@micha.bigler/ui-core-micha 3.13.0 → 3.13.2

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 3.13.2 - UCM-AUTH-13
+
+`ProfileComponent` preserves edited names and consent values when the same person's
+context data refreshes. Untouched fields still receive server updates. Account changes
+and logout reset the form, keeping edits and consent isolated between people.
+
+## 3.13.1 - UCM-SHELL-8
+
+`SectionNav` now renders grouped and overview navigation buttons inside list items on
+desktop and in the mobile drawer. Selection, callbacks, labels and spacing are preserved.
+
 ## 3.13.0 - UCM-AUTH-12
 
 `AccountPage` accepts `showProfileStatements` (default `true`). Set it to `false` in consumers

package/WORK_ORDERS.md

@@ -28,8 +28,9 @@ prefixed ID; never reuse a bare flat number across workstreams.
 
 | ID | Titel | Beschreibung | Datum | Status | Commit(s) | Notiz |
 |---|---|---|---|---|---|---|
-| UCM-AUTH-12 | [Optional account profile statement text](work-orders/UCM-AUTH-12.md) | AccountPage showProfileStatements defaults true; false suppresses statement panels/requests while preserving both consent controls and their payload. Minor release 3.13.0, consumed by innoservice INNO-FIX-13. | 2026-10-13 | in-review | 97b7d83 | Tier 3 (shared-core account surface). Gate #1 explicitly approved in the innoservice Codex chat on 2026-10-13, including release and app pin bump. Separate configured Luna implementation and independent reviews; existing default and consent behavior are invariants.  review: codex/gpt-6-luna · lenses: envelope, regression, duplication, tests, ui, security · 0 raised · 0 accepted · worst accepted: none. Parent scoped tests: AccountPage.profileStatements.test.jsx + AccountPage.test.jsx, 6 passed, correct kit cwd, maxWorkers2. Native author attempt EPERM before collection; parent gate green. Reviewed additive API/default and package release metadata; main push triggers the existing release build/suite/publish. Publication and innoservice capture remain pending. |
-| UCM-SHELL-8 | SectionNav lists contain direct button children | innoservice INNO-FIX-11 retained three serious axe list violations in account-admin-populated at 1280 px: ul[aria-labelledby="_r_b_-0"], ul[aria-labelledby="_r_b_-1"], ul[aria-labelledby="_r_b_-2"]. Installed ui-core-micha 3.12.0 AccountPage uses src/layout/SectionNav.jsx:132-159, where ListItemButton divs sit directly under List/ul. | 2026-10-13 | planned | | Source-attributed from CI38387014900, candidate9937adb, artifact e2e-capture-38387014900-1; full node evidence in innoservice/work-orders/assets/INNO-FIX-11-axe-nodes.json. Registered as expressly required by INNO-FIX-11 Part A; no kit source/token fix or implementation approval implied. Registration itself: Tier 1, self-checked identifiers/source/evidence; tests none (metadata only). Future shared-core implementation is Tier 3 and needs its own approved scope. |
+| UCM-AUTH-13 | [Preserve profile edits during refresh](work-orders/UCM-AUTH-13.md) | Keep unsaved names and consent for the same person; reset at account boundaries. Patch release and Spesix consumption approved. | 2026-10-14 | in-review | ab85c60 | Tier 3. Gate #1 approved by the operator in the Spesix orchestration chat on 2026-10-14. Fresh native configured codex/gpt-6-luna/high author `/root/ucm_auth13_author`; workspace-root cwd bootstrap, absolute target paths; effective provider/cwd/sandbox not exposed. Foreign scratchpad excluded. review: codex/gpt-6-luna · lenses: envelope,regression,duplication,tests,ui,security · 2 raised · 0 accepted · worst accepted: none. Parent 11 focused tests and TypeScript build passed. Patch 3.13.2 release and Spesix consumption pending; detailed dispositions in WO C. |
+| UCM-AUTH-12 | [Optional account profile statement text](work-orders/UCM-AUTH-12.md) | AccountPage showProfileStatements defaults true; false suppresses statement panels/requests while preserving both consent controls and their payload. Minor release 3.13.0, consumed by innoservice INNO-FIX-13. | 2026-10-13 | done | 97b7d83 | Tier 3 (shared-core account surface). Gate #1 explicitly approved in the innoservice Codex chat on 2026-10-13, including release and app pin bump. Separate configured Luna implementation and independent reviews; existing default and consent behavior are invariants.  review: codex/gpt-6-luna · lenses: envelope, regression, duplication, tests, ui, security · 0 raised · 0 accepted · worst accepted: none. Parent scoped tests: AccountPage.profileStatements.test.jsx + AccountPage.test.jsx, 6 passed, correct kit cwd, maxWorkers2. Native author attempt EPERM before collection; parent gate green. Reviewed additive API/default and package release metadata; main push triggers the existing release build/suite/publish. Released 3.13.0: CI38422682968 build, release suite and npm Trusted Publishing all succeeded. App consumption/capture remains tracked under INNO-FIX-13. |
+| UCM-SHELL-8 | SectionNav lists contain direct button children | Grouped and overview entries need genuine list items containing the existing navigation buttons, preserving selection, drawer behavior and presentation. | 2026-10-13 | done | `d399f51` | Tier 3. Gate #1 approved by the operator on 2026-10-13: structural correction, tests/review, patch release and innoservice pin bump. Full scope and context: [work-orders/UCM-SHELL-8.md](work-orders/UCM-SHELL-8.md). Original CI38387014900/source9937adb evidence remains in innoservice/work-orders/assets/INNO-FIX-11-axe-nodes.json; CI38425506007/sourceebc35e1 reproduces the three account list violations on 3.13.0, recorded in INNO-FIX-11-candidate-b-axe-nodes.json. Initial native author /root/kit_sectionnav requested codex/gpt-6-luna; effective native metadata unexposed. Source and two focused test cases delivered; author run EPERM before collection, zero tests. Parent tests and independent review pending. review: codex/gpt-6-luna · lenses: envelope, regression, duplication, tests + UI · 1 raised · 0 accepted · worst accepted: none. Disposition in WO Part C: fabricated class-stub identity demand rejected against the real revert failure and preserved existing behavior checks. Parent 21 scoped tests passed (maxWorkers=2), TypeScript build exit 0. Core source accepted; publication, app pin and fresh consumer capture pending. Closing proof:3.13.1 published CI38435441867 (744tests89files/build/npm success); app exact pin/sourcec527918, CI38444366349 account375/1280 both axe0,console/network0,rubric22yes and parent actual-image inspection; all three list violations gone. No source change since reviewed d399f51. |
