@micha.bigler/ui-core-micha 3.12.0 → 3.13.1

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 3.13.1 - UCM-SHELL-8
+
+`SectionNav` now renders grouped and overview navigation buttons inside list items on
+desktop and in the mobile drawer. Selection, callbacks, labels and spacing are preserved.
+
+## 3.13.0 - UCM-AUTH-12
+
+`AccountPage` accepts `showProfileStatements` (default `true`). Set it to `false` in consumers
+without privacy/cookie statement endpoints to suppress the statement panels and their requests.
+Both existing consent controls and their submitted values remain available.
+
 ## 3.12.0 - UCM-THEME-18
 
 The shared type scale now uses h1–h5 sizes of 36/32/28/24/20px, h4 steps to 23px below `sm`, and subtitle1 is 13px; every adopted app changes on its next bump, with hram, jg-ferien, kerzenziehen, spesix, and fitness-monitor moving screen titles from h5 to h4, while survey_app should remove its 800/700 weights and h4 `2.125rem`/400 override and decide its h3 page titles (24px to 28px), closing the held `SVA-THEME-1` typography revert. An app h4 `fontSize` override retains the baseline’s 23px mobile step (survey_app currently sets `2.125rem`); heading weights are fixed at 600, so apps should not override them per level. All other adopted apps need only bump; webshop-guenter, Kira, Cinevia, and Gustav are unaffected.

package/README.md

@@ -10,6 +10,12 @@ To add an entry, create a small component in `dev/entries.jsx` and append it to
 
 Spread `uiCoreTranslations` into the default i18n namespace as the supported aggregate; per-feature translation exports remain available to selective apps that accept responsibility for pairing every adopted feature with its bundle.
 
+## Account profile statements
+
+`AccountPage` defaults `showProfileStatements` to `true`. Pass `false` when the consumer does not
+offer privacy/cookie statement text endpoints; this hides their panels and prevents their requests.
+The privacy and cookie consent controls and their submitted values remain available.
+
 ## Consumer integration check
 
 ```js

package/WORK_ORDERS.md

@@ -28,6 +28,8 @@ prefixed ID; never reuse a bare flat number across workstreams.
 
 | ID | Titel | Beschreibung | Datum | Status | Commit(s) | Notiz |
 |---|---|---|---|---|---|---|
+| UCM-AUTH-12 | [Optional account profile statement text](work-orders/UCM-AUTH-12.md) | AccountPage showProfileStatements defaults true; false suppresses statement panels/requests while preserving both consent controls and their payload. Minor release 3.13.0, consumed by innoservice INNO-FIX-13. | 2026-10-13 | done | 97b7d83 | Tier 3 (shared-core account surface). Gate #1 explicitly approved in the innoservice Codex chat on 2026-10-13, including release and app pin bump. Separate configured Luna implementation and independent reviews; existing default and consent behavior are invariants.  review: codex/gpt-6-luna · lenses: envelope, regression, duplication, tests, ui, security · 0 raised · 0 accepted · worst accepted: none. Parent scoped tests: AccountPage.profileStatements.test.jsx + AccountPage.test.jsx, 6 passed, correct kit cwd, maxWorkers2. Native author attempt EPERM before collection; parent gate green. Reviewed additive API/default and package release metadata; main push triggers the existing release build/suite/publish. Released 3.13.0: CI38422682968 build, release suite and npm Trusted Publishing all succeeded. App consumption/capture remains tracked under INNO-FIX-13. |
+| UCM-SHELL-8 | SectionNav lists contain direct button children | Grouped and overview entries need genuine list items containing the existing navigation buttons, preserving selection, drawer behavior and presentation. | 2026-10-13 | in-review | `d399f51` | Tier 3. Gate #1 approved by the operator on 2026-10-13: structural correction, tests/review, patch release and innoservice pin bump. Full scope and context: [work-orders/UCM-SHELL-8.md](work-orders/UCM-SHELL-8.md). Original CI38387014900/source9937adb evidence remains in innoservice/work-orders/assets/INNO-FIX-11-axe-nodes.json; CI38425506007/sourceebc35e1 reproduces the three account list violations on 3.13.0, recorded in INNO-FIX-11-candidate-b-axe-nodes.json. Initial native author /root/kit_sectionnav requested codex/gpt-6-luna; effective native metadata unexposed. Source and two focused test cases delivered; author run EPERM before collection, zero tests. Parent tests and independent review pending. review: codex/gpt-6-luna · lenses: envelope, regression, duplication, tests + UI · 1 raised · 0 accepted · worst accepted: none. Disposition in WO Part C: fabricated class-stub identity demand rejected against the real revert failure and preserved existing behavior checks. Parent 21 scoped tests passed (maxWorkers=2), TypeScript build exit 0. Core source accepted; publication, app pin and fresh consumer capture pending. |
 | UCM-THEME-17 | Decide a less compressed baseline type scale | Design round (design-language process): inventory, instrument with 2-3 candidate scales next to today's baseline and MUI on real screens (hram, a survey site, jg-ferien, kerzenziehen), value rounds, frozen sheet. Measured 2026-10-04: page/card/section titles differ by 1-3 px, hierarchy rests on weight alone. Full order [`work-orders/UCM-THEME-17.md`](work-orders/UCM-THEME-17.md) | 2026-10-04 | done | `68dfc6a`, `998e36c`, `cb9dd89`, `c452224` | Tier 2 (document only) · operator decision 2026-10-04: baseline finding, not per-app overrides · implementation order follows the freeze · survey_app SVA-THEME-1 typography revert held until then · **frozen 2026-10-04** after two value rounds: candidate B, mobile h4 23, h1-h3 36/32/28; value source [`docs/TYPE-SCALE.md`](docs/TYPE-SCALE.md) · review: none, document order, the operator freeze is the gate · implementation UCM-THEME-18 |
