@micha.bigler/ui-core-micha 2.41.1 → 2.41.2

package/.github/workflows/publish.yml

@@ -109,14 +109,14 @@ jobs:
         if: steps.version_check.outputs.should_publish == 'true'
         run: pnpm install --frozen-lockfile
 
-      - name: Run tests
-        if: steps.version_check.outputs.should_publish == 'true'
-        run: pnpm run test
-
       - name: Build
         if: steps.version_check.outputs.should_publish == 'true'
         run: pnpm run build
 
+      - name: Run tests
+        if: steps.version_check.outputs.should_publish == 'true'
+        run: pnpm run test
+
       - name: Ensure recent npm for trusted publishing
         if: steps.version_check.outputs.should_publish == 'true'
         run: npm install -g npm@latest

package/WORK_ORDERS.md

@@ -27,7 +27,11 @@ prefixed ID; never reuse a bare flat number across workstreams.
 
 | ID | Titel | Beschreibung | Datum | Status | Commit(s) | Notiz |
 |---|---|---|---|---|---|---|
-| AUTH-5 | `addPublicPath` muss dynamische Routen ausdruecken koennen | `apiClient` leitet bei 401/403 hart auf `/login` um, ausser der Pfad steht auf einer Allowlist — der Mechanismus ist richtig gebaut, kann aber keine **dynamischen** Routen beschreiben: `matchesPublicPath` vergleicht mit `startsWith` (ausser `/`, das Gleichheit verlangt). Eine App mit oeffentlichen Seiten unter einem variablen Segment (`/<slug>`, `/<slug>/team`) kann ihre oeffentliche Flaeche damit nicht ausdruecken: ein konkreter Slug laesst sich eintragen, der naechste faellt wieder heraus. Folge: ein anonymer Besucher landet beim ersten 401 auf `/login` — auf einer Seite, die oeffentlich sein soll, von aussen nicht von "Seite existiert nicht" zu unterscheiden. `addPublicPath` nimmt daher zusaetzlich ein `RegExp` entgegen, geprueft ausschliesslich gegen `pathname`; die eingefrorene Builtin-Liste bleibt string-basiert und unberuehrt. | 2026-08-17 | planned | | Tier 3 (shared-core). Envelope: `work-orders/AUTH-5.md`. Kein Prototyp, keine Oberflaeche — `ui_reviewer` entfaellt, `reviewer` + `sec_reviewer` laufen. **Vorbedingung fuer `jg-ferien` PUB-7 Teil 2**, das ohne die veroeffentlichte Version nicht landen kann (jg pinnt heute `2.37.1`). Die WO ist erst `done`, wenn die Version veroeffentlicht ist. Kernrisiko: die Verantwortung wandert zum Konsumenten — ein unverankertes Muster wie `/team` trifft auch `/admin/team` und unterdrueckt die Weiterleitung dort, wo sie gebraucht wird; das gehoert in die Dokumentation am Aufruf, und die Gegenrichtung (nicht passender Pfad leitet weiterhin um) ist ein eigener Testfall. |
+| DX-3 | `publish.yml` tests before it builds, so `2.41.2` cannot publish | `DX-2` landed on `main` (`31675d8`, `e75192f`) and **its publish failed** — run [32029216699](https://github.com/bigler-webapps/ui-core-micha/actions/runs/32029216699), `completed/failure`. `publish.yml` runs `Run tests` **before** `Build`; `DX-2`'s new `tests/packageTreeShaking.test.js` copies the package's own `dist/` to assemble a fake installed consumer, and **`dist/` is gitignored** (`.gitignore:2`), so in a clean checkout it does not exist yet: `ENOENT ... lstat '.../dist'`, 510/511 passing with the one new test as the sole failure. The test is neither flaky nor wrong — it inspects the built artifact, which is the point; it cannot pass in the order the workflow runs. It was green locally at 511/511 only because a `dist/` from an earlier build was lying around. Full order [`work-orders/DX-3.md`](work-orders/DX-3.md) | 2026-08-17 | blocked | 67fe140 | Tier 3 — CI surface, independent `reviewer` mandatory for two lines; no `ui_reviewer`. Fix: move `Build` above `Run tests`, **keeping `if: steps.version_check.outputs.should_publish == 'true'` on both** — dropping one is the only way a reorder can go wrong, so the reviewer is asked to confirm it explicitly. Codex implemented (available today per `.claude/codex-status.md`, no prior fallback needed) — one-file, 4-line diff, nothing else touched. **Independent `reviewer` (Sonnet) confirmed: only file changed, both `if:` conditions retained on Build and Run-tests, order now install→Build→Run-tests→npm-bump→Publish, `tsc` (Build) emits `dist/` before `vitest run` (tests) needs it — no findings, safe to commit.** **Status `blocked`, not `done`: the code fix is committed but the dispatch that actually re-publishes `2.41.2` needs an explicit operator go** (`publish.yml` is not on the dispatch safe-allowlist, and its `paths` filter excludes `.github/workflows/**` so this commit alone does not re-trigger it). Move to `done` only once `npm view @micha.bigler/ui-core-micha version` returns `2.41.2` — acceptance is the registry, not the green tile. **The dispatch is the part most likely to be missed:** `publish.yml`'s trigger `paths` cover `package.json`/`pnpm-lock.yaml`/`src/**`/`tsconfig.build.json` but **not `.github/workflows/**`**, so landing this fix does NOT re-trigger the publish — `2.41.2` sits unpublished until `publish.yml` is dispatched on `main`, which needs explicit operator confirmation (not on the safe-allowlist). No version bump: the artifact being published is DX-2's. **Acceptance is `npm view` returning `2.41.2`, not a green tile** — the publish status of this package has now been misreported in both directions in one session. Do NOT skip, delete or self-build the tree-shaking test; a skip would silently retire the only check that `sideEffects` actually tree-shakes. **Recorded, out of scope:** `publish.yml` is the ONLY workflow here that runs tests, and only when `should_publish` is true — so ucm's suite runs in CI *only on a version bump*, and a `src/**` change without one is never tested. Real gap for a twelve-consumer shared core, separate decision. |
+| DX-2 | Declare `sideEffects` so consumers can tree-shake the kit | `package.json` has **no `sideEffects` field** and no `exports` map, so a bundler must assume every module can have an import side effect and cannot drop unused exports — twelve consumers ship the whole kit whatever they import. Measured, not theorised: `hram/THEME-2` switched from three named bundles to the full aggregate and the built size changed by **−11 bytes**. Full order [`work-orders/DX-2.md`](work-orders/DX-2.md) | 2026-08-12 | done | 31675d8 | Tier 3. Codex implemented (available today, no prior fallback needed). **Array form used, not blanket `false`** — the per-module audit found exactly one real import-time side effect group: font CSS. `src/theme/createAppTheme.js` and `src/theme/index.js` both used to `import '@fontsource/dm-sans/*.css'` at module scope; isolated into a new `src/theme/fonts.js`, declared in the `sideEffects` array (both `src/`/`dist/` forms) alongside `index.js`, `theme/index.js`, `theme/createAppTheme.js`, and `notifications/serviceWorker/sw.js` (a genuine `addEventListener` side effect, conservatively listed even though it isn't reachable from `src/index.js` — consumers import it directly). `uiCoreTranslations`'s aggregate-object construction relocated verbatim from `src/index.js` into `src/i18n/uiCoreTranslations.js` (no shape/value change) so the entry module carries no non-trivial logic beyond its own font import. New test `tests/packageTreeShaking.test.js` builds two throwaway consumer bundles against the real `dist/` output via Vite and asserts translations actually tree-shake. **Independent `reviewer` (Sonnet) redid the module-by-module audit from scratch** (walked theme/, auth/apiClient, notifications/realtime, messaging/, onboarding/, i18n/ for CSS imports, `document`/`window`/`self` mutation, axios interceptors, WebSocket construction, i18next `.use()/.init()`) and independently ran `pnpm run build` + the new test — **verdict: classification correct and complete, no missed side effect, safe to commit.** One non-blocking finding, addressed: **`src/index.js`'s font import is unconditional, so `@fontsource/dm-sans` CSS ships in every consumer's bundle regardless of import — it does NOT tree-shake**, and the reviewer flagged that the reported byte delta could be misread as covering the whole entry when it is translations-only. Added a one-line comment at `src/index.js:3` documenting the font/`sideEffects`-array coupling so a future edit can't decouple them silently (the exact false-negative hazard this WO exists to prevent). **Re-measured delta** (built `dist/`, minified, real bundler, supersedes both `I18N-1`'s `+28,943 B`/`+7,327 B` source-reachability figure and `THEME-2`'s `−11 bytes` no-tree-shaking baseline): auth-only **62,294 B raw / 17,653 B gzip** vs. aggregate **90,395 B raw / 25,045 B gzip** → **+28,101 B raw / +7,392 B gzip, translations only — font CSS is a separate, always-shipped, non-tree-shakeable cost not included in this number.** Written into `I18N-2`'s note below. Scoped tests: `pnpm run build` green, new test green, **full existing suite 511/511 green** (WO called for the existing suite as the scoped run, not full-estate). No rendered gate (nothing renders). Version bumped to `2.41.2` (patch by scope, per the WO). **Correction (2026-08-17): the publish failed** — `publish.yml` runs tests before build, and this WO's own new tree-shaking test needs `dist/` (gitignored), so it cannot pass on a clean checkout; registry stayed at `2.41.1`. Fix + re-publish tracked in `DX-3`. |
+| I18N-3 | Backfill Swahili in `messagingTranslations` and restore the four-locale shape test | `messagingTranslations.ts` carries **116 keys with `de`/`fr`/`en` and zero `sw`**, while all six other bundles carry all four locales. `I18N-1` hit this writing its aggregate test, confirmed the gap as pre-existing, and the operator scoped the assertion down to `{de,fr,en}` with the backfill recorded as a follow-up — **which was never written**. Full order [`work-orders/I18N-3.md`](work-orders/I18N-3.md) | 2026-08-12 | planned | | Tier 3 — re-tightens a deliberately loosened test, so every future bundle must then supply `sw` or fail CI. **No app is broken today**: `sw` is configured only in hram and hram does not register messaging — this closes an inconsistency and re-arms a test, which is why there is no urgency justifying unreviewed strings. **The real risk is translation quality**: 116 user-facing strings nobody on the team can check are worse than an honest gap, so the note must **state the translation source**, flag uncertain keys instead of guessing, and reuse `notifications`/`onboarding` terminology rather than coining new terms. `reviewer` mandatory but **cannot validate Swahili** — say so, or a clean verdict implies the translations were checked. Close `I18N-1`'s follow-up note in the same commit. Patch by scope. **A push to `main` publishes.** |
+| THEME-12 | `ScatterChart` ignores the kit's own margin opinion | `THEME-11` gave the kit an opinion about chart margins instead of inheriting MUI's flat 20 px. **`src/components/charts/ScatterChart.jsx` does not reference `withMarginDefaults`** — verified in the source — even though `THEME-10` shipped it in the same `2.41.0`. So every `ScatterChart` consumer re-inherits exactly what `THEME-11` removed. Found 2026-08-12 while surveying the strand; `hram/FIX-15` already bridged it app-side with a local `CHART_MARGIN`, which moves the workaround into the app instead of fixing the kit — the pattern worth not repeating. | 2026-08-12 | planned | | Tier 3 (shared-core, changes rendered output for every scatter consumer). **Not yet authored** — needs a decision first: wire `ScatterChart` to `withMarginDefaults` and let hram drop `CHART_MARGIN`, or decide scatter legitimately needs different margins and document why. The second is plausible — a scatter with a rotated axis title and auto-sized y-tick width is not a bar chart — so this is a question, not a defect to patch blind. `hram/FIX-15` named the gap in its own notes; this row exists so the kit side is tracked where it belongs rather than only in a consumer's WO. |