 | UCM-THEME-17 | Decide a less compressed baseline type scale | Design round (design-language process): inventory, instrument with 2-3 candidate scales next to today's baseline and MUI on real screens (hram, a survey site, jg-ferien, kerzenziehen), value rounds, frozen sheet. Measured 2026-10-04: page/card/section titles differ by 1-3 px, hierarchy rests on weight alone. Full order [`work-orders/UCM-THEME-17.md`](work-orders/UCM-THEME-17.md) | 2026-10-04 | done | `68dfc6a`, `998e36c`, `cb9dd89`, `c452224` | Tier 2 (document only) · operator decision 2026-10-04: baseline finding, not per-app overrides · implementation order follows the freeze · survey_app SVA-THEME-1 typography revert held until then · **frozen 2026-10-04** after two value rounds: candidate B, mobile h4 23, h1-h3 36/32/28; value source [`docs/TYPE-SCALE.md`](docs/TYPE-SCALE.md) · review: none, document order, the operator freeze is the gate · implementation UCM-THEME-18 |
 | UCM-THEME-18 | Ship the frozen baseline type scale | `tokens.js` typography per `docs/TYPE-SCALE.md`: h1-h3 36/32/28, h4 24 (23 below `sm`), h5 20, subtitle1 13; light fixture typography entries; minor release 3.12.0. Full order [`work-orders/UCM-THEME-18.md`](work-orders/UCM-THEME-18.md) | 2026-10-04 | 5be83d5 | | Tier 3 (shared-core) · reviewer + ui_reviewer · downstream per-app orders (h5 page titles -> h4, per-level weight overrides) written after the release - 2026-10-04: Codex implemented (gpt-6-luna; probe of stale 2026-10-03 record succeeded, available) - orchestrator fixed review findings - review: codex/gpt-6-luna - lenses: envelope,regression,duplication,tests + ui_review - 3 raised - 2 accepted - worst accepted: defect (h4 mobile key now follows an app-overridden sm, test added; completeness test strengthened; rejected: breakpointDownQuery vs theme.breakpoints.down, no theme exists at token time) - light fixture diff limited to typography entries - no rendered side-by-side (no prototype; values asserted from the resolved theme in light and dark) - release 3.12.0 |
 | UCM-I18N-5 | [User-list pagination range text is hard-coded English](work-orders/UCM-I18N-5.md) | `UserListComponent`'s `TablePagination` sets `labelRowsPerPage` but no `labelDisplayedRows`, so German shows "1–4 of 4". | 2026-10-01 | done | 6b9d557 | Found in jg-ferien's rendered check 2026-10-01. Follows `UCM-I18N-4`. Tier 3. Done = released AND jg-ferien pin bumped. Envelope written 2026-10-01; operator: hand to the jg Paket-4 session. Implementation map filled 2026-10-02 (`a732025`): the translation bundle carries FOUR locales (de/fr/en/sw), not three — confirmed by reading `authTranslations.ts` directly; proposed two keys (exact-count + "more than" form) with a best-effort, not native-verified, Swahili wording. Implemented by codex/gpt-5.6-luna exactly per the map: `labelDisplayedRows` resolves `UserList.DISPLAYED_ROWS`/`UserList.DISPLAYED_ROWS_MORE_THAN` through `t()`, both keys added in all four locales. review: codex/gpt-5.6-luna · lenses: envelope,regression,duplication,tests,ui_reviewer (one concurrent batch, diff inline) · 4 raised · 3 accepted (deduplicated) · worst accepted: defect. Accepted: the rendered English test would still pass against a reverted implementation, since the EN wording was deliberately made identical to MUI's own hardcoded default — added a second test swapping in a distinctive marker string for just that key, proving the render genuinely resolves through i18next, not MUI's fallback; `authTranslations.test.js`'s new key-parity check only asserted non-empty strings, not that each locale actually carries the `{{from}}`/`{{to}}`/`{{count}}` placeholders the others do — strengthened with an explicit per-locale placeholder check; self-identified (corroborated by the `tests` lens's own closing remark) that the `count === -1` ("more than") branch can never be reached through a render of `UserListComponent` itself (its own `count` prop is always a real array length) — extracted the inline callback into an exported, directly unit-tested `formatDisplayedRowsLabel(t)` rather than leaving it permanently untested dead code. Rejected: `regression`'s claim that hard-coding `labelDisplayedRows` "overrides any consuming app's MUI theme customisation" — speculative, no actual consumer override exists (same explicit-prop design as `labelRowsPerPage` since `UCM-I18N-4`), and the reviewer's own repo search found zero consumer snapshots/assertions relying on the old English text. `envelope`'s "release + pin bump missing from the diff" was correct but not a code defect — addressed by the remaining steps below, not a fix to the reviewed diff. `duplication`: 0 findings. `ui_reviewer`: 0 blocking findings; confirmed placeholder consistency across all 8 strings; Swahili wording flagged as advisory-only ("structurally plausible to a non-native reviewer, native-speaker verification advisable" — not re-asked of a native speaker here, recorded as open). Tests: 37/37 green (`userScreenTranslations.test.jsx`, `authTranslations.test.js`, `UserListComponent.test.jsx`). Released as `3.11.1` (patch — continues `UCM-I18N-4`'s i18n-gap category, not a new capability area), commit `6b9d557`; npm Trusted Publishing confirmed via the Actions job log (not a registry re-query — provenance publishes can lag), tarball `@micha.bigler/ui-core-micha@3.11.1`. jg-ferien's pin bumped 3.7.0 -> 3.11.1 same day, closed as jg's own `JG-DEPS-3` (`2c1d6e3`) — see that repo's `WORK_ORDERS.md` for the empirical safety checks (status-colour palette diff, `UserListComponent`-unused confirmation, full-suite run) this multi-version jump required. |