 | UCM-THEME-18 | Ship the frozen baseline type scale | `tokens.js` typography per `docs/TYPE-SCALE.md`: h1-h3 36/32/28, h4 24 (23 below `sm`), h5 20, subtitle1 13; light fixture typography entries; minor release 3.12.0. Full order [`work-orders/UCM-THEME-18.md`](work-orders/UCM-THEME-18.md) | 2026-10-04 | 5be83d5 | | Tier 3 (shared-core) · reviewer + ui_reviewer · downstream per-app orders (h5 page titles -> h4, per-level weight overrides) written after the release - 2026-10-04: Codex implemented (gpt-6-luna; probe of stale 2026-10-03 record succeeded, available) - orchestrator fixed review findings - review: codex/gpt-6-luna - lenses: envelope,regression,duplication,tests + ui_review - 3 raised - 2 accepted - worst accepted: defect (h4 mobile key now follows an app-overridden sm, test added; completeness test strengthened; rejected: breakpointDownQuery vs theme.breakpoints.down, no theme exists at token time) - light fixture diff limited to typography entries - no rendered side-by-side (no prototype; values asserted from the resolved theme in light and dark) - release 3.12.0 |
 | UCM-I18N-5 | [User-list pagination range text is hard-coded English](work-orders/UCM-I18N-5.md) | `UserListComponent`'s `TablePagination` sets `labelRowsPerPage` but no `labelDisplayedRows`, so German shows "1–4 of 4". | 2026-10-01 | done | 6b9d557 | Found in jg-ferien's rendered check 2026-10-01. Follows `UCM-I18N-4`. Tier 3. Done = released AND jg-ferien pin bumped. Envelope written 2026-10-01; operator: hand to the jg Paket-4 session. Implementation map filled 2026-10-02 (`a732025`): the translation bundle carries FOUR locales (de/fr/en/sw), not three — confirmed by reading `authTranslations.ts` directly; proposed two keys (exact-count + "more than" form) with a best-effort, not native-verified, Swahili wording. Implemented by codex/gpt-5.6-luna exactly per the map: `labelDisplayedRows` resolves `UserList.DISPLAYED_ROWS`/`UserList.DISPLAYED_ROWS_MORE_THAN` through `t()`, both keys added in all four locales. review: codex/gpt-5.6-luna · lenses: envelope,regression,duplication,tests,ui_reviewer (one concurrent batch, diff inline) · 4 raised · 3 accepted (deduplicated) · worst accepted: defect. Accepted: the rendered English test would still pass against a reverted implementation, since the EN wording was deliberately made identical to MUI's own hardcoded default — added a second test swapping in a distinctive marker string for just that key, proving the render genuinely resolves through i18next, not MUI's fallback; `authTranslations.test.js`'s new key-parity check only asserted non-empty strings, not that each locale actually carries the `{{from}}`/`{{to}}`/`{{count}}` placeholders the others do — strengthened with an explicit per-locale placeholder check; self-identified (corroborated by the `tests` lens's own closing remark) that the `count === -1` ("more than") branch can never be reached through a render of `UserListComponent` itself (its own `count` prop is always a real array length) — extracted the inline callback into an exported, directly unit-tested `formatDisplayedRowsLabel(t)` rather than leaving it permanently untested dead code. Rejected: `regression`'s claim that hard-coding `labelDisplayedRows` "overrides any consuming app's MUI theme customisation" — speculative, no actual consumer override exists (same explicit-prop design as `labelRowsPerPage` since `UCM-I18N-4`), and the reviewer's own repo search found zero consumer snapshots/assertions relying on the old English text. `envelope`'s "release + pin bump missing from the diff" was correct but not a code defect — addressed by the remaining steps below, not a fix to the reviewed diff. `duplication`: 0 findings. `ui_reviewer`: 0 blocking findings; confirmed placeholder consistency across all 8 strings; Swahili wording flagged as advisory-only ("structurally plausible to a non-native reviewer, native-speaker verification advisable" — not re-asked of a native speaker here, recorded as open). Tests: 37/37 green (`userScreenTranslations.test.jsx`, `authTranslations.test.js`, `UserListComponent.test.jsx`). Released as `3.11.1` (patch — continues `UCM-I18N-4`'s i18n-gap category, not a new capability area), commit `6b9d557`; npm Trusted Publishing confirmed via the Actions job log (not a registry re-query — provenance publishes can lag), tarball `@micha.bigler/ui-core-micha@3.11.1`. jg-ferien's pin bumped 3.7.0 -> 3.11.1 same day, closed as jg's own `JG-DEPS-3` (`2c1d6e3`) — see that repo's `WORK_ORDERS.md` for the empirical safety checks (status-colour palette diff, `UserListComponent`-unused confirmation, full-suite run) this multi-version jump required. |

package/dist/layout/SectionNav.js

@@ -1,7 +1,7 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { useId, useState } from 'react';
 import KeyboardArrowDownIcon from '@mui/icons-material/KeyboardArrowDown';
-import { Box, ButtonBase, Drawer, List, ListItemButton, ListItemText, Paper, Stack, Typography, } from '@mui/material';
+import { Box, ButtonBase, Drawer, List, ListItem, ListItemButton, ListItemText, Paper, Stack, Typography, } from '@mui/material';
 import { useTheme } from '@mui/material/styles';
 import { useTranslation } from 'react-i18next';
 const defaultZIndex = (theme) => theme.zIndex.drawer + 3;
@@ -82,11 +82,11 @@ const SECTION_NAV_DRAWER_SCROLL_SX = {
 };
 function SectionNavList({ groups, activeKey, rememberedKey, overviewItem, onSelect, rememberedLabel, }) {
     const headingId = useId();
-    return (_jsxs(Stack, { spacing: 2, children: [overviewItem && (_jsx(Paper, { variant: "outlined", sx: SECTION_NAV_GROUP_PAPER_SX, children: _jsx(List, { disablePadding: true, children: _jsx(ListItemButton, { selected: activeKey == null, "aria-current": activeKey == null ? 'page' : undefined, onClick: () => onSelect === null || onSelect === void 0 ? void 0 : onSelect(null), children: _jsx(ListItemText, { primary: overviewItem.label }) }) }) })), groups.map((group, groupIndex) => {
+    return (_jsxs(Stack, { spacing: 2, children: [overviewItem && (_jsx(Paper, { variant: "outlined", sx: SECTION_NAV_GROUP_PAPER_SX, children: _jsx(List, { disablePadding: true, children: _jsx(ListItem, { disablePadding: true, children: _jsx(ListItemButton, { selected: activeKey == null, "aria-current": activeKey == null ? 'page' : undefined, onClick: () => onSelect === null || onSelect === void 0 ? void 0 : onSelect(null), children: _jsx(ListItemText, { primary: overviewItem.label }) }) }) }) })), groups.map((group, groupIndex) => {
                 const groupHeadingId = `${headingId}-${groupIndex}`;
                 return (_jsxs(Paper, { variant: "outlined", sx: SECTION_NAV_GROUP_PAPER_SX, children: [_jsx(Box, { id: groupHeadingId, sx: SECTION_NAV_GROUP_HEADER_SX, children: _jsx(Typography, { variant: "subtitle2", fontWeight: 700, children: group.label }) }), _jsx(List, { disablePadding: true, "aria-labelledby": groupHeadingId, children: group.items.map((item) => {