+| AUTH-5 | `addPublicPath` muss dynamische Routen ausdruecken koennen | `apiClient` leitet bei 401/403 hart auf `/login` um, ausser der Pfad steht auf einer Allowlist — der Mechanismus ist richtig gebaut, kann aber keine **dynamischen** Routen beschreiben: `matchesPublicPath` vergleicht mit `startsWith` (ausser `/`, das Gleichheit verlangt). Eine App mit oeffentlichen Seiten unter einem variablen Segment (`/<slug>`, `/<slug>/team`) kann ihre oeffentliche Flaeche damit nicht ausdruecken: ein konkreter Slug laesst sich eintragen, der naechste faellt wieder heraus. Folge: ein anonymer Besucher landet beim ersten 401 auf `/login` — auf einer Seite, die oeffentlich sein soll, von aussen nicht von "Seite existiert nicht" zu unterscheiden. `addPublicPath` nimmt daher zusaetzlich ein `RegExp` entgegen, geprueft ausschliesslich gegen `pathname`; die eingefrorene Builtin-Liste bleibt string-basiert und unberuehrt. | 2026-08-17 | done | ca09d6e, 2c4a5d3 | Tier 3 (shared-core). reviewer: keine P1/P2-Blocker (ein P2 zu g/y-Flag-Statefulness bei RegExp.test() behoben — lastIndex-Reset + Regressionstest ergaenzt). sec_reviewer: keine Blocker (zwei P3-Hinweise, kein Handlungsbedarf). Kein ui_reviewer noetig (keine Oberflaeche). Veroeffentlicht als 2.41.1 (patch, da Erweiterung einer bestehenden Funktion). jg-ferien PUB-7 kann den Pin jetzt von 2.37.1 auf 2.41.1 ziehen. |
 | PRIM-1 | Promote `StatTile` and `SoftChip` into the shared kit | Both already exist **twice**, independently built, and each second build is an **inline component inside a page** rather than a file — `StatTile` in `fitness-monitor/frontend/src/pages/BodyHistoryPage.jsx:554-568` beside hram's `ResearchComponents/StatTile.jsx`, `SoftChip` in `cockpit/frontend/src/cockpit/BoardView.jsx:65-73` (the lane pill) beside hram's `SoftChip.jsx`. The promotion trigger is met on evidence, not waived. The two builds diverged in seven places; all seven decided by the operator 2026-08-12 and rendered in the prototype. Full order [`work-orders/PRIM-1.md`](work-orders/PRIM-1.md) | 2026-08-12 | done | b5fff23 | Tier 3 (shared-core). `reviewer` + `ui_reviewer` mandatory and concurrent; no `sec_reviewer`. **Prototype in scope** — [`work-orders/assets/PRIM-1-dashboard-primitives.html`](work-orders/assets/PRIM-1-dashboard-primitives.html), so the rendered 375/1280 side-by-side is a commit gate; screenshots have not been legibly obtainable here, so a substitution must be **declared**, not silent. Decisions: value `h5` 18/600 · `tabular-nums` always · `flex: 1` with a `minWidth` floor · `accent` kept (fitness-monitor cannot adopt without it) · responsive padding · `status` uses **`overline`** (cockpit independently chose uppercase + .4px tracking, so this satisfies `THEME-4` with **no** baseline change and only hram's chips shift to uppercase) · dot-or-icon and optional border via props. **Token delta list has one entry:** `caveat`'s 12/500 has no baseline variant (`caption` is 12/400) — operator resolved it as keep-the-value, so it must be **exempted in `THEME-4` with that reason stated**, not flattened to 400 and not fixed by extending the baseline here. Neither `StatTile` build has a test; the promoted tests are written from scratch. Minor bump `2.38.0` → `2.39.0` (new capability area). **The three app adoptions are separate follow-up WOs** and land no app change here. Programme strand `DS-5`. **Codex skipped, dated evidence**: `.claude/codex-status.md` records `unavailable` for 2026-08-12 (`cockpit/UI-10`, out of workspace credits, the day's one allowed probe already spent) — Orchestrator implemented directly, flipping authorship. **Independent `reviewer` (Haiku, mandatory regardless of tier per the WO): no findings.** **`ui_reviewer` (Haiku, mandatory, concurrent): two P1 findings, both fixed** — (1) `StatTile`'s padding had only `px` responsive (`{xs:1, sm:1.5}`) with `py` fixed at 1, against the decided "responsive `{xs:1, sm:1.5}`" (matching fitness-monitor's original `p` shorthand, not hram's split values) — changed to a single `p: {xs:1, sm:1.5}`; (2) the `status` variant's typography was under-tested (only `textTransform` checked) — added explicit `fontSize`/`fontWeight`/`letterSpacing` assertions against `theme.typography.overline`, and separately against the `caveat` variant's raw 12/500, both now green. Re-verified 51/51 scoped tests green after fixes, `tsc -p tsconfig.build.json --noEmit` clean. **Rendered gate: declared substitution**, per the WO's own text — the 375/1280 side-by-side screenshot capture is not legibly obtainable in this repo; computed-style/DOM inspection substituted instead, via the test suite itself (fill/border/text colour per tone verified against `alpha`/`darken` of `theme.palette[tone]`; `borderRadius` 999px status vs non-pill caveat; `fontVariantNumeric: tabular-nums`; accent border width 1px vs 2px; `overline` typography values now explicit). No visual click-through was performed. Commit `b5fff23`. |
 | THEME-3 | Add the missing "subtle surface" baseline token | Adds `palette.background.subtle` (`#F4F5F6`, fixed baseline constant alongside `default`/`paper`) to `createAppTheme` and registers it in `THEME_COMPLETENESS_SURFACES`. Found by `cockpit/UI-6`: the `UI-4` design-language sheet's canonical token table names this as a baseline-supplied "inset surface" replacing `cockpit.surface2` (16 of 195 token reads in that WO), but the value was never actually wired into the shipped package — confirmed by grep, not assumed. `cockpit/UI-6` is blocked on this landing + publishing first, per this estate's own "gap in the shared kit is a ucm WO, not a local workaround" rule. Full spec: [work-orders/THEME-3.md](work-orders/THEME-3.md). `2.33.2` (patch). | 2026-08-11 | done | 1b25117 | Tier 3 — shared-core, this repo publishes to npm on every `main` push touching `src/**`, no staging net. Codex implemented in one pass (stdin invocation), exit 0, `RESULT: DONE`, 17/17 of its own new tests green. **Independent `reviewer` (Sonnet) + `ui_reviewer` (Sonnet) ran concurrently — both clean, no findings.** Both independently re-derived the safety mechanism rather than trusting the WO's claim: `MUI_DEFAULT_THEME = createTheme()` never defines `background.subtle` (vanilla MUI only has `.default`/`.paper`), so `assertThemeComplete`'s `sameValue` check can never flag the new surface for any real adopter — the same unexempted treatment `background.default` already gets; `background.paper`'s exemption (needed because MUI's own default theme is also white) was correctly not copied. Both read `fitness-monitor`'s actual `theme.js`/`theme.test.js` directly (the one real production adopter, hard-asserting `assertThemeComplete(theme).findings` equals `[]`) and confirmed this diff cannot break it. `ui_reviewer` additionally grepped every sibling app repo under `webapps/` for `createAppTheme` — no other live consumer exists; cockpit's own adoption (`UI-6`) isn't wired yet. `reviewer` independently recomputed the contrast ratio in a throwaway script and got the same `5.3748:1` the diff claims (not the design sheet's `4.81:1`, which was computed on the sheet's own static canvas — a source discrepancy, not a functional risk; both clear AA). **Orchestrator's own verification:** built the package (`npm run build`) and attempted to run `fitness-monitor`'s real assertions against the fresh `dist/` via raw Node ESM import — hit a pre-existing (confirmed via `git show`, not introduced here) `tsc`-emitted extensionless-import quirk that only affects raw `node`, not the Vite/Vitest resolution every real consumer (incl. fitness-monitor's own suite) uses; fell back to the scoped vitest run instead. Tests: 17/17 green (`tests/createAppTheme.test.js` + `tests/themeCompleteness.test.js`), run by the Orchestrator. No visual/prototype gate — token-only change with no rendered specimen in this repo (per the Envelope); the rendered check happens downstream in `cockpit/UI-6`. Semver: patch, applied by the Orchestrator per the WO's own reasoning (additive, resolves automatically, no adopter code change needed) — confirmed rather than assumed by both reviews. Unblocks `cockpit/UI-6`, which was waiting on this landing + publish. |
 | CHART-7 | `ChartFrame` gains a `titleVariant` prop | Adds `titleVariant` (default `'h6'`, unchanged from today's hardcoded value) to `ChartFrame`, forwarded to the title `Typography` — lets a dense panel grid (e.g. fitness-monitor's seven body-composition panels beside one hero chart) render smaller titles that recede instead of competing with the one chart that matters. One prop, not a `slotProps.title` system — deliberately minimal per the WO. Precondition of fitness-monitor's `FM-12` (DS-10). `2.32.0` (minor, additive). Full spec: [work-orders/CHART-7.md](work-orders/CHART-7.md). | 2026-08-10 | done | 14020d0 | Envelope authored by Expertenchat, no design question (short-form WO). No preconditions. Orchestrator filled a minimal Implementation map (the whole change is two lines in `ChartFrame.jsx`), ran Codex (stdin invocation). Codex added `titleVariant = 'h6'` to the prop destructure, forwarded it to the title `Typography`, wrote all 3 required tests, and bumped `2.31.1` → `2.32.0` per the WO's own stated version target. **Independent `reviewer` + `ui_reviewer` (both Haiku, proportionate to a small low-risk diff) ran concurrently — both found NO findings**, including explicit confirmation that only the prop-destructure line and the one `Typography` line changed (padding, foot row, subtitle/toolbar/slots byte-for-byte unchanged) and that the default-regression test is non-vacuous. Re-verified: 13/13 scoped vitest tests green, `tsc -p tsconfig.build.json --noEmit` clean. **Two-width rendered side-by-side (DS-1 gate)**: no existing harness specimen used `titleVariant`, so the Orchestrator added one (two `ChartFrame`s side by side, default vs. `titleVariant="subtitle2"`) to `dev/entries.jsx` — confirmed live at 375px and 1280px that the override renders visibly smaller/lighter than the unchanged h6 default. |
@@ -77,7 +81,7 @@ Two chunks. **Chunk 1** (Part 1 + Part 2 of the Envelope): extended `SPACING_SHO
 **Orchestrator's own verification:** scoped tests (`themeCompleteness`, `createAppTheme`, `MobileBottomNav`, `ChartFrame`) 65/65 green, `tsc -p tsconfig.build.json --noEmit` clean. Independent `reviewer` (Sonnet) + `ui_reviewer` (Sonnet) spawned concurrently against the real, complete two-chunk diff — **this was the only independent review that actually ran; no prior pass exists despite what the uncommitted Notiz briefly claimed.** Both reviewers: **no blocking code findings.** `reviewer`: two P3 notes, not fixed — the print-document masking regex only matches the first `printWindow.document.write(...)` call in a file (currently safe, only one exists; latent fragility if a second is ever added); `exportChartPng`'s new `backgroundColour` parameter has no default (low risk, not exported from `src/index.js`, single caller always supplies it — a footgun only if the function gains a second caller or goes public). `ui_reviewer`: confirmed all nine role-based mappings resolve against real `tokens.js` values and are visually reasonable; flagged the Google-icon border change (`rgba(0,0,0,0.2)` → `divider`, roughly halving visible contrast) as the single largest visual delta of the nine and worth a live look given the operator's explicit no-rendered-gate decision for this WO — not blocking, no rendered gate was added, consistent with that decision. Version `2.34.0` → `2.35.0` (minor, new exported API). No rendered/prototype gate, per the operator's explicit decision — this note is the substitute, all nine changed values listed from-and-to above. DS-18 follow-ups. |
 | SHELL-5 | Promote the secondary-navigation shell | Promotes jg-ferien's `SectionSwitcher` (grouped sidebar + bottom drawer) into the kit as the level *below* the bottom bar, adds the trigger bar that supplies the missing affordance, and makes ucm's own `AccountPage` its first consumer by replacing its horizontal `Tabs` strip. Look and feel follow jg by operator decision. Full spec: [work-orders/SHELL-5.md](work-orders/SHELL-5.md). | 2026-08-11 | done | b283c33 | DS-11. Supersedes `SHELL-2` (now `dropped`); prototype `assets/SHELL-2-account-navigation.html` kept as the composition spec. Each jg-specific concept was made optional and `AccountPage` proves it optional: no `overviewItem` (no "Übersicht" concept), no `rememberedKey`, `APP_HEADER_HEIGHT` → `headerOffset` (default `24`), `zIndex.drawer + 3` kept as default (`SHELL-3`'s bar sits at `+2`, ordering is