. **`.github/workflows/**` is not in that list**, so landing this fix does **not**
+re-trigger the publish. `2.41.2` would sit unpublished until some unrelated `src/**` change happened to
+push it out.
+
+So: after the fix lands, **dispatch `publish.yml` on `main`**. `publish.yml` is **not** on the dispatch
+safe-allowlist (`weekly-routines`, `terraform-plan`), so per `AGENTS.md` name the exact workflow and inputs
+and **wait for an explicit operator go** before running it.
+
+`should_publish` compares `package.json` against the registry, so with `2.41.2` local and `2.41.1`
+published it will evaluate true and the dispatch will publish. No version bump is needed for this WO — and
+none should be added, because the artifact being published is DX-2's, not this WO's.
+
+### Non-goals / do not touch
+
+- **`tests/packageTreeShaking.test.js`.** It is correct. Do not make it build `dist/` itself, do not skip it
+  when `dist/` is absent, and above all do not delete it — a skip would silently retire the only check that
+  the `sideEffects` declaration actually tree-shakes, which is DX-2's entire deliverable.
+- **The `sideEffects` array, `src/theme/fonts.js`, or anything else DX-2 landed.** Reviewed and correct.
+- **The trigger `paths` list.** Adding `.github/workflows/**` would make every workflow edit attempt a
+  publish. That is a worse default than one dispatch.
+- **The version.** Stays `2.41.2`.
+- Any other workflow, any source file.
+
+### Recorded, deliberately out of scope
+
+**`publish.yml` is the only workflow in this repo that runs tests, and it runs them only when
+`should_publish == 'true'`.** So ucm's suite executes in CI *only on a version bump* — a `src/**` change
+that does not bump the version is never tested by CI at all. That is a real gap in a shared-core package
+consumed by twelve apps, and it is a separate decision (a `ci.yml` for this repo, or a `pull_request`
+trigger), not something to fold into a two-line reorder.
+
+### Risks
+
+- **Low, and the shape is known**: after the swap a build failure surfaces before test results instead of
+  after. That is an improvement, not a regression — you want to know the artifact is buildable before
+  spending 64 s on tests against it.
+- **The real risk is stopping at the commit.** A landed reorder with no dispatch leaves `2.41.2`
+  unpublished and looks done. The acceptance criterion below is the registry, not the workflow file.
+
+### Required tests to WRITE
+
+**None.** Nothing to unit-test in a step reorder, and manufacturing one would be noise. The verification is
+a green run plus the registry.
+
+### Acceptance
+
+1. A `publish.yml` run on `main` completes **green**, with `tests/packageTreeShaking.test.js` **passing**
+   rather than skipped — 511/511.
+2. **`npm view @micha.bigler/ui-core-micha version` returns `2.41.2`.** The registry is the acceptance,
+   not the commit and not the green tile.
+
+### Parity guardrail
+
+No source, API, behaviour or visual change. What changes is the order two CI steps run in.
+
+---
+
+## B. Implementation map
+
+*Filled by the Orchestrator on `git pull` — see `AGENTS.md` → "Work Order".*
+
+**Repo root:** `ui-core-micha` (workflow lives at repo root, `.github/workflows/publish.yml`).
+
+**Exact change:** in [`.github/workflows/publish.yml`](../.github/workflows/publish.yml), the step
+order today (verified on `git pull`, lines 112-118) is:
+
+```yaml
+      - name: Run tests
+        if: steps.version_check.outputs.should_publish == 'true'
+        run: pnpm run test
+
+      - name: Build
+        if: steps.version_check.outputs.should_publish == 'true'
+        run: pnpm run build
+```
+
+Swap so `Build` runs first, `Run tests` second — same two `if:` conditions, unchanged, one on each
+step. Nothing else in the file (`Check out code`, `Set up Node`, `Decide whether to publish`,
+`Set up pnpm`, `Show version from package.json`, `Install dependencies (pnpm)`,
+`Ensure recent npm for trusted publishing`, `Publish to npm`) moves or changes.