package/dist/components/ProfileComponent.js

@@ -1,6 +1,6 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // src/components/ProfileComponent.jsx
-import React, { useEffect, useState, useContext } from 'react';
+import React, { useEffect, useState, useContext, useRef } from 'react';
 import { Box, Stack, TextField, FormControlLabel, Checkbox, Button, CircularProgress, Alert, Typography, Accordion, AccordionSummary, AccordionDetails, } from '@mui/material';
 import { useTranslation } from 'react-i18next';
 // WICHTIG: Importiere den Context, um die bereits geladenen Daten zu nutzen
@@ -22,20 +22,43 @@ export function ProfileComponent({ onSubmit, submitText, showName = true, showPr
     const [lastName, setLastName] = useState('');
     const [acceptedPrivacy, setAcceptedPrivacy] = useState(false);
     const [acceptedCookies, setAcceptedCookies] = useState(false);
+    const previousUserIdentity = useRef(Symbol('uninitialized'));
+    const editedFields = useRef(new Set());
     const [privacyStatement, setPrivacyStatement] = useState(privacyStatementText || '');
     const [cookieStatement, setCookieStatement] = useState(cookieStatementText || '');
     const [loadingPrivacyStatement, setLoadingPrivacyStatement] = useState(false);
     const [loadingCookieStatement, setLoadingCookieStatement] = useState(false);
-    // Synchronisiere Formular-Daten, sobald der User aus dem Context da ist
+    // Refresh server values for untouched fields, while keeping edits for this identity.
     useEffect(() => {
-        var _a, _b, _c, _d;
+        var _a, _b, _c, _d, _e, _f, _g;
+        const userIdentity = user
+            ? ((_c = (_b = (_a = user.id) !== null && _a !== void 0 ? _a : user.email) !== null && _b !== void 0 ? _b : user.username) !== null && _c !== void 0 ? _c : null)
+            : null;
+        if (previousUserIdentity.current !== userIdentity) {
+            previousUserIdentity.current = userIdentity;
+            editedFields.current = new Set();
+        }
         if (user) {
-            setUsername((_a = user.username) !== null && _a !== void 0 ? _a : '');
-            setEmail((_b = user.email) !== null && _b !== void 0 ? _b : '');
-            setFirstName((_c = user.first_name) !== null && _c !== void 0 ? _c : '');
-            setLastName((_d = user.last_name) !== null && _d !== void 0 ? _d : '');
-            setAcceptedPrivacy(Boolean(user.accepted_privacy_statement));
-            setAcceptedCookies(Boolean(user.accepted_convenience_cookies));
+            setUsername((_d = user.username) !== null && _d !== void 0 ? _d : '');
+            setEmail((_e = user.email) !== null && _e !== void 0 ? _e : '');
+            if (!editedFields.current.has('firstName'))
+                setFirstName((_f = user.first_name) !== null && _f !== void 0 ? _f : '');
+            if (!editedFields.current.has('lastName'))
+                setLastName((_g = user.last_name) !== null && _g !== void 0 ? _g : '');
+            if (!editedFields.current.has('acceptedPrivacy')) {
+                setAcceptedPrivacy(Boolean(user.accepted_privacy_statement));
+            }
+            if (!editedFields.current.has('acceptedCookies')) {
+                setAcceptedCookies(Boolean(user.accepted_convenience_cookies));
+            }
+        }
+        else {
+            setUsername('');
+            setEmail('');
+            setFirstName('');
+            setLastName('');
+            setAcceptedPrivacy(false);
+            setAcceptedCookies(false);
         }
     }, [user]);
     useEffect(() => {
@@ -129,5 +152,17 @@ export function ProfileComponent({ onSubmit, submitText, showName = true, showPr
     }
     const submitLabel = submitText || t('Profile.SAVE_BUTTON');
     const submitLabelLoading = t('Profile.SAVE_BUTTON_LOADING');
-    return (_jsxs(Box, { component: "form", onSubmit: handleSubmit, sx: { maxWidth: 600, display: 'flex', flexDirection: 'column', gap: 2 }, children: [errorKey && (_jsx(Alert, { severity: "error", children: errorKey })), successKey && (_jsx(Alert, { severity: "success", children: t(successKey) })), _jsxs(Stack, { spacing: 2, children: [_jsx(TextField, { label: t('Profile.USERNAME_LABEL'), value: username, fullWidth: true, disabled: true }), _jsx(TextField, { label: t('Auth.EMAIL_LABEL'), type: "email", value: email, fullWidth: true, disabled: true })] }), showName && (_jsxs(Stack, { spacing: 2, direction: { xs: 'column', sm: 'row' }, children: [_jsx(TextField, { label: t('Profile.FIRST_NAME_LABEL'), value: firstName, onChange: (e) => setFirstName(e.target.value), fullWidth: true }), _jsx(TextField, { label: t('Profile.LAST_NAME_LABEL'), value: lastName, onChange: (e) => setLastName(e.target.value), fullWidth: true })] })), (showPrivacy || showCookies) && (_jsxs(Box, { sx: { mt: 1 }, children: [_jsx(Typography, { variant: "subtitle1", gutterBottom: true, children: t('Profile.PRIVACY_SECTION_TITLE') }), _jsxs(Stack, { spacing: 1, children: [showPrivacy && (_jsx(FormControlLabel, { control: _jsx(Checkbox, { checked: acceptedPrivacy, onChange: (e) => setAcceptedPrivacy(e.target.checked) }), label: t('Profile.ACCEPT_PRIVACY_LABEL') })), showCookies && (_jsx(FormControlLabel, { control: _jsx(Checkbox, { checked: acceptedCookies, onChange: (e) => setAcceptedCookies(e.target.checked) }), label: t('Profile.ACCEPT_COOKIES_LABEL') }))] }), showStatements && (_jsxs(Stack, { spacing: 1.25, sx: { mt: 1.5 }, children: [showPrivacy && (_jsxs(Accordion, { disableGutters: true, children: [_jsx(AccordionSummary, { children: _jsx(Typography, { variant: "body2", fontWeight: 600, children: t('Profile.PRIVACY_STATEMENT_TITLE', 'Privacy statement') }) }), _jsx(AccordionDetails, { children: loadingPrivacyStatement ? (_jsx(Typography, { variant: "body2", color: "text.secondary", children: t('Profile.STATEMENT_LOADING', 'Loading statement...') })) : (_jsx(Typography, { variant: "body2", sx: { whiteSpace: 'pre-wrap' }, children: privacyStatement || t('Profile.PRIVACY_STATEMENT_EMPTY', 'Privacy statement is currently unavailable.') })) })] })), showCookies && (_jsxs(Accordion, { disableGutters: true, children: [_jsx(AccordionSummary, { children: _jsx(Typography, { variant: "body2", fontWeight: 600, children: t('Profile.COOKIES_STATEMENT_TITLE', 'Cookie statement') }) }), _jsx(AccordionDetails, { children: loadingCookieStatement ? (_jsx(Typography, { variant: "body2", color: "text.secondary", children: t('Profile.STATEMENT_LOADING', 'Loading statement...') })) : (_jsx(Typography, { variant: "body2", sx: { whiteSpace: 'pre-wrap' }, children: cookieStatement || t('Profile.COOKIES_STATEMENT_EMPTY', 'Cookie statement is currently unavailable.') })) })] }))] }))] })), _jsx(Box, { sx: { mt: 2 }, children: _jsx(Button, { type: "submit", variant: "contained", disabled: saving, children: saving ? submitLabelLoading : submitLabel }) })] }));
+    return (_jsxs(Box, { component: "form", onSubmit: handleSubmit, sx: { maxWidth: 600, display: 'flex', flexDirection: 'column', gap: 2 }, children: [errorKey && (_jsx(Alert, { severity: "error", children: errorKey })), successKey && (_jsx(Alert, { severity: "success", children: t(successKey) })), _jsxs(Stack, { spacing: 2, children: [_jsx(TextField, { label: t('Profile.USERNAME_LABEL'), value: username, fullWidth: true, disabled: true }), _jsx(TextField, { label: t('Auth.EMAIL_LABEL'), type: "email", value: email, fullWidth: true, disabled: true })] }), showName && (_jsxs(Stack, { spacing: 2, direction: { xs: 'column', sm: 'row' }, children: [_jsx(TextField, { label: t('Profile.FIRST_NAME_LABEL'), value: firstName, onChange: (e) => {
+                            editedFields.current.add('firstName');
+                            setFirstName(e.target.value);
+                        }, fullWidth: true }), _jsx(TextField, { label: t('Profile.LAST_NAME_LABEL'), value: lastName, onChange: (e) => {
+                            editedFields.current.add('lastName');
+                            setLastName(e.target.value);
+                        }, fullWidth: true })] })), (showPrivacy || showCookies) && (_jsxs(Box, { sx: { mt: 1 }, children: [_jsx(Typography, { variant: "subtitle1", gutterBottom: true, children: t('Profile.PRIVACY_SECTION_TITLE') }), _jsxs(Stack, { spacing: 1, children: [showPrivacy && (_jsx(FormControlLabel, { control: _jsx(Checkbox, { checked: acceptedPrivacy, onChange: (e) => {
+                                        editedFields.current.add('acceptedPrivacy');
+                                        setAcceptedPrivacy(e.target.checked);
+                                    } }), label: t('Profile.ACCEPT_PRIVACY_LABEL') })), showCookies && (_jsx(FormControlLabel, { control: _jsx(Checkbox, { checked: acceptedCookies, onChange: (e) => {
+                                        editedFields.current.add('acceptedCookies');
+                                        setAcceptedCookies(e.target.checked);
+                                    } }), label: t('Profile.ACCEPT_COOKIES_LABEL') }))] }), showStatements && (_jsxs(Stack, { spacing: 1.25, sx: { mt: 1.5 }, children: [showPrivacy && (_jsxs(Accordion, { disableGutters: true, children: [_jsx(AccordionSummary, { children: _jsx(Typography, { variant: "body2", fontWeight: 600, children: t('Profile.PRIVACY_STATEMENT_TITLE', 'Privacy statement') }) }), _jsx(AccordionDetails, { children: loadingPrivacyStatement ? (_jsx(Typography, { variant: "body2", color: "text.secondary", children: t('Profile.STATEMENT_LOADING', 'Loading statement...') })) : (_jsx(Typography, { variant: "body2", sx: { whiteSpace: 'pre-wrap' }, children: privacyStatement || t('Profile.PRIVACY_STATEMENT_EMPTY', 'Privacy statement is currently unavailable.') })) })] })), showCookies && (_jsxs(Accordion, { disableGutters: true, children: [_jsx(AccordionSummary, { children: _jsx(Typography, { variant: "body2", fontWeight: 600, children: t('Profile.COOKIES_STATEMENT_TITLE', 'Cookie statement') }) }), _jsx(AccordionDetails, { children: loadingCookieStatement ? (_jsx(Typography, { variant: "body2", color: "text.secondary", children: t('Profile.STATEMENT_LOADING', 'Loading statement...') })) : (_jsx(Typography, { variant: "body2", sx: { whiteSpace: 'pre-wrap' }, children: cookieStatement || t('Profile.COOKIES_STATEMENT_EMPTY', 'Cookie statement is currently unavailable.') })) })] }))] }))] })), _jsx(Box, { sx: { mt: 2 }, children: _jsx(Button, { type: "submit", variant: "contained", disabled: saving, children: saving ? submitLabelLoading : submitLabel }) })] }));
 }