meaningful), and the 280px two-column grid moved from the consumer into the component. The trigger bar is the one net-new piece (jg has none) — new full-width 56px bar, first thing rendered on mobile, opens a bottom drawer. `AccountPage`'s flat permission-computed `tabs` list bucketed into four fixed groups per the prototype ("Mein Konto"/"Verwaltung"/"Hilfe"/trailing "Weitere" catch-all for ungrouped `extraTabs`), new `Account.GROUP_*` i18n keys; `?tab=` contract and all permission-gating logic byte-for-byte unchanged. New component-owned chrome i18n (`src/i18n/sectionNavTranslations.ts`, all 4 locales) resolves the trap jg's `t("SectionSwitcher.TITLE")` had — no fallback, would have rendered a raw key. **Codex left the diff uncommitted and did not touch this file, as instructed** (the third consecutive WO where the explicit warning about the prior invalid-review pattern held). **Concurrent-session note:** an unrelated `I18N-1` session was uncommitted in the same working tree at the same time (`README.md`, `tests/i18nAggregate.test.js`, an aggregate-translations addition to `src/index.js`) — separated by hunk-level staging (`git add -p`) before this commit; only `SectionNav`'s two export lines in `src/index.js` are in this commit, I18N-1's own hunks were left for its own session to land. **Orchestrator's own verification:** scoped tests green (52/52 after fixes, see below), `tsc` clean. Independent `reviewer` + `ui_reviewer` (Sonnet, both mandatory — new logic and a prototype in scope) ran concurrently. **`reviewer` found two real P2s, both fixed:** the drawer's `zIndex` was set via BOTH an exported/registered `sx` object and a separate inline `style` prop on the same element — `style` always wins, so the registered `sx` value was dead code, tested but never actually reaching the DOM; removed the redundant `SECTION_NAV_DRAWER_SX` entirely (and its now-pointless `kitSxRegistry.js` entry), kept only the working `style`-based zIndex. The "optional controlled" `open`/`onClose` API (an Orchestrator design resolution for reconciling jg's controlled drawer with the new internally-triggered one) was incomplete — no `onOpen` callback existed, so a controlled consumer's trigger click was silently a no-op; added `onOpen`, fixed, added a regression test (`AccountPage` itself is unaffected, it uses uncontrolled mode). **`ui_reviewer` found one real P2, fixed:** the mobile trigger's current-section text used `fontWeight={700}`, matching neither the theme's `subtitle1` (600) nor the prototype's `.trigger-value` (16.5px/600) — an undeclared deviation that made it visually indistinguishable from the bold group headers; removed the override. One P3 left as documented, not fixed: `headerOffset` defaults to `24` vs. the prototype's `16` — a defensible generalisation (the component no longer assumes a fixed app-header height the way jg's original did; no consumer today is sensitive to the exact value). **Rendered verification:** the Browser pane could not composite frames in this session (same recurring environment limitation as `SHELL-3`/`SHELL-4`) — DOM/computed-style substitution via the test suite's own assertions (grid columns, drawer dimensions, z-index, theme-token resolution under two themes) plus static composition comparison against the prototype by both independent reviewers, one of which (`ui_reviewer`) is exactly the review type this repo relies on for design fidelity when a real render isn't obtainable. **Follow-ups named, unchanged:** jg migrates onto this and deletes its own drawer (operator requirement, separate WO); the users table is `AUTH-4`, deliberately not here. |
 | I18N-1 | One export, so a consumer cannot half-register the kit's strings | ucm exports its UI strings as **six separate bundles** that each app must spread into its own i18n resources by hand. Adopting a component without also adding its bundle renders **a raw key as visible UI text** — no type error, no runtime error. Ship a `uiCoreTranslations` aggregate so that cannot happen, and so a future ucm feature is carried automatically instead of requiring twelve apps to notice. Full order [work-orders/I18N-1.md](work-orders/I18N-1.md). | 2026-08-11 | done | a6d322d | Tier 3 (shared-core + new public export). **Shipped as `2.37.0`, not the planned `2.36.0`** — the concurrent `SHELL-5` release claimed `2.36.0` first; sequenced behind it (see below), no other change to scope. **Landed with seven bundles, not six** — `SHELL-5` (same day, same repo) added a seventh `sectionNavTranslations`, already picked up by the directory-enumerated ratchet before this WO's own commit, so the aggregate never had a six-bundle gap in practice. Codex implemented (`uiCoreTranslations` export + directory-ratcheted `tests/i18nAggregate.test.js` + README line); left the diff uncommitted as instructed. **Concurrent-session collision, real one:** `SHELL-5` was landing in the same working tree at the same time and touched `src/index.js` too; held this WO uncommitted until `SHELL-5`'s commit (`b283c33`) reached `main`, then re-diffed — clean, only this WO's seven-import/aggregate hunk remained. **Test #3 blocked Codex for a real reason, resolved by the operator, not routed around:** the required "every value keeps its `{de,fr,en,sw}` shape" test failed because `messagingTranslations`'s 116 keys have **no `sw` value at all**, a pre-existing gap, not something the merge caused — confirmed directly (`grep -c "'sw':" src/i18n/messagingTranslations.ts` → 0). Operator chose to scope the test down to `{de,fr,en}` for now with `sw` backfill tracked as a follow-up (comment in `tests/i18nAggregate.test.js` records this); key/value fidelity and the collision check are unaffected by the scope-down. **Bundle-size delta measured** (feeds `I18N-2`): +28,943 B raw / +7,327 B gzip for an auth-only app switching from `authTranslations` alone to the (then six-bundle) aggregate. **Independent `reviewer` + `ui_reviewer` (Sonnet, both mandatory, concurrent): no findings from either.** `reviewer` additionally confirmed the seven bundles are namespace-disjoint by prefix so spread order can't shadow a value, and that the ratchet's `fs.readdirSync` + `import.meta.glob` targets stay in sync (mismatch throws explicitly). Scoped tests green: 23/23 (`i18nAggregate`, `authTranslations`, `messagingExports`, `notificationsExports`). No rendered verification — the diff renders nothing. **`fitness-monitor/FM-14` is the still-open acceptance condition**, executed in another repo: fitness-monitor keeps rendering raw `ChartFrame.*` keys until it lands. **Two apps hit by the same mechanism, evidence not hypothesis:** (1) cockpit's `UI-3` adopted `UserMenu` without `userMenuTranslations` and shipped a header button reading the literal `UserMenu.TITLE` — **both independent static reviews were clean**, it was caught only by the rendered click-through, and only by DOM inspection at that since screenshots were unavailable; (2) **fitness-monitor is defective right now** — it imports `ChartFrame` (`BodyHistoryPage.jsx:7`, used `:295`/`:445`) but registers only `authTranslations`, so `ChartFrame.jsx:74`'s `t('ChartFrame.LOADING')` and its empty/error siblings render raw keys. It survived because those are transient edge states. **Estate survey, 2026-08-11:** twelve apps register ucm bundles — jg-ferien all six, cockpit four, hram three, **fitness-monitor one (defective)**, and eight auth-only apps that are correct solely because they have not adopted a second component yet. That is a coincidence with an expiry date, not a safety property. **The merge is safe:** 504 keys across the six bundles with **zero collisions**, verified by enumeration; every key is namespace-prefixed. **The part that makes the fix permanent is the ratchet test** — the aggregate must be asserted against the bundle list **read from `src/i18n/`**, not a hand-written list, so a future bundle that is not folded in fails. Without it the aggregate is correct today and rots exactly as the six exports did. Per-feature exports stay (removing them would break twelve apps for no gain); double-spreading during migration is harmless, which is why the zero-collision property is a test and not a comment. **Rollout is constrained by the one-repo rule** — a WO implements in one repository, so the twelve consumers cannot be migrated from here: `fitness-monitor/FM-14` is written, mandatory and blocked on this release, and **fitness-monitor renders raw keys until it lands** (the operator chose to route the fix through this rollout rather than patch it separately, so it could not be lost between two WOs; the delay is the cost and is recorded rather than left implicit). The other eleven are correct today — prevention, not repair — and ride along when each is next touched. Self-registration via `addResourceBundle` is **deliberately out of scope**: feasible (ucm components use `useTranslation()` against the consumer's own instance and ucm owns no instance), but all twelve consumers flatten into the default namespace with dotted keys, and registering at render time risks a first-paint flash of the raw key — replacing an invisible defect with a visible one. It is `I18N-2`, framed as a bundle-size optimisation rather than a correctness fix, because this WO already closes the hole. |
-| I18N-2 | Self-registering component strings, if the bundle cost justifies it | Have ucm components register their own strings on the consumer's i18n instance (`addResourceBundle` on the instance from `useTranslation()`) instead of relying on the consumer spreading a bundle. Would remove the last of the consumer's i18n obligations and stop auth-only apps shipping strings they never render. | 2026-08-11 | blocked | | **Deferred by operator decision 2026-08-12** (recorded as `blocked` because the register's status vocabulary has no `deferred`; the blocker is named below). **Its premise did not survive measurement.** `hram/THEME-2` switched from three named bundles to the full aggregate and the built size changed by **−11 bytes**, not the expected increase — because **this package declares no `sideEffects` field** (and no `exports` map), so a bundler must assume every module has side effects and cannot drop unused exports. An auth-only app therefore already ships all seven bundles whatever it imports. That makes this WO's stated input **unmeasurable until tree-shaking works at all**, and it relocates the actual bundle-size lever to a `package.json` change rather than a Tier-3 rework of how twelve consumers resolve strings. Do not author this until `sideEffects` is settled and the delta re-measured against a package that can actually tree-shake. Original framing, kept for the record: Tier 3 (shared-core, changes how every consumer resolves strings); **deliberately NOT a correctness WO** — `I18N-1`'s aggregate closes the defect class. Source-side the non-auth strings are ~30 KB (the five non-auth bundles are 188 keys against auth's 316), but a source figure is not the answer and a guess here would make this decision unfalsifiable. **Two known hazards, both to be resolved before authoring:** (1) all twelve consumers flatten everything into i18next's DEFAULT namespace with flat dotted keys, so the registration shape has to match exactly or key resolution changes under twelve apps at once; (2) registering during render risks a first-paint flash of the raw key — which would trade an invisible defect for a visible one, the opposite of the point. Feasibility is established: ucm components use `useTranslation()` against the consumer's instance and ucm owns no i18next instance of its own, so there is a real instance to register against. |