                                 const selected = item.key === activeKey;
-                                return (_jsx(ListItemButton, { selected: selected, "aria-current": selected ? 'page' : undefined, onClick: () => onSelect === null || onSelect === void 0 ? void 0 : onSelect(item.key), children: _jsx(ListItemText, { primary: item.label, secondary: !selected && item.key === rememberedKey ? rememberedLabel : null }) }, item.key));
+                                return (_jsx(ListItem, { disablePadding: true, children: _jsx(ListItemButton, { selected: selected, "aria-current": selected ? 'page' : undefined, onClick: () => onSelect === null || onSelect === void 0 ? void 0 : onSelect(item.key), children: _jsx(ListItemText, { primary: item.label, secondary: !selected && item.key === rememberedKey ? rememberedLabel : null }) }) }, item.key));
                             }) })] }, group.key));
             })] }));
 }

package/dist/pages/AccountPage.js

@@ -26,7 +26,7 @@ import { QrSignupValidityManager } from '../components/QrSignupValidityManager';
 import { SupportRecoveryRequestsTab } from '../components/SupportRecoveryRequestsTab';
 import { BulkInviteCsvTab } from '../components/BulkInviteCsvTab';
 import { fetchAuthPolicy, updateUserProfile } from '../auth/authApi'; // Ggf. Pfad anpassen
-export function AccountPage({ userListExtraColumns = [], userListExtraRowActions = [], userListExtraContext = null, userListRefreshTrigger = 0, userListCanEditUser = null, userListShowNewColumn = true, userListShowSuccessfulLoginColumn = true, userListShowRoleColumn = true, userListOnChangeRole = null, userListShowDeleteAction = true, userListCanDeleteUser = null, userListOnDeleteUser = null, showBulkInviteCsvTab = false, bulkInviteCsvProps = {}, extraTabs = [], }) {
+export function AccountPage({ userListExtraColumns = [], userListExtraRowActions = [], userListExtraContext = null, userListRefreshTrigger = 0, userListCanEditUser = null, userListShowNewColumn = true, userListShowSuccessfulLoginColumn = true, userListShowRoleColumn = true, userListOnChangeRole = null, userListShowDeleteAction = true, userListCanDeleteUser = null, userListOnDeleteUser = null, showBulkInviteCsvTab = false, bulkInviteCsvProps = {}, extraTabs = [], showProfileStatements = true, }) {
     var _a;
     const { t, i18n } = useTranslation();
     const { user, login, loading } = useContext(AuthContext);
@@ -174,5 +174,5 @@ export function AccountPage({ userListExtraColumns = [], userListExtraRowActions
     const activeExtraTab = builtInTabValues.has(safeTab)
         ? null
         : extraTabs.find((tab) => tab.value === safeTab);
-    return (_jsxs(WidePage, { title: t('Account.TITLE', 'Account & Administration'), children: [_jsx(Helmet, { children: _jsxs("title", { children: [t('Account.PAGE_TITLE', 'Account'), " \u2013 ", user.email] }) }), _jsxs(SectionNav, { mode: isMobile ? 'mobile' : 'desktop', groups: groups, activeKey: safeTab, onSelect: (key) => handleTabChange(null, key), children: [safeTab === 'profile' && (_jsx(Box, { sx: { mt: 2 }, children: _jsx(ProfileComponent, { onSubmit: handleProfileSubmit, showName: true, showPrivacy: true, showCookies: true }) })), safeTab === 'security' && (_jsx(Box, { sx: { mt: 2 }, children: _jsx(SecurityComponent, { fromRecovery: fromRecovery, fromWeakLogin: fromWeakLogin }) })), safeTab === 'users' && (_jsx(Box, { sx: { mt: 2 }, children: _jsx(UserListComponent, { roles: activeRoles, currentUser: user, extraColumns: userListExtraColumns, extraRowActions: userListExtraRowActions, extraContext: userListExtraContext, refreshTrigger: userListRefreshTrigger, canEditUser: userListCanEditUser, showNewColumn: userListShowNewColumn, showSuccessfulLoginColumn: userListShowSuccessfulLoginColumn, showRoleColumn: userListShowRoleColumn, onChangeRole: userListOnChangeRole, showDeleteAction: userListShowDeleteAction, canDeleteUser: userListCanDeleteUser, onDeleteUser: userListOnDeleteUser }) })), safeTab === 'invite' && (_jsx(Box, { sx: { mt: 2 }, children: _jsxs(Stack, { spacing: 2.5, children: [canViewAuthPolicy && (_jsx(Paper, { variant: "outlined", sx: ACCOUNT_PAGE_SECTION_PAPER_SX, children: _jsx(AuthFactorRequirementCard, { canEdit: canWriteAuthPolicy, policy: authPolicy }) })), canViewAuthPolicy && (_jsx(Paper, { variant: "outlined", sx: ACCOUNT_PAGE_SECTION_PAPER_SX, children: _jsx(RegistrationMethodsManager, { policy: authPolicy, error: authPolicyError, onPolicyChange: setAuthPolicy, canEdit: canWriteAuthPolicy }) })), canSendInvites && Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_admin_invite) && (_jsx(Paper, { variant: "outlined", sx: ACCOUNT_PAGE_SECTION_PAPER_SX, children: _jsx(UserInviteComponent, {}) })), canManageAccessCodes && Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_self_signup_access_code) && (_jsxs(Paper, { variant: "outlined", sx: ACCOUNT_PAGE_SECTION_PAPER_SX, children: [_jsx(Typography, { variant: "h6", gutterBottom: true, children: t('Auth.ACCESS_CODE_MANAGER_TITLE', 'Access Codes') }), _jsx(Typography, { variant: "body2", sx: { mb: 2, color: 'text.secondary' }, children: t('Account.ACCESS_CODES_HINT', 'Manage access codes for self-registration.') }), _jsx(AccessCodeManager, {})] })), canManageAccessCodes && Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_self_signup_access_code) && (_jsx(Paper, { variant: "outlined", sx: ACCOUNT_PAGE_SECTION_PAPER_SX, children: _jsx(AccessCodeSingleUseToggle, { canEdit: canWriteAuthPolicy, policy: authPolicy, onPolicyChange: setAuthPolicy }) })), canSendInvites && showBulkInviteCsvTab && Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_admin_invite) && (_jsx(Paper, { variant: "outlined", sx: ACCOUNT_PAGE_SECTION_PAPER_SX, children: _jsx(BulkInviteCsvTab, Object.assign({}, bulkInviteCsvProps)) })), canViewAuthPolicy && Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_self_signup_email_domain) && (_jsx(Paper, { variant: "outlined", sx: ACCOUNT_PAGE_SECTION_PAPER_SX, children: _jsx(AllowedEmailDomainsManager, { enabled: Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_self_signup_email_domain), domains: (authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allowed_email_domains) || [], onPolicyChange: setAuthPolicy, canEdit: canWriteAuthPolicy }) })), canViewAuthPolicy && Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_self_signup_qr) && (_jsx(Paper, { variant: "outlined", sx: ACCOUNT_PAGE_SECTION_PAPER_SX, children: _jsx(QrSignupValidityManager, { enabled: Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_self_signup_qr), expiryDays: authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.signup_qr_expiry_days, onPolicyChange: setAuthPolicy, canEdit: canWriteAuthPolicy }) })), canManageSignupQr && Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_self_signup_qr) && (_jsx(Paper, { variant: "outlined", sx: ACCOUNT_PAGE_SECTION_PAPER_SX, children: _jsx(QrSignupManager, { enabled: Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_self_signup_qr), expiryDays: authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.signup_qr_expiry_days }) }))] }) })), safeTab === 'support' && (_jsx(Box, { sx: { mt: 2 }, children: _jsx(SupportRecoveryRequestsTab, {}) })), activeExtraTab && (_jsx(Box, { sx: { mt: 2 }, children: (_a = activeExtraTab.render) === null || _a === void 0 ? void 0 : _a.call(activeExtraTab, { user, perms, isSuperUser, t }) }))] })] }));
+    return (_jsxs(WidePage, { title: t('Account.TITLE', 'Account & Administration'), children: [_jsx(Helmet, { children: _jsxs("title", { children: [t('Account.PAGE_TITLE', 'Account'), " \u2013 ", user.email] }) }), _jsxs(SectionNav, { mode: isMobile ? 'mobile' : 'desktop', groups: groups, activeKey: safeTab, onSelect: (key) => handleTabChange(null, key), children: [safeTab === 'profile' && (_jsx(Box, { sx: { mt: 2 }, children: _jsx(ProfileComponent, { onSubmit: handleProfileSubmit, showName: true, showPrivacy: true, showCookies: true, showStatements: showProfileStatements }) })), safeTab === 'security' && (_jsx(Box, { sx: { mt: 2 }, children: _jsx(SecurityComponent, { fromRecovery: fromRecovery, fromWeakLogin: fromWeakLogin }) })), safeTab === 'users' && (_jsx(Box, { sx: { mt: 2 }, children: _jsx(UserListComponent, { roles: activeRoles, currentUser: user, extraColumns: userListExtraColumns, extraRowActions: userListExtraRowActions, extraContext: userListExtraContext, refreshTrigger: userListRefreshTrigger, canEditUser: userListCanEditUser, showNewColumn: userListShowNewColumn, showSuccessfulLoginColumn: userListShowSuccessfulLoginColumn, showRoleColumn: userListShowRoleColumn, onChangeRole: userListOnChangeRole, showDeleteAction: userListShowDeleteAction, canDeleteUser: userListCanDeleteUser, onDeleteUser: userListOnDeleteUser }) })), safeTab === 'invite' && (_jsx(Box, { sx: { mt: 2 }, children: _jsxs(Stack, { spacing: 2.5, children: [canViewAuthPolicy && (_jsx(Paper, { variant: "outlined", sx: ACCOUNT_PAGE_SECTION_PAPER_SX, children: _jsx(AuthFactorRequirementCard, { canEdit: canWriteAuthPolicy, policy: authPolicy }) })), canViewAuthPolicy && (_jsx(Paper, { variant: "outlined", sx: ACCOUNT_PAGE_SECTION_PAPER_SX, children: _jsx(RegistrationMethodsManager, { policy: authPolicy, error: authPolicyError, onPolicyChange: setAuthPolicy, canEdit: canWriteAuthPolicy }) })), canSendInvites && Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_admin_invite) && (_jsx(Paper, { variant: "outlined", sx: ACCOUNT_PAGE_SECTION_PAPER_SX, children: _jsx(UserInviteComponent, {}) })), canManageAccessCodes && Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_self_signup_access_code) && (_jsxs(Paper, { variant: "outlined", sx: ACCOUNT_PAGE_SECTION_PAPER_SX, children: [_jsx(Typography, { variant: "h6", gutterBottom: true, children: t('Auth.ACCESS_CODE_MANAGER_TITLE', 'Access Codes') }), _jsx(Typography, { variant: "body2", sx: { mb: 2, color: 'text.secondary' }, children: t('Account.ACCESS_CODES_HINT', 'Manage access codes for self-registration.') }), _jsx(AccessCodeManager, {})] })), canManageAccessCodes && Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_self_signup_access_code) && (_jsx(Paper, { variant: "outlined", sx: ACCOUNT_PAGE_SECTION_PAPER_SX, children: _jsx(AccessCodeSingleUseToggle, { canEdit: canWriteAuthPolicy, policy: authPolicy, onPolicyChange: setAuthPolicy }) })), canSendInvites && showBulkInviteCsvTab && Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_admin_invite) && (_jsx(Paper, { variant: "outlined", sx: ACCOUNT_PAGE_SECTION_PAPER_SX, children: _jsx(BulkInviteCsvTab, Object.assign({}, bulkInviteCsvProps)) })), canViewAuthPolicy && Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_self_signup_email_domain) && (_jsx(Paper, { variant: "outlined", sx: ACCOUNT_PAGE_SECTION_PAPER_SX, children: _jsx(AllowedEmailDomainsManager, { enabled: Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_self_signup_email_domain), domains: (authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allowed_email_domains) || [], onPolicyChange: setAuthPolicy, canEdit: canWriteAuthPolicy }) })), canViewAuthPolicy && Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_self_signup_qr) && (_jsx(Paper, { variant: "outlined", sx: ACCOUNT_PAGE_SECTION_PAPER_SX, children: _jsx(QrSignupValidityManager, { enabled: Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_self_signup_qr), expiryDays: authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.signup_qr_expiry_days, onPolicyChange: setAuthPolicy, canEdit: canWriteAuthPolicy }) })), canManageSignupQr && Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_self_signup_qr) && (_jsx(Paper, { variant: "outlined", sx: ACCOUNT_PAGE_SECTION_PAPER_SX, children: _jsx(QrSignupManager, { enabled: Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_self_signup_qr), expiryDays: authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.signup_qr_expiry_days }) }))] }) })), safeTab === 'support' && (_jsx(Box, { sx: { mt: 2 }, children: _jsx(SupportRecoveryRequestsTab, {}) })), activeExtraTab && (_jsx(Box, { sx: { mt: 2 }, children: (_a = activeExtraTab.render) === null || _a === void 0 ? void 0 : _a.call(activeExtraTab, { user, perms, isSuperUser, t }) }))] })] }));
 }

package/docs/TYPE-SCALE.md

@@ -90,6 +90,18 @@ These are inputs for the per-app follow-up after the release, not part of the ba
   1 page h5; survey_app uses h3 on 7 pages, which grows from 24 to 28.
 - **Per-level weight overrides** contradict decision 3: survey_app (h1 to h6 800/700, site builder 800),
   hram (500), spesix (weights). survey_app's held typography revert (`SVA-THEME-1`) is decided by this sheet.