package/dist/layout/SectionNav.js

@@ -1,7 +1,7 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { useId, useState } from 'react';
 import KeyboardArrowDownIcon from '@mui/icons-material/KeyboardArrowDown';
-import { Box, ButtonBase, Drawer, List, ListItemButton, ListItemText, Paper, Stack, Typography, } from '@mui/material';
+import { Box, ButtonBase, Drawer, List, ListItem, ListItemButton, ListItemText, Paper, Stack, Typography, } from '@mui/material';
 import { useTheme } from '@mui/material/styles';
 import { useTranslation } from 'react-i18next';
 const defaultZIndex = (theme) => theme.zIndex.drawer + 3;
@@ -82,11 +82,11 @@ const SECTION_NAV_DRAWER_SCROLL_SX = {
 };
 function SectionNavList({ groups, activeKey, rememberedKey, overviewItem, onSelect, rememberedLabel, }) {
     const headingId = useId();
-    return (_jsxs(Stack, { spacing: 2, children: [overviewItem && (_jsx(Paper, { variant: "outlined", sx: SECTION_NAV_GROUP_PAPER_SX, children: _jsx(List, { disablePadding: true, children: _jsx(ListItemButton, { selected: activeKey == null, "aria-current": activeKey == null ? 'page' : undefined, onClick: () => onSelect === null || onSelect === void 0 ? void 0 : onSelect(null), children: _jsx(ListItemText, { primary: overviewItem.label }) }) }) })), groups.map((group, groupIndex) => {
+    return (_jsxs(Stack, { spacing: 2, children: [overviewItem && (_jsx(Paper, { variant: "outlined", sx: SECTION_NAV_GROUP_PAPER_SX, children: _jsx(List, { disablePadding: true, children: _jsx(ListItem, { disablePadding: true, children: _jsx(ListItemButton, { selected: activeKey == null, "aria-current": activeKey == null ? 'page' : undefined, onClick: () => onSelect === null || onSelect === void 0 ? void 0 : onSelect(null), children: _jsx(ListItemText, { primary: overviewItem.label }) }) }) }) })), groups.map((group, groupIndex) => {
                 const groupHeadingId = `${headingId}-${groupIndex}`;
                 return (_jsxs(Paper, { variant: "outlined", sx: SECTION_NAV_GROUP_PAPER_SX, children: [_jsx(Box, { id: groupHeadingId, sx: SECTION_NAV_GROUP_HEADER_SX, children: _jsx(Typography, { variant: "subtitle2", fontWeight: 700, children: group.label }) }), _jsx(List, { disablePadding: true, "aria-labelledby": groupHeadingId, children: group.items.map((item) => {
                                 const selected = item.key === activeKey;
-                                return (_jsx(ListItemButton, { selected: selected, "aria-current": selected ? 'page' : undefined, onClick: () => onSelect === null || onSelect === void 0 ? void 0 : onSelect(item.key), children: _jsx(ListItemText, { primary: item.label, secondary: !selected && item.key === rememberedKey ? rememberedLabel : null }) }, item.key));
+                                return (_jsx(ListItem, { disablePadding: true, children: _jsx(ListItemButton, { selected: selected, "aria-current": selected ? 'page' : undefined, onClick: () => onSelect === null || onSelect === void 0 ? void 0 : onSelect(item.key), children: _jsx(ListItemText, { primary: item.label, secondary: !selected && item.key === rememberedKey ? rememberedLabel : null }) }) }, item.key));
                             }) })] }, group.key));
             })] }));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@micha.bigler/ui-core-micha",
-  "version": "3.13.0",
+  "version": "3.13.2",
   "main": "dist/index.js",
   "module": "dist/index.js",
   "sideEffects": [

package/src/components/ProfileComponent.jsx

@@ -1,5 +1,5 @@
 // src/components/ProfileComponent.jsx
-import React, { useEffect, useState, useContext } from 'react';
+import React, { useEffect, useState, useContext, useRef } from 'react';
 import {
   Box,
   Stack,
@@ -47,20 +47,42 @@ export function ProfileComponent({
   const [lastName, setLastName] = useState('');
   const [acceptedPrivacy, setAcceptedPrivacy] = useState(false);
   const [acceptedCookies, setAcceptedCookies] = useState(false);
+  const previousUserIdentity = useRef(Symbol('uninitialized'));
+  const editedFields = useRef(new Set());
   const [privacyStatement, setPrivacyStatement] = useState(privacyStatementText || '');
   const [cookieStatement, setCookieStatement] = useState(cookieStatementText || '');
   const [loadingPrivacyStatement, setLoadingPrivacyStatement] = useState(false);
   const [loadingCookieStatement, setLoadingCookieStatement] = useState(false);
 
-  // Synchronisiere Formular-Daten, sobald der User aus dem Context da ist
+  // Refresh server values for untouched fields, while keeping edits for this identity.
   useEffect(() => {
+    const userIdentity = user
+      ? (user.id ?? user.email ?? user.username ?? null)
+      : null;
+
+    if (previousUserIdentity.current !== userIdentity) {
+      previousUserIdentity.current = userIdentity;
+      editedFields.current = new Set();
+    }
+
     if (user) {
       setUsername(user.username ?? '');
       setEmail(user.email ?? '');
-      setFirstName(user.first_name ?? '');
-      setLastName(user.last_name ?? '');
-      setAcceptedPrivacy(Boolean(user.accepted_privacy_statement)); 
-      setAcceptedCookies(Boolean(user.accepted_convenience_cookies));
+      if (!editedFields.current.has('firstName')) setFirstName(user.first_name ?? '');
+      if (!editedFields.current.has('lastName')) setLastName(user.last_name ?? '');
+      if (!editedFields.current.has('acceptedPrivacy')) {
+        setAcceptedPrivacy(Boolean(user.accepted_privacy_statement));
+      }
+      if (!editedFields.current.has('acceptedCookies')) {
+        setAcceptedCookies(Boolean(user.accepted_convenience_cookies));
+      }
+    } else {
+      setUsername('');
+      setEmail('');
+      setFirstName('');
+      setLastName('');
+      setAcceptedPrivacy(false);
+      setAcceptedCookies(false);
     }
   }, [user]);
 