+| I18N-2 | Self-registering component strings, if the bundle cost justifies it | Have ucm components register their own strings on the consumer's i18n instance (`addResourceBundle` on the instance from `useTranslation()`) instead of relying on the consumer spreading a bundle. Would remove the last of the consumer's i18n obligations and stop auth-only apps shipping strings they never render. | 2026-08-11 | blocked | | **Deferred by operator decision 2026-08-12** (recorded as `blocked` because the register's status vocabulary has no `deferred`; the blocker is named below). **Its premise did not survive measurement.** `hram/THEME-2` switched from three named bundles to the full aggregate and the built size changed by **−11 bytes**, not the expected increase — because **this package declares no `sideEffects` field** (and no `exports` map), so a bundler must assume every module has side effects and cannot drop unused exports. An auth-only app therefore already ships all seven bundles whatever it imports. That makes this WO's stated input **unmeasurable until tree-shaking works at all**, and it relocates the actual bundle-size lever to a `package.json` change rather than a Tier-3 rework of how twelve consumers resolve strings. Do not author this until `sideEffects` is settled and the delta re-measured against a package that can actually tree-shake. Original framing, kept for the record: Tier 3 (shared-core, changes how every consumer resolves strings); **deliberately NOT a correctness WO** — `I18N-1`'s aggregate closes the defect class. Source-side the non-auth strings are ~30 KB (the five non-auth bundles are 188 keys against auth's 316), but a source figure is not the answer and a guess here would make this decision unfalsifiable. **Two known hazards, both to be resolved before authoring:** (1) all twelve consumers flatten everything into i18next's DEFAULT namespace with flat dotted keys, so the registration shape has to match exactly or key resolution changes under twelve apps at once; (2) registering during render risks a first-paint flash of the raw key — which would trade an invisible defect for a visible one, the opposite of the point. Feasibility is established: ucm components use `useTranslation()` against the consumer's instance and ucm owns no i18next instance of its own, so there is a real instance to register against. **`DX-2` (2026-08-17) re-measured the input this WO is blocked on**, against a package that can now actually tree-shake: auth-only **62,294 B raw / 17,653 B gzip** vs. aggregate **90,395 B raw / 25,045 B gzip** → **+28,101 B raw / +7,392 B gzip**, translations only. This is now real, tree-shaking-aware evidence rather than the pre-`DX-2` source-reachability figure — **but the number is unchanged in kind (still a ~7.4 KB gzip cost for a fully auth-only app), so it does not by itself flip the blocked decision.** Still unresolved before this WO can be authored: the two named hazards (flat-namespace registration shape matching exactly across twelve consumers; first-paint raw-key flash risk during render-time registration) — the size delta alone was never the only gate. |
 | AUTH-4 | The account user list on a phone | Gives `UserListComponent` a card layout below `md` — one card per user, email as the title, the two boolean columns as labelled chips, role select and delete in a divided footer, plus a sort control that replaces the column headers the table loses. Above `md` the table is byte-identical. Prototype: [assets/AUTH-4-user-list-card.html](work-orders/assets/AUTH-4-user-list-card.html). Full spec: [work-orders/AUTH-4.md](work-orders/AUTH-4.md). | 2026-08-11 | planned | | Split out of DS-11 by operator decision; fix class chosen by operator (card list, over sticky-first-column and priority-hide). Envelope only (Approval Gate #1 pending). **Authored and parked by operator decision 2026-08-11 — not queued.** It is built on demand, not as SHELL-5's successor; a fresh session should not dispatch it without the operator saying so. When it does run, it runs **after** `SHELL-5` (same screen, different half). The point of this row is that the measurements above are already done, so nobody re-measures. Prototype in scope, so the two-width rendered gate applies. **Measured 2026-08-11 in cockpit** at `innerWidth` 411 (the mobile preset gives 411, not 375): table **1053px inside a 325px container**, container `overflow-x: auto` and **the document does not overflow** — so it is not a broken layout but a desktop table on a phone, with Role and Actions, the two things the screen exists for, entirely outside the view. **The cheap fix was tested and rejected:** 253px of the width is `New` (90) + `Successful Login` (163), both default-on props that `AccountPage` already forwards and cockpit simply left on — but the four remaining columns are 800px against 325px, so configuration cannot fix it. Column defaults deliberately NOT flipped: that would be a silent estate-wide change. SHELL-2's 1045px from 2026-08-08 still holds (+8px), so THEME-4/5 did not move the density. **Four prototype decisions are load-bearing:** email as title with a muted placeholder when the name is absent (verified: a 47-char address wraps to two lines in a 357px card without overflow); the icon-only flags become labelled chips **because a Tooltip is unreachable on a touch pointer**, so that data is effectively absent today; role and delete in a footer behind a divider with the full 44px target; and a **sort control**, because a card list has no column headers — without it the mobile view silently loses a desktop capability. `extraColumns` render as label/value rows with **no new required field**; `extraRowActions` beyond three must collapse into an overflow menu. Reached via `AccountPage`, which **at least ten apps mount**, and ucm has no staging net. |
 | SHELL-6 | A controlled `SectionNav` with no way to open must not render a trigger | In `mode="mobile"` the built-in trigger renders unconditionally (`SectionNav.jsx:246`), while `handleTriggerClick` calls `onOpen?.()` — so a consumer driving `open` itself without `onOpen` gets a button that is visible, focusable and does nothing. Render the trigger only when a click can open the drawer: uncontrolled, or controlled **and** `onOpen` supplied. Plus the component's **render matrix** written into its doc comment. Full spec: [work-orders/SHELL-6.md](work-orders/SHELL-6.md). | 2026-08-11 | done | f119b70 | **Unblocks `jg-ferien/NAV-37`** (`blocked`, `c627d7b`), same shape as `SHELL-3`→`SHELL-4`. **Operator chose the semantics fix over a `showTrigger` prop** — a prop would leave the dead button as the default for every controlled consumer who has not heard of it, turning a defect into a configuration option; a focusable control that performs no action is wrong on its own terms. Fix: `const canOpenTrigger = !isControlled || Boolean(onOpen)`, wrapping only the `<ButtonBase>` trigger — `children` and `<Drawer>` keep rendering unconditionally in every case. Render-matrix doc comment added above the component per the WO's own framing ("not optional documentation; it is the artefact whose absence caused the defect"). `AccountPage`, the only shipped consumer, is uncontrolled and renders identically. Version `2.37.0` → `2.37.1` (patch, defect fix, no API change). **Codex left the diff uncommitted and did not touch this file, as instructed** — fourth consecutive WO where the explicit warning held. **Required test 1's non-vacuity confirmed**: Codex's own landing note states the new regression test was run against the pre-fix code and failed (dead trigger still in the DOM), then passed after the one-line fix — the Orchestrator did not re-verify this specific claim by checking out the prior commit, but both independent reviewers separately read the old-vs-new JSX and found the claim plausible/consistent. **Orchestrator's own verification:** scoped tests 47/47 green, `tsc` clean. Independent `reviewer` + `ui_reviewer` (Sonnet, both mandatory) ran concurrently — **both came back clean, no findings, no fix required.** `reviewer` confirmed the condition is keyed correctly (not on `open`'s value, avoiding the trap the WO's own test 3 exists to catch), `children`/`Drawer` stay unconditional, desktop path untouched, and the render-matrix comment matches the Envelope's table exactly. `ui_reviewer` confirmed the trigger's removal is genuine (conditional JSX unmount, not a CSS-hidden trick left in the accessibility tree/tab order) and no restyle occurred as a side effect; noted two non-blocking residual observations, not fixed: a hypothetical layout-shift if a consumer dynamically toggled `onOpen` on/off at runtime (no current or planned consumer does this), and `resolvedEyebrow`/`resolvedTitle` computed unconditionally even when unused (harmless). No rendered gate needed per the WO's own reasoning — the change is a DOM absence fact, not an appearance, and the test suite is the correct instrument. |
 | THEME-6 | An app-side check for `sx` values the theme already gives | `THEME-4` made shadowing mechanical for the kit's own components; apps have no equivalent — cockpit alone carries **464 `sx` props across 37 files** (measured 2026-08-11). Adds an exported, source-level, **report-only** check an app calls from its own suite, plus the cockpit count. Full spec: [work-orders/THEME-6.md](work-orders/THEME-6.md). | 2026-08-11 | done | 637d262 | DS-18's app-side half. **Codex → Claude fallback**: Codex ran out of workspace credits mid-task (first-hand failure this session, stamped today) — the Orchestrator implemented directly. Author-flip rule applied: independent `reviewer` (Sonnet, mandatory regardless of tier) ran against the Orchestrator's own diff; `ui_reviewer` correctly not spawned, per the WO's own text, since nothing renders. New export `reportRedundantThemeValues(sources, { theme })` in `src/theme/themeCompleteness.js`, reusing existing primitives (`getPath`, `sameValue`, `jsxOpeningTag`, `topLevelSxValue`, `BASELINE_STYLED_MUI_COMPONENTS`, `expandShorthandProperty`) rather than rebuilding them. Attribution by JSX tag name only (root-slot styleOverrides only), literal string/number sx values only — no template literals, identifiers, spreads, or `component={...}` resolution, the bound written open per the WO's instruction. **A real, verified discrepancy in the Envelope's own grounding, corrected here rather than silently chased:** the cited cockpit examples (`borderColor: 'divider'` ×2, `bgcolor: 'background.paper'` ×3, `borderRadius: 1` ×3) all live on `<Box component="button">` in `cockpit/frontend/src/cockpit/ChatView.jsx:75,82,95` — confirmed by direct inspection — which the check's own stated tag-name attribution method cannot catch (`Box` isn't a themed tag, and `component={...}` resolution is explicitly out of scope). The check was NOT widened to chase these numbers. **Run against cockpit's real source** (`cockpit/frontend/src`, 50 `.jsx` files, `theme.js` excluded from the sources passed per the WO's app-side-exclusion instruction — `reportOffPaletteColours`'s own skip pattern left untouched): **27 findings, all `MuiButton.textTransform`, across 4 files** (`BoardView.jsx`, `KnowledgeView.jsx`, `SettingsView.jsx`, one more) — cockpit's buttons redundantly set `sx={{ textTransform: 'none' }}`, matching the baseline's own `MuiButton.styleOverrides.root.textTransform`. This is the honest, real result, reported as a correction to the Envelope's stale grounding, not a match to it. Independent `reviewer` found one real **P2, fixed**: numeric sx values for `borderRadius` and spacing-shorthand aliases were compared raw against the theme's already-resolved CSS value, but MUI actually multiplies a bare number by `theme.shape.borderRadius`/`theme.spacing()` before rendering (e.g. `borderRadius: 8` in sx renders as `8 × shape.borderRadius`, not `8`) — comparing the two raw numbers could produce a **false positive**, exactly the failure mode the WO's own Risks section names as the one to avoid. Fixed by skipping numeric-value comparison entirely for `borderRadius` and every spacing alias (`MUI_NUMERIC_SCALE_PROPERTIES`), erring toward a false negative (the accepted lower bound) rather than a false positive; two regression tests added (the specific false-positive case, plus a corrected version of the "component the theme doesn't style" test, which had used an off-list tag rather than exercising the intended undefined-styleOverride branch — also a reviewer note, fixed). Re-verified: cockpit's 27/27 findings unchanged by the fix (all string-valued `textTransform`, not numeric). Scoped tests 37/37 green, `tsc` clean. Version `2.37.1` → `2.38.0` (minor, new exported API). No rendered gate — static/logic change, no fix shipped anywhere (report-only, per the WO's explicit non-goal). |