+- **subtitle1 also serves as a title, not only as a section label** (added 2026-10-04, after the freeze; the
+  inventory missed it, because it read subtitle1 only in its section-label role on hram Research). Uses in
+  `src/`: hram 72, jg-ferien 39, ui-core-micha itself 12 (`UserMenu` user name, `SectionNav` active item,
+  announcement titles), innoservice 9, survey_app 7, reimbursements 6, spesix 5. As item or panel titles they
+  fall below body size. **Decided at the jg-ferien pilot `JG-DEPS-4`, 2026-10-04: subtitle1 stays at 13 px.**
+  The operator looked at jg-ferien on the 3.12.0 build, including `FinanceSummaryPanel` with subtitle1 as a
+  panel section title, and accepted it without any remapping. Rollout orders therefore do not remap
+  subtitle1 by default; a remap happens only where an app's own look rejects a specific screen.
+- **Exception to decision 3: spesix keeps its own heading weights** (operator, 2026-10-04, at `SPX-DEP-3`). Its
+  `DESIGN` block (h1 800, h2-h5 700, h6 600, button 700) belongs to a decided design (`SPX-THEME-1`, identity
+  bucket), and the new sizes separate the levels on their own. survey_app's 800/700 weights are not covered by
+  this exception: there the operator found the bold levels themselves to be the problem.
 - webshop-guenter keeps its handoff scale (decided brand, identity bucket). Kira, Cinevia and Gustav use no MUI
   heading variants and are unaffected.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@micha.bigler/ui-core-micha",
-  "version": "3.12.0",
+  "version": "3.13.1",
   "main": "dist/index.js",
   "module": "dist/index.js",
   "sideEffects": [

package/src/layout/SectionNav.jsx

@@ -5,6 +5,7 @@ import {
   ButtonBase,
   Drawer,
   List,
+  ListItem,
   ListItemButton,
   ListItemText,
   Paper,
@@ -118,13 +119,15 @@ function SectionNavList({
       {overviewItem && (
         <Paper variant="outlined" sx={SECTION_NAV_GROUP_PAPER_SX}>
           <List disablePadding>
-            <ListItemButton
-              selected={activeKey == null}
-              aria-current={activeKey == null ? 'page' : undefined}
-              onClick={() => onSelect?.(null)}
-            >
-              <ListItemText primary={overviewItem.label} />
-            </ListItemButton>
+            <ListItem disablePadding>
+              <ListItemButton
+                selected={activeKey == null}
+                aria-current={activeKey == null ? 'page' : undefined}
+                onClick={() => onSelect?.(null)}
+              >
+                <ListItemText primary={overviewItem.label} />
+              </ListItemButton>
+            </ListItem>
           </List>
         </Paper>
       )}
@@ -143,17 +146,18 @@ function SectionNavList({
               {group.items.map((item) => {
                 const selected = item.key === activeKey;
                 return (
-                  <ListItemButton
-                    key={item.key}
-                    selected={selected}
-                    aria-current={selected ? 'page' : undefined}
-                    onClick={() => onSelect?.(item.key)}
-                  >
-                    <ListItemText
-                      primary={item.label}
-                      secondary={!selected && item.key === rememberedKey ? rememberedLabel : null}
-                    />
-                  </ListItemButton>
+                  <ListItem key={item.key} disablePadding>
+                    <ListItemButton
+                      selected={selected}
+                      aria-current={selected ? 'page' : undefined}
+                      onClick={() => onSelect?.(item.key)}
+                    >
+                      <ListItemText
+                        primary={item.label}
+                        secondary={!selected && item.key === rememberedKey ? rememberedLabel : null}
+                      />
+                    </ListItemButton>
+                  </ListItem>
                 );
               })}
             </List>

package/src/pages/AccountPage.jsx

@@ -53,6 +53,7 @@ export function AccountPage({
   showBulkInviteCsvTab = false,
   bulkInviteCsvProps = {},
   extraTabs = [],
+  showProfileStatements = true,
 }) {
   const { t, i18n } = useTranslation();
   const { user, login, loading } = useContext(AuthContext);
@@ -253,6 +254,7 @@ export function AccountPage({
             showName
             showPrivacy
             showCookies
+            showStatements={showProfileStatements}
           />
         </Box>
       )}

package/tests/AccountPage.profileStatements.test.jsx

@@ -0,0 +1,162 @@
+// @vitest-environment jsdom
+import React from 'react';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react';
+import { ThemeProvider, createTheme } from '@mui/material/styles';
+import { MemoryRouter, Route, Routes } from 'react-router-dom';
+
+vi.mock('react-i18next', () => {
+  const KEYS = {
+    'Account.TITLE': 'Account & Administration',
+    'Account.PAGE_TITLE': 'Account',
+    'Account.TAB_PROFILE': 'Profile',
+    'Account.TAB_SECURITY': 'Security',
+    'Account.GROUP_MY_ACCOUNT': 'My account',
+    'Profile.ACCEPT_PRIVACY_LABEL': 'Accept privacy statement',
+    'Profile.ACCEPT_COOKIES_LABEL': 'Accept convenience cookies',
+    'Profile.PRIVACY_STATEMENT_TITLE': 'Privacy statement',
+    'Profile.COOKIES_STATEMENT_TITLE': 'Cookie statement',
+    'Profile.SAVE_BUTTON': 'Save',
+    'Profile.PRIVACY_SECTION_TITLE': 'Privacy and cookies',
+    'Profile.USERNAME_LABEL': 'Username',
+    'Profile.EMAIL_LABEL': 'Email',
+    'Profile.FIRST_NAME_LABEL': 'First name',
+    'Profile.LAST_NAME_LABEL': 'Last name',
+  };
+  const t = (key, fallback) => KEYS[key] ?? fallback ?? key;
+  return {
+    useTranslation: () => ({
+      t,
+      i18n: { exists: (key) => Object.hasOwn(KEYS, key), t },
+    }),
+  };
+});
+
+vi.mock('../src/auth/authApi', () => ({
+  fetchAuthPolicy: vi.fn(),
+  fetchPrivacyStatement: vi.fn(),
+  fetchCookieStatement: vi.fn(),
+  updateUserProfile: vi.fn(),
+}));
+
+vi.mock('../src/components/SecurityComponent', () => ({ SecurityComponent: () => null }));
+vi.mock('../src/components/UserListComponent', () => ({ UserListComponent: () => null }));
+vi.mock('../src/components/UserInviteComponent', () => ({ UserInviteComponent: () => null }));
+vi.mock('../src/components/AccessCodeManager', () => ({ AccessCodeManager: () => null }));
+vi.mock('../src/components/AllowedEmailDomainsManager', () => ({ AllowedEmailDomainsManager: () => null }));
+vi.mock('../src/components/RegistrationMethodsManager', () => ({ RegistrationMethodsManager: () => null }));
+vi.mock('../src/components/AuthFactorRequirementCard', () => ({ AuthFactorRequirementCard: () => null }));
+vi.mock('../src/components/AccessCodeSingleUseToggle', () => ({ AccessCodeSingleUseToggle: () => null }));
+vi.mock('../src/components/QrSignupManager', () => ({ QrSignupManager: () => null }));