@@ -208,13 +230,19 @@ export function ProfileComponent({
           <TextField
             label={t('Profile.FIRST_NAME_LABEL')}
             value={firstName}
-            onChange={(e) => setFirstName(e.target.value)}
+            onChange={(e) => {
+              editedFields.current.add('firstName');
+              setFirstName(e.target.value);
+            }}
             fullWidth
           />
           <TextField
             label={t('Profile.LAST_NAME_LABEL')}
             value={lastName}
-            onChange={(e) => setLastName(e.target.value)}
+            onChange={(e) => {
+              editedFields.current.add('lastName');
+              setLastName(e.target.value);
+            }}
             fullWidth
           />
         </Stack>
@@ -232,7 +260,10 @@ export function ProfileComponent({
                 control={
                   <Checkbox
                     checked={acceptedPrivacy}
-                    onChange={(e) => setAcceptedPrivacy(e.target.checked)}
+                    onChange={(e) => {
+                      editedFields.current.add('acceptedPrivacy');
+                      setAcceptedPrivacy(e.target.checked);
+                    }}
                   />
                 }
                 label={t('Profile.ACCEPT_PRIVACY_LABEL')}
@@ -244,7 +275,10 @@ export function ProfileComponent({
                 control={
                   <Checkbox
                     checked={acceptedCookies}
-                    onChange={(e) => setAcceptedCookies(e.target.checked)}
+                    onChange={(e) => {
+                      editedFields.current.add('acceptedCookies');
+                      setAcceptedCookies(e.target.checked);
+                    }}
                   />
                 }
                 label={t('Profile.ACCEPT_COOKIES_LABEL')}

package/src/layout/SectionNav.jsx

@@ -5,6 +5,7 @@ import {
   ButtonBase,
   Drawer,
   List,
+  ListItem,
   ListItemButton,
   ListItemText,
   Paper,
@@ -118,13 +119,15 @@ function SectionNavList({
       {overviewItem && (
         <Paper variant="outlined" sx={SECTION_NAV_GROUP_PAPER_SX}>
           <List disablePadding>
-            <ListItemButton
-              selected={activeKey == null}
-              aria-current={activeKey == null ? 'page' : undefined}
-              onClick={() => onSelect?.(null)}
-            >
-              <ListItemText primary={overviewItem.label} />
-            </ListItemButton>
+            <ListItem disablePadding>
+              <ListItemButton
+                selected={activeKey == null}
+                aria-current={activeKey == null ? 'page' : undefined}
+                onClick={() => onSelect?.(null)}
+              >
+                <ListItemText primary={overviewItem.label} />
+              </ListItemButton>
+            </ListItem>
           </List>
         </Paper>
       )}
@@ -143,17 +146,18 @@ function SectionNavList({
               {group.items.map((item) => {
                 const selected = item.key === activeKey;
                 return (
-                  <ListItemButton
-                    key={item.key}
-                    selected={selected}
-                    aria-current={selected ? 'page' : undefined}
-                    onClick={() => onSelect?.(item.key)}
-                  >
-                    <ListItemText
-                      primary={item.label}
-                      secondary={!selected && item.key === rememberedKey ? rememberedLabel : null}
-                    />
-                  </ListItemButton>
+                  <ListItem key={item.key} disablePadding>
+                    <ListItemButton
+                      selected={selected}
+                      aria-current={selected ? 'page' : undefined}
+                      onClick={() => onSelect?.(item.key)}
+                    >
+                      <ListItemText
+                        primary={item.label}
+                        secondary={!selected && item.key === rememberedKey ? rememberedLabel : null}
+                      />
+                    </ListItemButton>
+                  </ListItem>
                 );
               })}
             </List>