package/dist/i18n/uiCoreTranslations.js

@@ -0,0 +1,8 @@
+import { authTranslations } from './authTranslations';
+import { chartsTranslations } from './chartsTranslations';
+import { messagingTranslations } from './messagingTranslations';
+import { notificationsTranslations } from './notificationsTranslations';
+import { onboardingTranslations } from './onboardingTranslations';
+import { sectionNavTranslations } from './sectionNavTranslations';
+import { userMenuTranslations } from './userMenuTranslations';
+export const uiCoreTranslations = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, authTranslations), chartsTranslations), messagingTranslations), notificationsTranslations), onboardingTranslations), sectionNavTranslations), userMenuTranslations);

package/dist/index.js

@@ -1,11 +1,9 @@
 // index.js (Entry Point deiner Library)
-import { authTranslations } from './i18n/authTranslations';
-import { chartsTranslations } from './i18n/chartsTranslations';
-import { messagingTranslations } from './i18n/messagingTranslations';
-import { notificationsTranslations } from './i18n/notificationsTranslations';
-import { onboardingTranslations } from './i18n/onboardingTranslations';
-import { sectionNavTranslations } from './i18n/sectionNavTranslations';
-import { userMenuTranslations } from './i18n/userMenuTranslations';
+// Deliberately unconditional: font CSS ships in every consumer bundle regardless of what they
+// import (not tree-shaken). If this import is ever removed, drop this file from the
+// `sideEffects` array in package.json in the same change — decoupling them silently reintroduces
+// the false-sideEffects-false hazard DX-2 exists to avoid.
+import './theme/fonts';
 // --- 0. Theme ---
 export { createAppTheme, assertThemeComplete, assertKitSxDisjoint, calculateContrastRatio, KIT_COMPONENT_SX_REGISTRY, reportOffPaletteColours, reportKitSxBypasses, reportRedundantThemeValues, reportThemeAdoption, THEME_COMPLETENESS_SURFACES, } from './theme';
 // --- 1. Auth Context (Essentiell für den Wrapper) ---
@@ -91,4 +89,4 @@ export { notificationsTranslations } from './i18n/notificationsTranslations';
 export { onboardingTranslations } from './i18n/onboardingTranslations';
 export { chartsTranslations } from './i18n/chartsTranslations';
 export { messagingTranslations } from './i18n/messagingTranslations';
-export const uiCoreTranslations = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, authTranslations), chartsTranslations), messagingTranslations), notificationsTranslations), onboardingTranslations), sectionNavTranslations), userMenuTranslations);
+export { uiCoreTranslations } from './i18n/uiCoreTranslations';

package/dist/theme/createAppTheme.js

@@ -1,6 +1,4 @@
-import '@fontsource/dm-sans/400.css';
-import '@fontsource/dm-sans/500.css';
-import '@fontsource/dm-sans/600.css';
+import './fonts';
 import { createTheme, darken, getContrastRatio } from '@mui/material/styles';
 import { BASELINE_INTENTIONAL_DEFAULT_EXEMPTIONS, BASELINE_PALETTE, BASELINE_STATIC, MOTION, } from './tokens';
 function findFunction(value, path) {

package/dist/theme/fonts.js

@@ -0,0 +1,3 @@
+import '@fontsource/dm-sans/400.css';
+import '@fontsource/dm-sans/500.css';
+import '@fontsource/dm-sans/600.css';

package/dist/theme/index.js

@@ -1,3 +1,4 @@
+import './fonts';
 export { createAppTheme } from './createAppTheme';
 export { assertThemeComplete, assertKitSxDisjoint, calculateContrastRatio, reportOffPaletteColours, reportKitSxBypasses, reportRedundantThemeValues, reportThemeAdoption, THEME_COMPLETENESS_SURFACES, } from './themeCompleteness';
 export { KIT_COMPONENT_SX_REGISTRY } from './kitSxRegistry';

package/package.json

@@ -1,8 +1,20 @@
 {
   "name": "@micha.bigler/ui-core-micha",
-  "version": "2.41.1",
+  "version": "2.41.2",
   "main": "dist/index.js",
   "module": "dist/index.js",
+  "sideEffects": [
+    "./src/index.js",
+    "./dist/index.js",
+    "./src/theme/index.js",
+    "./dist/theme/index.js",
+    "./src/theme/createAppTheme.js",
+    "./dist/theme/createAppTheme.js",
+    "./src/theme/fonts.js",
+    "./dist/theme/fonts.js",
+    "./src/notifications/serviceWorker/sw.js",
+    "./dist/notifications/serviceWorker/sw.js"
+  ],
   "repository": {
     "type": "git",
     "url": "https://github.com/bigler-webapps/ui-core-micha"

package/src/i18n/uiCoreTranslations.js

@@ -0,0 +1,17 @@
+import { authTranslations } from './authTranslations';
+import { chartsTranslations } from './chartsTranslations';
+import { messagingTranslations } from './messagingTranslations';
+import { notificationsTranslations } from './notificationsTranslations';
+import { onboardingTranslations } from './onboardingTranslations';
+import { sectionNavTranslations } from './sectionNavTranslations';
+import { userMenuTranslations } from './userMenuTranslations';
+
+export const uiCoreTranslations = {
+  ...authTranslations,
+  ...chartsTranslations,
+  ...messagingTranslations,
+  ...notificationsTranslations,
+  ...onboardingTranslations,
+  ...sectionNavTranslations,
+  ...userMenuTranslations,
+};

package/src/index.js

@@ -1,12 +1,10 @@
 // index.js (Entry Point deiner Library)
 
-import { authTranslations } from './i18n/authTranslations';
-import { chartsTranslations } from './i18n/chartsTranslations';
-import { messagingTranslations } from './i18n/messagingTranslations';
-import { notificationsTranslations } from './i18n/notificationsTranslations';
-import { onboardingTranslations } from './i18n/onboardingTranslations';
-import { sectionNavTranslations } from './i18n/sectionNavTranslations';
-import { userMenuTranslations } from './i18n/userMenuTranslations';
+// Deliberately unconditional: font CSS ships in every consumer bundle regardless of what they
+// import (not tree-shaken). If this import is ever removed, drop this file from the
+// `sideEffects` array in package.json in the same change — decoupling them silently reintroduces
+// the false-sideEffects-false hazard DX-2 exists to avoid.
+import './theme/fonts';
 