+vi.mock('../src/components/QrSignupValidityManager', () => ({ QrSignupValidityManager: () => null }));
+vi.mock('../src/components/SupportRecoveryRequestsTab', () => ({ SupportRecoveryRequestsTab: () => null }));
+vi.mock('../src/components/BulkInviteCsvTab', () => ({ BulkInviteCsvTab: () => null }));
+
+import { AuthContext } from '../src/auth/AuthContext';
+import {
+  fetchCookieStatement,
+  fetchPrivacyStatement,
+  updateUserProfile,
+} from '../src/auth/authApi';
+import { AccountPage } from '../src/pages/AccountPage';
+
+const theme = createTheme();
+const user = {
+  email: 'person@example.com',
+  username: 'person',
+  first_name: 'Pat',
+  last_name: 'Example',
+  accepted_privacy_statement: false,
+  accepted_convenience_cookies: true,
+  is_superuser: false,
+  ui_permissions: {},
+  available_roles: [],
+};
+
+function setViewportWidth(width) {
+  window.matchMedia = vi.fn().mockImplementation((query) => ({
+    matches: query.includes('max-width') ? width <= 900 : width > 900,
+    media: query,
+    onchange: null,
+    addEventListener: vi.fn(),
+    removeEventListener: vi.fn(),
+    addListener: vi.fn(),
+    removeListener: vi.fn(),
+    dispatchEvent: vi.fn(),
+  }));
+}
+
+function renderAccount({ showProfileStatements } = {}) {
+  const login = vi.fn();
+  return {
+    login,
+    ...render(
+      <ThemeProvider theme={theme}>
+        <AuthContext.Provider value={{ user, login, loading: false }}>
+          <MemoryRouter initialEntries={['/account']}>
+            <Routes>
+              <Route
+                path="/account"
+                element={<AccountPage showProfileStatements={showProfileStatements} />}
+              />
+            </Routes>
+          </MemoryRouter>
+        </AuthContext.Provider>
+      </ThemeProvider>,
+    ),
+  };
+}
+
+describe('AccountPage profile statements', () => {
+  beforeEach(() => {
+    setViewportWidth(1280);
+    vi.mocked(fetchPrivacyStatement).mockResolvedValue('Privacy text');
+    vi.mocked(fetchCookieStatement).mockResolvedValue('Cookie text');
+    vi.mocked(updateUserProfile).mockResolvedValue({ ...user, accepted_privacy_statement: true });
+  });
+
+  afterEach(() => {
+    cleanup();
+    vi.clearAllMocks();
+  });
+
+  it('fetches and presents both statement panels when the prop is omitted', async () => {
+    renderAccount();
+
+    expect(await screen.findByText('Privacy statement')).toBeTruthy();
+    expect(screen.getByText('Cookie statement')).toBeTruthy();
+    await waitFor(() => {
+      expect(fetchPrivacyStatement).toHaveBeenCalledOnce();
+      expect(fetchCookieStatement).toHaveBeenCalledOnce();
+    });
+    expect(await screen.findByText('Privacy text')).toBeTruthy();
+    expect(screen.getByText('Cookie text')).toBeTruthy();
+  });
+
+  it('hides statements and skips requests while retaining editable consent submission', async () => {
+    const { login } = renderAccount({ showProfileStatements: false });
+
+    expect(screen.queryByText('Privacy statement')).toBeNull();
+    expect(screen.queryByText('Cookie statement')).toBeNull();
+    expect(fetchPrivacyStatement).not.toHaveBeenCalled();
+    expect(fetchCookieStatement).not.toHaveBeenCalled();
+
+    const privacyConsent = screen.getByRole('checkbox', { name: 'Accept privacy statement' });
+    const cookieConsent = screen.getByRole('checkbox', { name: 'Accept convenience cookies' });
+    expect(privacyConsent.checked).toBe(false);
+    expect(cookieConsent.checked).toBe(true);
+    fireEvent.click(privacyConsent);
+    fireEvent.click(cookieConsent);
+    fireEvent.click(screen.getByRole('button', { name: 'Save' }));
+
+    await waitFor(() => {
+      expect(updateUserProfile).toHaveBeenCalledWith({
+        first_name: 'Pat',
+        last_name: 'Example',
+        accepted_privacy_statement: true,
+        accepted_convenience_cookies: false,
+      });
+    });
+    expect(login).toHaveBeenCalledOnce();
+  });
+});

package/tests/SectionNav.test.jsx

@@ -68,6 +68,17 @@ function renderNav(props = {}, currentTheme = theme) {
   );
 }
 
+function expectListsToContainListItemButtons(lists) {
+  expect(lists.length).toBeGreaterThan(0);
+  lists.forEach((list) => {
+    expect(Array.from(list.children).every((child) => child.tagName === 'LI')).toBe(true);
+    expect(list.querySelectorAll(':scope > li')).toHaveLength(list.children.length);
+    list.querySelectorAll(':scope > li').forEach((item) => {
+      expect(item.querySelectorAll(':scope > .MuiListItemButton-root')).toHaveLength(1);
+    });
+  });
+}
+
 describe('SectionNav', () => {
   afterEach(() => {
     cleanup();
@@ -133,6 +144,35 @@ describe('SectionNav', () => {
     expect(container.querySelectorAll('.MuiPaper-root')).toHaveLength(groups.length);
   });
 
+  it('renders overview and grouped controls inside list items on desktop and mobile', () => {
+    const overviewItem = { label: 'Overview' };
+    const { container } = renderNav({ overviewItem });
+
+    expectListsToContainListItemButtons(container.querySelectorAll('nav ul'));
+    expect(container.querySelectorAll('nav ul')).toHaveLength(groups.length + 1);
+
+    cleanup();
+    renderNav({ mode: 'mobile', overviewItem, open: true });
+    const dialog = screen.getByRole('dialog', { name: 'Switch section' });
+    const lists = dialog.querySelectorAll('ul');
+
+    expectListsToContainListItemButtons(lists);
+    expect(lists).toHaveLength(groups.length + 1);
+  });
+
+  it('passes null for overview selection and closes the mobile drawer', async () => {
+    const onSelect = vi.fn();
+    renderNav({ mode: 'mobile', onSelect, overviewItem: { label: 'Overview' } });
+
+    fireEvent.click(screen.getByRole('button', { name: /Section Profile/i }));
+    expect(screen.getByRole('dialog', { name: 'Switch section' })).toBeTruthy();
+    fireEvent.click(screen.getByRole('button', { name: 'Overview' }));
+
+    expect(onSelect).toHaveBeenCalledOnce();
+    expect(onSelect).toHaveBeenCalledWith(null);
+    await waitFor(() => expect(screen.queryByRole('dialog', { name: 'Switch section' })).toBeNull());
+  });
+
   it('shows the remembered secondary line only on its unselected item', () => {
     renderNav({ activeKey: 'profile', rememberedKey: 'security' });
     expect(screen.getByText('Last opened')).toBeTruthy();

package/work-orders/UCM-AUTH-12.md

@@ -0,0 +1,98 @@
+# UCM-AUTH-12: Optional profile statement text on the account page
+
+# A. Envelope — operator-approved scope
+
+## Goal and expected outcome
+
+Expose `AccountPage.showProfileStatements` so an app without privacy/cookie statement
+endpoints can suppress the explanatory statement panels and their requests. The default
+is `true`, preserving every existing consumer's behavior. With `false`, the account profile
+still renders and submits both existing consent fields.