package/tests/ProfileComponent.refresh.test.jsx

@@ -0,0 +1,194 @@
+// @vitest-environment jsdom
+import React from 'react';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react';
+import { ThemeProvider, createTheme } from '@mui/material/styles';
+
+vi.mock('react-i18next', () => ({
+  useTranslation: () => ({
+    t: (key, fallback) => ({
+      'Profile.USERNAME_LABEL': 'Username',
+      'Auth.EMAIL_LABEL': 'Email',
+      'Profile.FIRST_NAME_LABEL': 'First name',
+      'Profile.LAST_NAME_LABEL': 'Last name',
+      'Profile.ACCEPT_PRIVACY_LABEL': 'Accept privacy statement',
+      'Profile.ACCEPT_COOKIES_LABEL': 'Accept convenience cookies',
+      'Profile.SAVE_BUTTON': 'Save',
+    }[key] ?? fallback ?? key),
+    i18n: { exists: () => true },
+  }),
+}));
+
+vi.mock('../src/auth/authApi', () => ({
+  fetchCookieStatement: vi.fn(),
+  fetchPrivacyStatement: vi.fn(),
+}));
+
+import { AuthContext } from '../src/auth/AuthContext';
+import { ProfileComponent } from '../src/components/ProfileComponent';
+
+const theme = createTheme();
+
+function makeUser(overrides = {}) {
+  return {
+    id: 17,
+    username: 'pat',
+    email: 'pat@example.com',
+    first_name: 'Pat',
+    last_name: 'Example',
+    accepted_privacy_statement: false,
+    accepted_convenience_cookies: true,
+    ...overrides,
+  };
+}
+
+function profileTree(user, onSubmit) {
+  return (
+    <ThemeProvider theme={theme}>
+      <AuthContext.Provider value={{ user, loading: false }}>
+        <ProfileComponent onSubmit={onSubmit} showStatements={false} />
+      </AuthContext.Provider>
+    </ThemeProvider>
+  );
+}
+
+function renderProfile(user, onSubmit = vi.fn()) {
+  const view = render(profileTree(user, onSubmit));
+  return {
+    ...view,
+    onSubmit,
+    setUser: (nextUser) => view.rerender(profileTree(nextUser, onSubmit)),
+  };
+}
+
+afterEach(() => {
+  cleanup();
+  vi.clearAllMocks();
+});
+
+describe('ProfileComponent user refresh', () => {
+  it('refreshes untouched editable fields while retaining the independently edited field', () => {
+    const { setUser } = renderProfile(makeUser());
+    fireEvent.change(screen.getByRole('textbox', { name: 'First name' }), {
+      target: { value: 'Local first' },
+    });
+
+    setUser(makeUser({
+      first_name: 'Server first',
+      last_name: 'Server last',
+      accepted_privacy_statement: true,
+      accepted_convenience_cookies: false,
+    }));
+
+    expect(screen.getByRole('textbox', { name: 'First name' }).value).toBe('Local first');
+    expect(screen.getByRole('textbox', { name: 'Last name' }).value).toBe('Server last');
+    expect(screen.getByRole('checkbox', { name: 'Accept privacy statement' }).checked).toBe(true);
+    expect(screen.getByRole('checkbox', { name: 'Accept convenience cookies' }).checked).toBe(false);
+  });
+
+  it('preserves edits for the same identity and refreshes untouched fields', async () => {
+    const { onSubmit, setUser } = renderProfile(makeUser());
+    fireEvent.change(screen.getByRole('textbox', { name: 'First name' }), {
+      target: { value: 'Patricia' },
+    });
+    fireEvent.change(screen.getByRole('textbox', { name: 'Last name' }), {
+      target: { value: 'Newname' },
+    });
+    fireEvent.click(screen.getByRole('checkbox', { name: 'Accept privacy statement' }));
+    fireEvent.click(screen.getByRole('checkbox', { name: 'Accept convenience cookies' }));
+
+    setUser(makeUser({
+      username: 'pat-updated',
+      email: 'new@example.com',
+      first_name: 'Server first',
+      last_name: 'Server last',
+      accepted_privacy_statement: false,
+      accepted_convenience_cookies: true,
+    }));
+
+    await waitFor(() => {
+      expect(screen.getByRole('textbox', { name: 'Username' }).value).toBe('pat-updated');
+      expect(screen.getByRole('textbox', { name: 'Email' }).value).toBe('new@example.com');
+    });
+    expect(screen.getByRole('textbox', { name: 'First name' }).value).toBe('Patricia');
+    expect(screen.getByRole('textbox', { name: 'Last name' }).value).toBe('Newname');
+    expect(screen.getByRole('checkbox', { name: 'Accept privacy statement' }).checked).toBe(true);
+    expect(screen.getByRole('checkbox', { name: 'Accept convenience cookies' }).checked).toBe(false);
+
+    fireEvent.click(screen.getByRole('button', { name: 'Save' }));
+    await waitFor(() => {
+      expect(onSubmit).toHaveBeenCalledWith({
+        first_name: 'Patricia',
+        last_name: 'Newname',
+        accepted_privacy_statement: true,
+        accepted_convenience_cookies: false,
+      });
+    });
+  });
+
+  it('resets every field when the identity changes', async () => {
+    const { setUser } = renderProfile(makeUser());
+    fireEvent.change(screen.getByRole('textbox', { name: 'First name' }), {
+      target: { value: 'Unsaved first' },
+    });
+    fireEvent.change(screen.getByRole('textbox', { name: 'Last name' }), {
+      target: { value: 'Unsaved last' },
+    });
+    fireEvent.click(screen.getByRole('checkbox', { name: 'Accept privacy statement' }));
+    fireEvent.click(screen.getByRole('checkbox', { name: 'Accept convenience cookies' }));
+
+    setUser(makeUser({
+      id: 18,
+      username: 'lee',
+      email: 'lee@example.com',
+      first_name: 'Lee',
+      last_name: 'Newperson',
+      accepted_privacy_statement: false,
+      accepted_convenience_cookies: true,
+    }));
+
+    await waitFor(() => {
+      expect(screen.getByRole('textbox', { name: 'First name' }).value).toBe('Lee');
+    });
+    expect(screen.getByRole('textbox', { name: 'Username' }).value).toBe('lee');
+    expect(screen.getByRole('textbox', { name: 'Email' }).value).toBe('lee@example.com');
+    expect(screen.getByRole('textbox', { name: 'Last name' }).value).toBe('Newperson');
+    expect(screen.getByRole('checkbox', { name: 'Accept privacy statement' }).checked).toBe(false);
+    expect(screen.getByRole('checkbox', { name: 'Accept convenience cookies' }).checked).toBe(true);
+  });
+
+  it('clears edits on logout before initializing the next login', async () => {
+    const { setUser } = renderProfile(makeUser());
+    fireEvent.change(screen.getByRole('textbox', { name: 'First name' }), {
+      target: { value: 'Unsaved first' },
+    });
+    fireEvent.click(screen.getByRole('checkbox', { name: 'Accept privacy statement' }));
+    fireEvent.click(screen.getByRole('checkbox', { name: 'Accept convenience cookies' }));
+
+    setUser(null);
+    expect(await screen.findByText('User not logged in.')).toBeTruthy();
+    setUser(makeUser({
+      first_name: 'Pat after login',
+      accepted_privacy_statement: false,
+      accepted_convenience_cookies: true,
+    }));
+
+    await waitFor(() => {
+      expect(screen.getByRole('textbox', { name: 'First name' }).value).toBe('Pat after login');
+    });
+    expect(screen.getByRole('checkbox', { name: 'Accept privacy statement' }).checked).toBe(false);
+    expect(screen.getByRole('checkbox', { name: 'Accept convenience cookies' }).checked).toBe(true);
+  });
+
+  it('hydrates fields when the current user arrives asynchronously', async () => {
+    const { setUser } = renderProfile(null);
+    setUser(makeUser({ first_name: 'Hydrated' }));
+
+    await waitFor(() => {
+      expect(screen.getByRole('textbox', { name: 'First name' }).value).toBe('Hydrated');
+      expect(screen.getByRole('textbox', { name: 'Last name' }).value).toBe('Example');
+    });
+    expect(screen.getByRole('checkbox', { name: 'Accept privacy statement' }).checked).toBe(false);
+    expect(screen.getByRole('checkbox', { name: 'Accept convenience cookies' }).checked).toBe(true);
+  });
+});