 // --- 0. Theme ---
 export {
@@ -142,13 +140,4 @@ export { notificationsTranslations } from './i18n/notificationsTranslations';
 export { onboardingTranslations } from './i18n/onboardingTranslations';
 export { chartsTranslations } from './i18n/chartsTranslations';
 export { messagingTranslations } from './i18n/messagingTranslations';
-
-export const uiCoreTranslations = {
-  ...authTranslations,
-  ...chartsTranslations,
-  ...messagingTranslations,
-  ...notificationsTranslations,
-  ...onboardingTranslations,
-  ...sectionNavTranslations,
-  ...userMenuTranslations,
-};
+export { uiCoreTranslations } from './i18n/uiCoreTranslations';

package/src/theme/createAppTheme.js

@@ -1,6 +1,4 @@
-import '@fontsource/dm-sans/400.css';
-import '@fontsource/dm-sans/500.css';
-import '@fontsource/dm-sans/600.css';
+import './fonts';
 
 import { createTheme, darken, getContrastRatio } from '@mui/material/styles';
 

package/src/theme/fonts.js

@@ -0,0 +1,3 @@
+import '@fontsource/dm-sans/400.css';
+import '@fontsource/dm-sans/500.css';
+import '@fontsource/dm-sans/600.css';

package/src/theme/index.js

@@ -1,3 +1,5 @@
+import './fonts';
+
 export { createAppTheme } from './createAppTheme';
 export {
   assertThemeComplete,

package/tests/packageTreeShaking.test.js

@@ -0,0 +1,126 @@
+import { cp, mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { gzipSync } from 'node:zlib';
+
+import { build } from 'vite';
+import { afterAll, expect, test } from 'vitest';
+
+const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const packageManifest = JSON.parse(
+  await readFile(path.join(packageRoot, 'package.json'), 'utf8'),
+);
+const packageName = packageManifest.name;
+let temporaryRoot;
+
+async function bundlePackageExport({ caseName, exportName, manifestField }) {
+  temporaryRoot ||= await mkdtemp(path.join(tmpdir(), 'ui-core-tree-shaking-'));
+  const consumerRoot = path.join(temporaryRoot, caseName);
+  const installedPackageRoot = path.join(
+    consumerRoot,
+    'node_modules',
+    ...packageName.split('/'),
+  );
+
+  await mkdir(installedPackageRoot, { recursive: true });
+  await cp(
+    path.join(packageRoot, 'dist'),
+    path.join(installedPackageRoot, 'dist'),
+    { recursive: true },
+  );
+  const installedFontRoot = path.join(
+    consumerRoot,
+    'node_modules',
+    '@fontsource',
+    'dm-sans',
+  );
+  await mkdir(path.dirname(installedFontRoot), { recursive: true });
+  await cp(
+    path.join(packageRoot, 'node_modules', '@fontsource', 'dm-sans'),
+    installedFontRoot,
+    { recursive: true },
+  );
+  await writeFile(
+    path.join(installedPackageRoot, 'package.json'),
+    JSON.stringify({
+      name: packageName,
+      version: packageManifest.version,
+      [manifestField]: packageManifest[manifestField],
+      sideEffects: packageManifest.sideEffects,
+    }),
+  );
+
+  const entryPath = path.join(consumerRoot, 'entry.js');
+  await writeFile(entryPath, `export { ${exportName} } from '${packageName}';\n`);
+
+  const result = await build({
+    configFile: false,
+    logLevel: 'silent',
+    root: consumerRoot,
+    build: {
+      minify: true,
+      rollupOptions: {
+        input: entryPath,
+        preserveEntrySignatures: 'strict',
+        external: (id) => (
+          id !== packageName
+          && !id.startsWith('@fontsource/dm-sans')
+          && !id.startsWith('.')
+          && !path.isAbsolute(id)
+        ),
+        output: {
+          format: 'es',
+        },
+      },
+      write: false,
+    },
+  });
+  const outputs = Array.isArray(result)
+    ? result.flatMap((buildResult) => buildResult.output)
+    : result.output;
+  const entryChunk = outputs.find((output) => output.type === 'chunk' && output.isEntry);
+
+  expect(entryChunk, `${manifestField} entry should produce a bundle`).toBeDefined();
+  return {
+    code: entryChunk.code,
+    css: outputs
+      .filter((output) => output.type === 'asset' && output.fileName.endsWith('.css'))
+      .map((output) => output.source.toString())
+      .join('\n'),
+    rawBytes: Buffer.byteLength(entryChunk.code),
+    gzipBytes: gzipSync(entryChunk.code).byteLength,
+  };
+}
+
+afterAll(async () => {
+  if (temporaryRoot) await rm(temporaryRoot, { recursive: true, force: true });
+});
+
+test('built package entries resolve and unused translation bundles tree-shake', async () => {
+  const authOnly = await bundlePackageExport({
+    caseName: 'auth-main',
+    exportName: 'authTranslations',
+    manifestField: 'main',
+  });
+  const aggregate = await bundlePackageExport({
+    caseName: 'aggregate-module',
+    exportName: 'uiCoreTranslations',
+    manifestField: 'module',
+  });
+
+  expect(authOnly.code).toContain('Auth.LOGIN');
+  expect(authOnly.code).not.toContain('ChartFrame.LOADING');
+  expect(authOnly.css).toContain('DM Sans');
+  expect(aggregate.code).toContain('ChartFrame.LOADING');
+  expect(aggregate.rawBytes).toBeGreaterThan(authOnly.rawBytes);
+  expect(aggregate.gzipBytes).toBeGreaterThan(authOnly.gzipBytes);
+
+  const rawDelta = aggregate.rawBytes - authOnly.rawBytes;
+  const gzipDelta = aggregate.gzipBytes - authOnly.gzipBytes;
+  console.info(
+    `tree-shaking measurement: auth=${authOnly.rawBytes} B raw/${authOnly.gzipBytes} B gzip; `
+      + `aggregate=${aggregate.rawBytes} B raw/${aggregate.gzipBytes} B gzip; `
+      + `delta=+${rawDelta} B raw/+${gzipDelta} B gzip`,
+  );
+}, 15_000);

package/work-orders/DX-2.md

@@ -0,0 +1,188 @@
+# DX-2 — Declare `sideEffects` so consumers can tree-shake the kit
+
+**Target repo:** `ui-core-micha` (branch `main`)
+**Tier:** 3 — shared-core, and it changes what every consumer's bundler is permitted to discard.
+
+---
+
+## A. Envelope
+
+### Goal
+
+`package.json` declares **no `sideEffects` field**. Without it a bundler must assume every module in the
+package can have an import side effect and therefore cannot drop unused exports. **Twelve consumers ship the
+whole kit regardless of what they import.**
+
+This is not a theory. `hram/THEME-2` switched hram from three named translation bundles to the full
+`uiCoreTranslations` aggregate and measured the built-size delta at **−11 bytes** — not the increase everyone
+expected, because the three-bundle import was already pulling all seven.
+
+### Why this is worth a Tier-3 change
+
+Two decisions currently rest on a number that this defect makes meaningless:
+
+- **`I18N-1` measured `+28,943 B` raw / `+7,327 B` gzip** for an auth-only app switching to the aggregate.
+  That measured a real difference in *source* reachability which the build never realises. As a decision input
+  it is void.
+- **`I18N-2` is `blocked` on exactly this.** It was framed as a bundle-size optimisation via
+  self-registration, and its stated input is a size delta that cannot be measured until the package can
+  tree-shake at all. **This WO is its unblocker**, and it is a far smaller change than reworking how twelve
+  consumers resolve strings.
+
+### Scope
+
+1. **Prove it first, per module.** Walk every module reachable from the package root and establish that
+   importing it has **no** side effect: no top-level statement with an observable effect, no polyfill or
+   registry mutation, no `import './x.css'` or equivalent, no module-scope singleton creation whose existence
+   something depends on. **This is the work**; the field is one line.
+2. **`package.json`** — add `"sideEffects": false` if step 1 holds for everything. If it does **not** hold for
+   some module, add the array form listing exactly those files rather than the blanket `false`.
+3. **Re-measure the delta `I18N-1` got wrong**: the built size of an auth-only app importing only
+   `authTranslations` versus the full aggregate, against a package that can now tree-shake. Report the number.
+4. Update `I18N-2`'s register note with that number, so it is either authorable or droppable on evidence.
+
+### Non-goals / do not touch
+
+- **No `exports` map.** It would allow subpath imports and give a further size win, but it changes which
+  import paths resolve at all — a breaking-change risk for twelve consumers in the same commit. Separate
+  decision, and this WO's measurement is its input.
+- **No component, theme, chart or i18n change.** Nothing in `src/` is edited for its own sake; the only source
+  changes permitted are ones step 1 proves are needed to make a module genuinely side-effect-free, and each
+  must be reported rather than folded in silently.
+- **No consumer pin bumps.** Apps pick this up when they next bump.
+- **`I18N-2` itself.** This unblocks it; it does not implement it.
+
+### Risks
+
+- **The real failure mode is a false `sideEffects: false`.** If a module *does* have an import side effect and
+  the field says otherwise, a bundler silently drops it and the consuming app breaks at runtime in a way no
+  test here will catch. That is why step 1 is the scope and the field is an afterthought. **If any module is
+  uncertain, use the array form and list it** — a partial declaration that is true beats a blanket one that is
+  nearly true.
+- **`side effect` includes the theme.** `createAppTheme`, the token module and the registry are the places to
+  look hardest: a module that builds an object at import time is fine, but one that *registers* itself
+  somewhere is not.
+- **Every consumer's bundle changes shape**, even though no source behaviour changes. That is the intent, and
+  it is why this is Tier 3 rather than a chore.
+
+### Required tests to WRITE
+
+- **A test asserting the field matches reality** is not really possible in-repo — a bundler is what enforces
+  it. So instead: **one build-level check** that the package builds and its entry points still resolve after
+  the declaration, plus the measurement in scope item 3 recorded as a number in the register note.
+- If step 1 finds a module needing a source change to become side-effect-free, that change gets a test.
+- Otherwise **no new unit tests** — and saying so is the correct answer for a `package.json` field.
+
+Scoped run: the existing suite, to confirm nothing regressed. Not a full-estate exercise.
+
+### Parity guardrail
+
+No API, behaviour or visual change. Every currently-working import must keep working; what changes is only
+what a consumer's bundler may discard.
+
+---
+
+## B. Implementation map
+
+*Filled by the Orchestrator on `git pull` — see `AGENTS.md` → "Work Order".*
+
+**Repo root:** `ui-core-micha` (this is the package root — `package.json` lives here, `src/index.js` is
+the package entry per `"main"`/`"module"`). Build: `pnpm run build` (tsc, `tsconfig.build.json`,
+`rootDir: src` → `outDir: dist`). Tests: `pnpm test` (vitest run), config likely under `tests/` or
+`vite.config.mjs`.
+
+**Entry point to walk:** [`src/index.js`](../src/index.js) — every export re-exported from here is a
+module the audit must cover. Rough module groups, in the order they're exported: `theme/` (7 exports),
+`auth/` (AuthContext, UserMenu, apiClient, authApi, authService), `layout/` (PageLayout, SectionNav),
+`pages/` (7 page components), `components/` (12 components incl. charts subtree), `i18n/` (7 translation
+bundle modules, pure data objects), `notifications/` (7 exports incl. a `realtime` module — check for
+WebSocket/EventSource construction at module scope, not just component-body), `messaging/` (13 exports,
+same realtime-connection caution), `onboarding/` (8 exports).
+
+**Known non-trivial finding — do not silently "fix" this, report it:**
+[`src/theme/createAppTheme.js:1-3`](../src/theme/createAppTheme.js) has three top-level
+`import '@fontsource/dm-sans/400.css'` (+ `/500.css`, `/600.css`) — these ARE import-level side effects
+(CSS injected into the document on import, unconditionally, regardless of whether `createAppTheme` is
+even called). This module must be **excluded** from a blanket `sideEffects: false` — either list
+`src/theme/createAppTheme.js` explicitly in the array form, or (better, since it's a source-level fix
+consistent with the WO's "no false negatives" risk framing) move the three font-CSS imports into a
+separate module (e.g. `src/theme/fonts.css.js` or inline at the one leaf that needs them) so the rest of
+`theme/` stays tree-shakeable and only that one file is excluded. Whichever path is taken, it must be
+**reported explicitly** in the WO's audit output, not folded in silently (Envelope: "each must be
+reported rather than folded in silently").
+
+**Areas most likely to hide further side effects (audit these hardest, per the Envelope's own risk
+note):** `theme/` (registry singletons — `KIT_COMPONENT_SX_REGISTRY` is exported as a value; confirm it's
+a plain object literal built at import with no external registration call), `notifications/realtime.js`
+and `messaging/` (anything opening a socket/listener at module scope rather than inside a hook/effect),
+`auth/apiClient.js` (axios instance creation is fine — a side-effect-free object build — but check for
+any `axios.interceptors.*.use(...)` called at module scope outside a factory function, which would be a
+real side effect since it mutates a shared axios default instance).
+
+**Do-not-touch:** no `exports` map in `package.json` (Envelope non-goal). No component/theme/chart/i18n
+behaviour change — only source edits that make a module genuinely side-effect-free, each reported.
+
+**Progress contract:** emit `PLAN: …` first, then `PROGRESS: [n/total] <module-group>` before auditing
+each group above and `… done` after, and a final `RESULT: DONE` or `RESULT: BLOCKED <reason>`. No gap
+> ~2 min. Work from this package — open files only to verify specific claims, not a blind full-repo read.
+
+## Preamble
+
+The text above is the COMPLETE spec — the committed WO file's content, not a plan to refine; there is
+no separate plan file. Read the nearest `AGENTS.md`, the relevant `.codex/skills/<role>/SKILL.md`, and
+the app `MEMORY.md` ONLY for conventions. Stay in scope; do not touch auth/permissions/deps/schema/CI
+unless the spec says so; do not update `MEMORY.md`. **Do NOT edit `WORK_ORDERS.md`** — the register row
+and the review verdicts are the orchestrator's alone. Do NOT `git add`/`commit`/`push` — leave every
+change uncommitted in the working tree for the orchestrator's independent review. WRITE the tests the
+"Required tests to WRITE" section calls for AND **RUN the tests you just wrote** to confirm they execute
+and pass — that is the ONLY test run you do (NOT the app's affected/full suite, NOT any review). The
+orchestrator re-runs the authoritative set + does the independent review after you finish — those are
+the gate; your own run does not count as the gate.
+
+Narrate continuously: a `PLAN: <step1> | <step2> | …` line up front, then a single-line
+`PROGRESS: [<n>/<total>] <present-tense action>` before every relevant action (and `… done` on
+completion), spaced so no gap exceeds ~2 min, stdout unbuffered, plus exactly one final
+`RESULT: DONE|BLOCKED <reason>`.
+
+---
+
+## C. Orchestrator only
+
+> **STOP — if you are the implementer reading this work order as your own specification, this section is NOT
+> addressed to you. Skip it entirely.** It tells the Orchestrator how to invoke you. **You ARE that
+> invocation — do NOT shell out to `codex exec`, do NOT spawn reviewers, do NOT edit `WORK_ORDERS.md`, and do
+> NOT `git add`/`commit`/`push`.**
+
+### Execution directive
+
+Check `.claude/codex-status.md` first. **No line for the current date means use Codex.** A dated `unavailable`
+line for today means skip the attempt, implement directly in Claude and name the record — that flips
+authorship. Otherwise one probe, outcome written back either way.
+
+### Review routing
+
+Tier 3: **independent `reviewer`** — mandatory, and the substantive one here: ask it to **independently
+re-check the side-effect audit**, module by module, rather than accept the implementer's list. That audit is
+the entire safety argument. **No `ui_reviewer`** — nothing renders. No `sec_reviewer`.
+
+### Verification
+
+Nothing renders, so no gate. The verification is the audit plus the re-measured delta, both reported as
+findings rather than assertions.
+
+**A push to `main` here IS the npm publish** — `publish.yml` triggers on `push: branches: [main]` with `paths`
+covering `package.json` and `src/**`, and npm publishes cannot be undone. So decide the version deliberately
+before pushing: this is a **patch** by scope (no new capability, no API change), and it will go out the moment
+it lands.
+
+### Register + commit
+
+One row, `DX-2`. `done` only with the independent reviewer and verdict named, plus the measured delta.
+Update `I18N-2`'s note in the same commit — that cross-reference is half the point of this WO.
+
+### Mini-handover
+
+Repo: `ui-core-micha`, branch `main`. WO: `work-orders/DX-2.md`. The one-line field is trivial; **the
+per-module side-effect audit is the work**, and a wrong `false` breaks consumers silently at runtime. Use the
+array form if anything is uncertain. Re-measure the aggregate delta and write it into `I18N-2`. Tier 3,
+`reviewer` mandatory and asked to redo the audit. **Pushing to main publishes.** Follow `orchestrate-codex`.