+
+The operator explicitly approved this switch, its release and the innoservice pin bump on
+2026-10-13. innoservice CI38387014900 records privacy/cookie 404s; auth policy returns 200.
+
+## Scope and non-goals
+
+- Add the optional prop and pass it to the existing ProfileComponent statement switch.
+- Publish a minor release 3.13.0; innoservice consumes it under INNO-FIX-13.
+- Do not change consent defaults, payloads, validation, permissions, authentication,
+  account navigation, statement fetching implementation, theme tokens or other consumers.
+- Do not fix UCM-SHELL-8 or invent statement endpoints/content.
+- No new visual design or prototype; this config uses the existing ProfileComponent surface.
+
+## Tier, risk and required tests
+
+Tier 3: source inside shared-core on an account surface. Compatibility rests on default true.
+Tests to write: render the real AccountPage and ProfileComponent; omission of the new prop
+fetches both statements and presents the existing panels; false performs neither request and
+hides the panels, while both consent controls remain editable and their values reach the
+existing updateUserProfile submission. Keep the existing account-navigation tests.
+
+# B. Implementation map — ADDRESSED TO THE IMPLEMENTER
+
+## Target and ownership
+
+Target: `C:/Users/Micha Bigler/Documents/webapps/ui-core-micha`.
+Native bootstrap retains workspace-root cwd; use explicit absolute paths and workdirs.
+You are not alone in the workspace. Own only:
+- `src/pages/AccountPage.jsx`
+- new `tests/AccountPage.profileStatements.test.jsx`
+
+## Context package
+
+`src/pages/AccountPage.jsx:39` exports named AccountPage with destructured optional props.
+Its profile branch near line228 renders ProfileComponent with showName/showPrivacy/showCookies.
+Its existing handleProfileSubmit calls updateUserProfile(payload), then AuthContext.login(updated).
+`src/components/ProfileComponent.jsx:23` exports named ProfileComponent; showStatements defaults
+true, independently of showPrivacy/showCookies. Its statement-loading effect at83 returns before
+either fetch when showStatements is false. Panels at255 are also controlled by showStatements.
+Consent controls at230/242 and payload at130/133 depend only on showPrivacy/showCookies.
+Use that established switch; leave this component untouched.
+
+Read only these targets plus `tests/AccountPage.test.jsx` for theme/router/AuthContext setup,
+and `src/auth/authApi.jsx` for the four API export names if necessary. Do not explore broadly.
+The existing navigation test mocks ProfileComponent, so it cannot prove the no-request and
+consent invariant: write a separate test file rendering both real components. Stub network API
+functions and unrelated account children only. Relevant real accessible labels are translation
+keys Profile.ACCEPT_PRIVACY_LABEL, Profile.ACCEPT_COOKIES_LABEL, Profile.PRIVACY_STATEMENT_TITLE,
+Profile.COOKIES_STATEMENT_TITLE and Profile.SAVE_BUTTON.
+Use the suite's established translation seam; never mock AccountPage/ProfileComponent under test.
+
+## Preamble
+
+> This committed WO is the COMPLETE spec. You are the initial implementer, not the reviewer.
+> Preserve other edits. Edit only the two owned source/test paths using explicit UTF-8 I/O.
+> Do not edit dependencies, lockfiles, package/version/changelog/register/README/governance,
+> settings, environment, other repos or memory. Never read .env or dump settings/environment.
+> No installs, package-manager commands, containers, git operations, self-review or subagents.
+> Write the required tests and run your own new file ONCE with the existing Node/Vitest runtime,
+> maxWorkers=2; no affected/full suite, build or app startup. If unavailable, report the obstacle.
+> The orchestrator's tests and separate reviews are the acceptance gate. Leave uncommitted.
+> Start PLAN, emit PROGRESS before relevant actions without silence over two minutes, then
+> exactly one final RESULT: DONE or RESULT: BLOCKED.
+
+# C. Orchestrator only — NOT ADDRESSED TO THE IMPLEMENTER
+
+> IMPLEMENTER STOP HERE. You ARE the initial implementation instance. No steps below belong to you.
+
+Gate #1: operator explicitly approved the exact API/default, retained consents, release and pin
+bump in the innoservice orchestration chat on 2026-10-13. Native plain worker requested
+codex/gpt-6-luna, fresh context, full committed WO inline. Record accepted ID and actual metadata;
+effective provider/model stays unverified when the API does not expose it. No protection-parity claim.
+
+Parent owns version/changelog/README/register and pnpm state. Independent four lenses plus UI
+and security concurrently, full scoped context, CLI read-only without bypass. Parent fixes findings.
+Scoped gate: new real-component tests, existing AccountPage navigation and affected auth tests.
+Publish workflow on main already runs build/full tests; shared-core ripple justifies that existing
+release suite. Do not dispatch publish manually; normal reviewed main push triggers it. Check
+publish job success before app pin. Minor 3.13.0 is additive; read exact release diff before app bump.
+Final core row includes deduplicated review totals and test results; second register commit before
+one main push. innoservice AccountPage/WelcomePage statements false and capture evidence remain
+INNO-FIX-13; keep existing consents, request diagnostics and capture checks intact.
+
+Accepted native implementer: `/root/kit_account_statements`, explicit requested gpt-6-luna,
+high reasoning, fresh context, complete WO inline. Effective native provider/model metadata
+was not exposed and remains unverified. Source/test edits only; the one permitted author test
+attempt failed before collection with temporary-file EPERM (zero tests). Parent runs the
+authoritative scoped gate through the normal runtime approval path. No author review or git.

package/work-orders/UCM-SHELL-8.md

@@ -0,0 +1,113 @@
+# UCM-SHELL-8: Valid SectionNav list items
+
+# A. Envelope — operator-approved scope
+
+## Goal and expected outcome
+
+SectionNav navigation entries are genuine list items containing the existing buttons.