+
+**Do-not-touch (repeat of the Envelope's non-goals, stated here for the implementer):**
+`tests/packageTreeShaking.test.js`, the `sideEffects` array / `src/theme/fonts.js` (DX-2, already
+landed and reviewed), the `on: push: paths` trigger list, `package.json`'s version (stays `2.41.2`).
+This WO touches exactly one file.
+
+**Progress contract:** `PLAN: …` naming the single edit, `PROGRESS: [1/1] swap Build/Run-tests order
+in publish.yml … done`, then `RESULT: DONE`.
+
+## Preamble
+
+The text above is the COMPLETE spec — the committed WO file's content, not a plan to refine; there is
+no separate plan file. Read the nearest `AGENTS.md`, the relevant `.codex/skills/<role>/SKILL.md`, and
+the app `MEMORY.md` ONLY for conventions. Stay in scope; do not touch auth/permissions/deps/schema/CI
+beyond the one named swap. Do not update `MEMORY.md`. **Do NOT edit `WORK_ORDERS.md`** — the register
+row and the review verdicts are the orchestrator's alone. Do NOT `git add`/`commit`/`push`, and do NOT
+dispatch any workflow — leave every change uncommitted in the working tree for the orchestrator's
+independent review. This WO's "Required tests to WRITE" is explicitly **none** — do not write or run
+any test; there is nothing to verify locally that the orchestrator's own read of the diff and the
+reviewer's pass don't already cover.
+
+Narrate continuously: a `PLAN: <step1> | …` line up front, then a single-line
+`PROGRESS: [<n>/<total>] <present-tense action>` before every relevant action (and `… done` on
+completion), spaced so no gap exceeds ~2 min, stdout unbuffered, plus exactly one final
+`RESULT: DONE|BLOCKED <reason>`.
+
+---
+
+## C. Orchestrator only
+
+> **STOP — if you are the implementer reading this work order as your own specification, this section is NOT
+> addressed to you. Skip it entirely.** It tells the Orchestrator how to invoke you. **You ARE that
+> invocation — do NOT shell out to `codex exec`, do NOT spawn reviewers, do NOT edit `WORK_ORDERS.md`, do
+> NOT dispatch any workflow, and do NOT `git add`/`commit`/`push`.**
+
+### Execution directive
+
+Check `.claude/codex-status.md` first. **No line for the current date means use Codex.** A dated
+`unavailable` line for today means skip the attempt, implement directly in Claude and name the record —
+that flips authorship, which keeps the independent `reviewer` mandatory. Otherwise one probe, outcome
+written back either way.
+
+### Review routing
+
+Tier 3: **independent `reviewer`** — mandatory even for two lines, because CI is the surface. **No
+`ui_reviewer`** (nothing renders), no `sec_reviewer`. Ask the reviewer to confirm the `if:` conditions
+survived the move on **both** steps — dropping one would make a step run unconditionally, which is the only
+way a two-line reorder can go wrong.
+
+### Verification
+
+Acceptance criterion 2 is the verification: **read the registry.** A green tile is not a publish, and this
+session has now had the publish status misreported in both directions on the same package — once assumed
+published when it was not, once assumed unpublished when it was. `npm view`, every time.
+
+### Register + commit
+
+One row, `DX-3`. `done` only with the reviewer's verdict named **and** the registry showing `2.41.2`. Also
+update `DX-2`'s note: it currently reads as fully delivered, and it was not — its publish failed. Leaving
+that uncorrected is how the next person concludes `2.41.2` is available when it is not.
+
+### Mini-handover
+
+Repo: `ui-core-micha`, branch `main`. WO: `work-orders/DX-3.md`. Move `Build` above `Run tests` in
+`.github/workflows/publish.yml`, keeping the `if: should_publish` condition on both. Then **ask the operator
+to confirm a `publish.yml` dispatch on `main`** — the workflow's own path filter excludes
+`.github/workflows/**`, so landing the fix does not re-trigger it, and `2.41.2` stays unpublished until
+someone dispatches. Acceptance is `npm view` returning `2.41.2`, not a green tile. Tier 3, `reviewer`
+mandatory. Follow `orchestrate-codex`.