package/work-orders/DX-3.md

@@ -0,0 +1,195 @@
+# DX-3 — `publish.yml` tests before it builds, so `2.41.2` cannot publish
+
+**Target repo:** `ui-core-micha` (branch `main`)
+**Tier:** 3 — CI is a Tier-3 surface regardless of diff size.
+
+Short-form WO: two steps swapped, then an operator-confirmed dispatch.
+
+---
+
+## A. Envelope
+
+### Goal
+
+`DX-2` landed on `main` (`31675d8`, `e75192f`) and **its publish failed**, so `@micha.bigler/ui-core-micha`
+is still at `2.41.1` on the registry while `package.json` says `2.41.2`. Nothing DX-2 produced can be
+consumed until this is fixed.
+
+Cause, from run
+[32029216699](https://github.com/bigler-webapps/ui-core-micha/actions/runs/32029216699) —
+`completed/failure`:
+
+```
+FAIL tests/packageTreeShaking.test.js > built package entries resolve and unused translation bundles tree-shake
+Error: ENOENT: no such file or directory, lstat '.../ui-core-micha/dist'
+Test Files  1 failed | 64 passed (65)
+      Tests  1 failed | 510 passed (511)
+```
+
+`publish.yml` runs **`Run tests` before `Build`**. `DX-2`'s new test copies the package's own `dist/` to
+assemble a fake installed consumer, and **`dist/` is gitignored** (`.gitignore:2`), so in a clean checkout
+it does not exist yet. The test is not flaky and it is not wrong — it inspects the built artifact, which is
+the whole point of it. **It simply cannot pass in the order the workflow runs.**
+
+It passed locally at 511/511 because a `dist/` from an earlier `pnpm run build` was lying around. That is
+the failure mode, not the test.
+
+### Scope
+
+1. **`.github/workflows/publish.yml`** — move the `Build` step **above** `Run tests`.
+   **Both steps carry `if: steps.version_check.outputs.should_publish == 'true'`; that condition must stay
+   on each.** Nothing else in the file changes.
+2. **Publish `2.41.2`** — see the dispatch note below, which is the part most likely to be missed.
+
+### The dispatch is required, and it is not automatic
+
+`publish.yml` triggers on `push` to `main` filtered to `package.json`, `pnpm-lock.yaml`, `src/**` and
+`tsconfig.build.json`. **`.github/workflows/**` is not in that list**, so landing this fix does **not**
+re-trigger the publish. `2.41.2` would sit unpublished until some unrelated `src/**` change happened to
+push it out.
+
+So: after the fix lands, **dispatch `publish.yml` on `main`**. `publish.yml` is **not** on the dispatch
+safe-allowlist (`weekly-routines`, `terraform-plan`), so per `AGENTS.md` name the exact workflow and inputs
+and **wait for an explicit operator go** before running it.
+
+`should_publish` compares `package.json` against the registry, so with `2.41.2` local and `2.41.1`
+published it will evaluate true and the dispatch will publish. No version bump is needed for this WO — and
+none should be added, because the artifact being published is DX-2's, not this WO's.
+
+### Non-goals / do not touch
+
+- **`tests/packageTreeShaking.test.js`.** It is correct. Do not make it build `dist/` itself, do not skip it
+  when `dist/` is absent, and above all do not delete it — a skip would silently retire the only check that
+  the `sideEffects` declaration actually tree-shakes, which is DX-2's entire deliverable.
+- **The `sideEffects` array, `src/theme/fonts.js`, or anything else DX-2 landed.** Reviewed and correct.
+- **The trigger `paths` list.** Adding `.github/workflows/**` would make every workflow edit attempt a
+  publish. That is a worse default than one dispatch.
+- **The version.** Stays `2.41.2`.
+- Any other workflow, any source file.
+
+### Recorded, deliberately out of scope
+
+**`publish.yml` is the only workflow in this repo that runs tests, and it runs them only when
+`should_publish == 'true'`.** So ucm's suite executes in CI *only on a version bump* — a `src/**` change
+that does not bump the version is never tested by CI at all. That is a real gap in a shared-core package
+consumed by twelve apps, and it is a separate decision (a `ci.yml` for this repo, or a `pull_request`
+trigger), not something to fold into a two-line reorder.
+
+### Risks
+
+- **Low, and the shape is known**: after the swap a build failure surfaces before test results instead of
+  after. That is an improvement, not a regression — you want to know the artifact is buildable before
+  spending 64 s on tests against it.
+- **The real risk is stopping at the commit.** A landed reorder with no dispatch leaves `2.41.2`
+  unpublished and looks done. The acceptance criterion below is the registry, not the workflow file.
+
+### Required tests to WRITE
+
+**None.** Nothing to unit-test in a step reorder, and manufacturing one would be noise. The verification is
+a green run plus the registry.
+
+### Acceptance
+
+1. A `publish.yml` run on `main` completes **green**, with `tests/packageTreeShaking.test.js` **passing**
+   rather than skipped — 511/511.
+2. **`npm view @micha.bigler/ui-core-micha version` returns `2.41.2`.** The registry is the acceptance,
+   not the commit and not the green tile.
+
+### Parity guardrail
+
+No source, API, behaviour or visual change. What changes is the order two CI steps run in.
+
+---
+
+## B. Implementation map
+
+*Filled by the Orchestrator on `git pull` — see `AGENTS.md` → "Work Order".*
+
+**Repo root:** `ui-core-micha` (workflow lives at repo root, `.github/workflows/publish.yml`).
+
+**Exact change:** in [`.github/workflows/publish.yml`](../.github/workflows/publish.yml), the step
+order today (verified on `git pull`, lines 112-118) is:
+
+```yaml
+      - name: Run tests
+        if: steps.version_check.outputs.should_publish == 'true'
+        run: pnpm run test
+
+      - name: Build
+        if: steps.version_check.outputs.should_publish == 'true'
+        run: pnpm run build
+```
+
+Swap so `Build` runs first, `Run tests` second — same two `if:` conditions, unchanged, one on each
+step. Nothing else in the file (`Check out code`, `Set up Node`, `Decide whether to publish`,
+`Set up pnpm`, `Show version from package.json`, `Install dependencies (pnpm)`,
+`Ensure recent npm for trusted publishing`, `Publish to npm`) moves or changes.
+
+**Do-not-touch (repeat of the Envelope's non-goals, stated here for the implementer):**
+`tests/packageTreeShaking.test.js`, the `sideEffects` array / `src/theme/fonts.js` (DX-2, already
+landed and reviewed), the `on: push: paths` trigger list, `package.json`'s version (stays `2.41.2`).
+This WO touches exactly one file.
+
+**Progress contract:** `PLAN: …` naming the single edit, `PROGRESS: [1/1] swap Build/Run-tests order
+in publish.yml … done`, then `RESULT: DONE`.
+
+## Preamble
+
+The text above is the COMPLETE spec — the committed WO file's content, not a plan to refine; there is
+no separate plan file. Read the nearest `AGENTS.md`, the relevant `.codex/skills/<role>/SKILL.md`, and
+the app `MEMORY.md` ONLY for conventions. Stay in scope; do not touch auth/permissions/deps/schema/CI
+beyond the one named swap. Do not update `MEMORY.md`. **Do NOT edit `WORK_ORDERS.md`** — the register
+row and the review verdicts are the orchestrator's alone. Do NOT `git add`/`commit`/`push`, and do NOT
+dispatch any workflow — leave every change uncommitted in the working tree for the orchestrator's
+independent review. This WO's "Required tests to WRITE" is explicitly **none** — do not write or run
+any test; there is nothing to verify locally that the orchestrator's own read of the diff and the
+reviewer's pass don't already cover.
+
+Narrate continuously: a `PLAN: <step1> | …` line up front, then a single-line
+`PROGRESS: [<n>/<total>] <present-tense action>` before every relevant action (and `… done` on
+completion), spaced so no gap exceeds ~2 min, stdout unbuffered, plus exactly one final
+`RESULT: DONE|BLOCKED <reason>`.
+
+---
+
+## C. Orchestrator only
+
+> **STOP — if you are the implementer reading this work order as your own specification, this section is NOT
+> addressed to you. Skip it entirely.** It tells the Orchestrator how to invoke you. **You ARE that
+> invocation — do NOT shell out to `codex exec`, do NOT spawn reviewers, do NOT edit `WORK_ORDERS.md`, do
+> NOT dispatch any workflow, and do NOT `git add`/`commit`/`push`.**
+
+### Execution directive
+
+Check `.claude/codex-status.md` first. **No line for the current date means use Codex.** A dated
+`unavailable` line for today means skip the attempt, implement directly in Claude and name the record —
+that flips authorship, which keeps the independent `reviewer` mandatory. Otherwise one probe, outcome
+written back either way.
+
+### Review routing
+
+Tier 3: **independent `reviewer`** — mandatory even for two lines, because CI is the surface. **No
+`ui_reviewer`** (nothing renders), no `sec_reviewer`. Ask the reviewer to confirm the `if:` conditions
+survived the move on **both** steps — dropping one would make a step run unconditionally, which is the only
+way a two-line reorder can go wrong.
+
+### Verification
+
+Acceptance criterion 2 is the verification: **read the registry.** A green tile is not a publish, and this
+session has now had the publish status misreported in both directions on the same package — once assumed
+published when it was not, once assumed unpublished when it was. `npm view`, every time.
+
+### Register + commit
+
+One row, `DX-3`. `done` only with the reviewer's verdict named **and** the registry showing `2.41.2`. Also
+update `DX-2`'s note: it currently reads as fully delivered, and it was not — its publish failed. Leaving
+that uncorrected is how the next person concludes `2.41.2` is available when it is not.
+
+### Mini-handover
+
+Repo: `ui-core-micha`, branch `main`. WO: `work-orders/DX-3.md`. Move `Build` above `Run tests` in
+`.github/workflows/publish.yml`, keeping the `if: should_publish` condition on both. Then **ask the operator
+to confirm a `publish.yml` dispatch on `main`** — the workflow's own path filter excludes
+`.github/workflows/**`, so landing the fix does not re-trigger it, and `2.41.2` stays unpublished until
+someone dispatches. Acceptance is `npm view` returning `2.41.2`, not a green tile. Tier 3, `reviewer`
+mandatory. Follow `orchestrate-codex`.