+The account capture in innoservice reports three serious axe list violations at 1280 px;
+these remain in ui-core-micha 3.13.0. The correction removes their structural cause.
+
+## Scope and non-goals
+
+- Correct grouped and optional overview entries in SectionNav's shared list renderer.
+- Keep selection, aria-current, labels, remembered entry, keyboard operation, callbacks,
+  controlled/uncontrolled drawer behavior and appearance unchanged.
+- Release the correction as patch 3.13.1 and update innoservice's exact package pin.
+- No navigation redesign, new text, token delta, authentication, permissions, data contract,
+  other component, CI configuration or dependency changes beyond that release/pin.
+- No new visual design or prototype: retain the existing presentation.
+
+## Tier, risk and required tests to write
+
+Tier 3: shared-core source with a rendered DOM correction used by consumers.
+Risk: wrapper defaults could alter spacing or interrupt existing button interaction.
+Write focused assertions that every grouped and overview list has li children containing
+the existing button controls, on desktop and inside the mobile drawer. Preserve existing
+selection and drawer tests; prove overview selection still passes null and closes the drawer.
+
+# B. Implementation map — ADDRESSED TO THE IMPLEMENTER
+
+## Target and ownership
+
+Target: `C:/Users/Micha Bigler/Documents/webapps/ui-core-micha`.
+Native bootstrap retains workspace-root cwd; use absolute paths and explicit workdirs.
+You are not alone in the codebase; preserve other agents' changes. Own only:
+- `src/layout/SectionNav.jsx`
+- `tests/SectionNav.test.jsx`
+
+## Context package
+
+`src/layout/SectionNav.jsx:120`, SectionNavList, is shared by the desktop nav and mobile
+drawer. The overview List currently directly contains ListItemButton; grouped Lists at
+159 map item keys to direct ListItemButton children. MUI List defaults to ul and the
+button defaults to div. Correct list containment while preserving the interactive button.
+The overview handler passes null; grouped handlers pass item.key. Selected buttons carry
+aria-current=page; remembered secondary text is shown only on its unselected entry.
+Keep exported sx constants, drawer state handlers, prop defaults and group label IDs.
+Use existing MUI primitives; prevent wrapper padding from changing the presentation.
+
+`tests/SectionNav.test.jsx` renders the real named SectionNav with ThemeProvider and a
+translation mock. Existing labels: Profile, Security, Users, Invite, Support, Notifications;
+optional Overview; trigger accessible name matches /Section Profile/i; drawer title
+Switch section. Existing tests cover selection, remembered text, controlled/uncontrolled
+drawer, theme tokens and grid. Extend this file without mocking SectionNav or changing
+existing tests to accept weaker behavior. Work from these two files, no broad exploration.
+
+## Preamble and progress contract
+
+> This committed WO is the COMPLETE spec. You are the initial implementer, not the reviewer.
+> Edit only the owned source/test paths using explicit UTF-8 I/O. Preserve other changes.
+> Do not edit dependencies, lockfiles, package/version/changelog/register/README/governance,
+> settings, environment, other repos or memory. Never read .env or dump environment/settings.
+> Your tools are for editing source/test files and running the tests you wrote, nothing else.
+> No installs, package-manager commands, containers, git operations, self-review or subagents.
+> Run your newly written SectionNav cases ONCE with the existing Node/Vitest runtime,
+> maxWorkers=2, selected by test names; no affected/full suite, build or app startup.
+> If blocked, report it rather than changing repo state. Leave all changes uncommitted.
+> The orchestrator's tests and independent reviews are the acceptance gate, not your run.
+> Start PLAN, emit PROGRESS before relevant actions with no silence over two minutes,
+> then exactly one final RESULT: DONE or RESULT: BLOCKED.
+
+# C. Orchestrator only — NOT ADDRESSED TO THE IMPLEMENTER
+
+> IMPLEMENTER STOP HERE. You ARE the initial implementation instance. No steps below belong to you.
+
+Gate #1: operator explicitly approved this exact structural correction, preserved behavior
+and appearance, tests/review, release and innoservice pin bump on 2026-10-13.
+No source approval was inferred from the earlier registration or clarification question.
+
+Dispatch: fresh native plain worker, requested codex/gpt-6-luna, full WO inline; inherited
+cwd is workspace root, target is the absolute core repo above. Record accepted identity
+and only exposed effective metadata. Assigned ownership is not technical containment.
+Parent owns repo state, package version, changelog, README/register and release/pin.
+
+Independent envelope/regression/duplication/tests lenses plus UI run concurrently on the
+same frozen diff via fresh read-only codex/gpt-6-luna processes. Security reviewer is not
+required: no auth/security behavior changes. Parent also checks exposure/permission parity.
+Parent runs SectionNav and both existing AccountPage test files, then build. Existing main
+publish workflow supplies the full shared-core regression suite and publishing evidence;
+normal reviewed main push, no manual publish dispatch. Confirm successful publication of
+3.13.1 before innoservice exact pin and lockfile update. Keep all app capture/axe checks.
+Fresh app capture at 375/1280 must verify navigation and absence of the three list violations.
+Finalize register with named reviews, deduplicated dispositions and actual test/release proof.
+
+Accepted native implementer: `/root/kit_sectionnav`, explicit requested gpt-6-luna, high
+reasoning, fresh context. Effective native provider/model metadata was not exposed and
+remains unverified. Only the two assigned files changed; no author git/review/repo-state
+operations. Author's single permitted test run failed before collection with temporary-file
+EPERM (zero tests). Parent runs the authoritative gate through the normal runtime path.
+
+Core acceptance: five fresh concurrent CLI reviews (envelope, regression, duplication,
+tests, UI), all exit 0, banners confirm codex/gpt-6-luna, provider openai, read-only.
+Deduplicated disposition: 1 raised, 0 accepted, worst accepted none. Tests lens R1 proposed
+proving the MUI implementation identity against a fabricated class-bearing stub. Rejected:
+the structural assertion fails against the actual pre-change direct div children, existing
+selection/theme/drawer tests retain their behavior checks, and the source still directly
+imports and renders the real MUI ListItemButton. No behavior or identity abstraction is added.
+Other lenses report no findings. Parent targeted pass confirms callbacks/permission filtering,
+labels and selected/remembered state unchanged; wrappers use disablePadding.
+Parent gate: 21 tests in SectionNav.test.jsx, AccountPage.test.jsx and
+AccountPage.profileStatements.test.jsx passed with maxWorkers=2; TypeScript build exit 0.
+Publish workflow's full suite is justified by shared-core consumer ripple. App pin and fresh
+consumer capture remain pending after the reviewed core source/release lands.