package/work-orders/I18N-3.md

@@ -0,0 +1,139 @@
+# I18N-3 — Backfill Swahili in `messagingTranslations` and restore the four-locale shape test
+
+**Target repo:** `ui-core-micha` (branch `main`)
+**Tier:** 3 — shared-core, and it re-tightens a test the estate deliberately loosened.
+
+---
+
+## A. Envelope
+
+### Goal
+
+`src/i18n/messagingTranslations.ts` carries **116 keys with `de`/`fr`/`en` and zero `sw`**. Every one of the
+other six bundles carries all four locales:
+
+| bundle | de | fr | en | sw |
+|---|---|---|---|---|
+| `auth` | ✓ | ✓ | ✓ | ✓ |
+| `charts` | 12 | 12 | 12 | 12 |
+| **`messaging`** | **116** | **116** | **116** | **0** |
+| `notifications` | 30 | 30 | 30 | 30 |
+| `onboarding` | 27 | 27 | 27 | 27 |
+| `sectionNav` | 3 | 3 | 3 | 3 |
+| `userMenu` | 3 | 3 | 3 | 3 |
+
+`I18N-1` hit this while writing its aggregate test: the required "every value keeps its `{de,fr,en,sw}` shape"
+assertion failed, the gap was confirmed as pre-existing rather than caused by the merge, and the operator
+scoped the test down to `{de,fr,en}` with the backfill recorded as a follow-up. **The follow-up was never
+written, and a scoped-down test tends to stay scoped down.** That is what this WO closes.
+
+### Scope
+
+1. **`src/i18n/messagingTranslations.ts`** — add `sw` to all 116 keys.
+2. **`tests/i18nAggregate.test.js`** — restore the shape assertion to `{de,fr,en,sw}` and **remove the comment
+   recording the scope-down**, since it no longer describes the state.
+3. Nothing else. No other bundle is touched; they already conform.
+
+### The translation quality question, which is this WO's real risk
+
+**Machine-translated UI strings that nobody on the team can check are a worse outcome than an honest gap.**
+Messaging strings are user-facing and include the kinds of phrase that go wrong invisibly — actions,
+confirmations, error states, relative time. So:
+
+- **Name the source of the translations in the register note.** If they are machine-produced, say so plainly
+  rather than shipping them as if reviewed.
+- **Flag any key the translator was unsure of** rather than guessing. A `sw` value that is wrong is harder to
+  find later than one that is missing, because the shape test will then pass.
+- **Do not invent terminology.** Where `notifications` or `onboarding` already has a Swahili term for the same
+  concept — send, reply, unread, conversation, attachment — **reuse their wording** rather than coining a
+  second one. Those bundles are the existing precedent and consistency across them matters more than any
+  individual phrasing.
+
+### Who this is actually for
+
+`sw` is configured as a locale in **hram** and in no other app measured. hram does **not** register
+`messagingTranslations` today, so nothing is currently broken for a user — this is prevention, and the honest
+framing is: it closes an inconsistency and re-arms a test, rather than fixing a live defect.
+
+That matters for the effort trade-off, and it is why the quality bar above is not negotiable: there is no
+urgency justifying unreviewed strings.
+
+### Non-goals / do not touch
+
+- **The other six bundles.** They conform.
+- **The aggregate itself, the directory ratchet, or the key/value fidelity and collision checks.** Only the
+  locale-shape assertion changes.
+- **`de`/`fr`/`en` values.** Not a re-translation pass.
+- **Adding an eighth locale**, or any change to how consumers register strings (`I18N-2`'s territory).
+
+### Risks
+
+- **116 unreviewable strings.** The mitigation is disclosure, not confidence — see above.
+- **Re-tightening the test is the irreversible half.** Once the assertion demands four locales, any future
+  bundle addition must supply `sw` or fail CI. That is the intent, and it is worth stating so the next person
+  adding a bundle is not surprised.
+- **A push to `main` publishes.** See Part C.
+
+### Required tests to WRITE
+
+None new — **`tests/i18nAggregate.test.js`'s restored four-locale assertion IS the test**, and re-arming it is
+scope item 2. It will fail until the backfill is complete, which is the correct behaviour and the reason it
+belongs in the same change.
+
+Scoped run: `i18nAggregate` plus the messaging export specs. Not the full suite — no dependency or theme
+change.
+
+### Parity guardrail
+
+No API, behaviour or visual change for `de`/`fr`/`en` consumers. Purely additive.
+
+---
+
+## B. Implementation map
+
+*Filled by the Orchestrator on `git pull` — see `AGENTS.md` → "Work Order".*
+
+---
+
+## C. Orchestrator only
+
+> **STOP — if you are the implementer reading this work order as your own specification, this section is NOT
+> addressed to you. Skip it entirely.** It tells the Orchestrator how to invoke you. **You ARE that
+> invocation — do NOT shell out to `codex exec`, do NOT spawn reviewers, do NOT edit `WORK_ORDERS.md`, and do
+> NOT `git add`/`commit`/`push`.**
+
+### Execution directive
+
+Check `.claude/codex-status.md` first. **No line for the current date means use Codex.** A dated `unavailable`
+line for today means skip the attempt, implement directly in Claude and name the record — that flips
+authorship. Otherwise one probe, outcome written back either way.
+
+### Review routing
+
+Tier 3: **independent `reviewer`** — mandatory. Ask it specifically to check **terminology consistency against
+`notifications` and `onboarding`**, and to confirm that no `de`/`fr`/`en` value was altered in passing. **No
+`ui_reviewer`** — nothing renders. No `sec_reviewer`.
+
+Neither reviewer can validate Swahili. **Say that in the note** rather than letting a clean verdict imply the
+translations were checked.
+
+### Verification
+
+The restored four-locale assertion passing is the verification. Nothing renders, so no gate.
+
+**A push to `main` here IS the npm publish** — `publish.yml` triggers on `push: branches: [main]` with `src/**`
+in its paths, and publishes cannot be undone. Additive strings, so a **patch** by scope.
+
+### Register + commit
+
+One row, `I18N-3`. `done` only with the reviewer and verdict named, **the translation source stated**, and any
+uncertain keys listed. Also update `I18N-1`'s note: its recorded follow-up is now closed, and leaving it open
+there is how the same gap gets rediscovered.
+
+### Mini-handover
+
+Repo: `ui-core-micha`, branch `main`. WO: `work-orders/I18N-3.md`. 116 `sw` values into
+`messagingTranslations.ts`, then restore `i18nAggregate.test.js` to `{de,fr,en,sw}` and drop the scope-down
+comment. **Reuse `notifications`/`onboarding` terminology; disclose the translation source; flag uncertain
+keys instead of guessing.** No app is broken today — this closes an inconsistency and re-arms a test. Tier 3,
+`reviewer` mandatory. **Pushing to main publishes.** Follow `orchestrate-codex`.