package/tests/SectionNav.test.jsx

@@ -68,6 +68,17 @@ function renderNav(props = {}, currentTheme = theme) {
   );
 }
 
+function expectListsToContainListItemButtons(lists) {
+  expect(lists.length).toBeGreaterThan(0);
+  lists.forEach((list) => {
+    expect(Array.from(list.children).every((child) => child.tagName === 'LI')).toBe(true);
+    expect(list.querySelectorAll(':scope > li')).toHaveLength(list.children.length);
+    list.querySelectorAll(':scope > li').forEach((item) => {
+      expect(item.querySelectorAll(':scope > .MuiListItemButton-root')).toHaveLength(1);
+    });
+  });
+}
+
 describe('SectionNav', () => {
   afterEach(() => {
     cleanup();
@@ -133,6 +144,35 @@ describe('SectionNav', () => {
     expect(container.querySelectorAll('.MuiPaper-root')).toHaveLength(groups.length);
   });
 
+  it('renders overview and grouped controls inside list items on desktop and mobile', () => {
+    const overviewItem = { label: 'Overview' };
+    const { container } = renderNav({ overviewItem });
+
+    expectListsToContainListItemButtons(container.querySelectorAll('nav ul'));
+    expect(container.querySelectorAll('nav ul')).toHaveLength(groups.length + 1);
+
+    cleanup();
+    renderNav({ mode: 'mobile', overviewItem, open: true });
+    const dialog = screen.getByRole('dialog', { name: 'Switch section' });
+    const lists = dialog.querySelectorAll('ul');
+
+    expectListsToContainListItemButtons(lists);
+    expect(lists).toHaveLength(groups.length + 1);
+  });
+
+  it('passes null for overview selection and closes the mobile drawer', async () => {
+    const onSelect = vi.fn();
+    renderNav({ mode: 'mobile', onSelect, overviewItem: { label: 'Overview' } });
+
+    fireEvent.click(screen.getByRole('button', { name: /Section Profile/i }));
+    expect(screen.getByRole('dialog', { name: 'Switch section' })).toBeTruthy();
+    fireEvent.click(screen.getByRole('button', { name: 'Overview' }));
+
+    expect(onSelect).toHaveBeenCalledOnce();
+    expect(onSelect).toHaveBeenCalledWith(null);
+    await waitFor(() => expect(screen.queryByRole('dialog', { name: 'Switch section' })).toBeNull());
+  });
+
   it('shows the remembered secondary line only on its unselected item', () => {
     renderNav({ activeKey: 'profile', rememberedKey: 'security' });
     expect(screen.getByText('Last opened')).toBeTruthy();

package/work-orders/UCM-AUTH-13.md

@@ -0,0 +1,45 @@
+# UCM-AUTH-13 — Preserve profile edits during a same-person refresh
+
+## A. Envelope — operator-approved correction
+
+The Spesix first-steps browser trace proves that a background current-user response can arrive while the privacy checkbox is being edited. `ProfileComponent` currently resets every form field whenever the context user object changes, losing the person's input.
+
+Expected outcome: preserve unsaved name and consent edits across a background refresh of the same person. Continue to refresh untouched fields from server data. A change of person, including logout followed by login, must initialize the form from the new person's data and never transfer consent or edits between people. Initial asynchronous user hydration must still work.
+
+Scope: the existing shared ProfileComponent form state, targeted regression tests, a patch release, and subsequent Spesix dependency consumption. No change to authentication, permissions, consent policy, API payload shape, statement requests, layout or copy. No prototype; existing components and labels remain the visual specification. Token delta: EMPTY. Copy list: EMPTY.
+
+Tier 3: shared-core and profile/consent surface. Operator explicitly approved correction, checking, publication and Spesix pin update in the Spesix orchestration chat on 2026-10-14.
+
+Risks: stale pristine fields, failure to hydrate an initially absent user, or carrying unsaved consent into a different account. Tests to write: same-person object replacement preserves typed first/last names and both edited consent values in the submitted payload; untouched fields update; different identity and logout/login reset all fields; initial hydration works. Use real form controls and context rerenders.
+
+## B. Implementation map — addressed to the implementer
+
+Target: `C:/Users/Micha Bigler/Documents/webapps/ui-core-micha`.
+
+Own only `src/components/ProfileComponent.jsx` and new `tests/ProfileComponent.refresh.test.jsx`. Read `tests/AccountPage.profileStatements.test.jsx` for the existing Vitest/jsdom, MUI and AuthContext conventions; `src/auth/AuthContext.jsx` for user identity shape; and `src/pages/AccountPage.jsx` for the caller contract. The library is not a joined application: one author owns component and focused unit tests.
+
+The synchronization effect at ProfileComponent lines 56–65 currently depends on `[user]` and unconditionally assigns username, email, first/last name and both consent flags. The editable controls are near lines 205–250. `handleSubmit` near line 117 constructs the existing optional-fields payload; preserve it. Username/email remain read-only. Statement loading effects and visibility props are unchanged. AccountPage passes its profile update callback into this component. Work from these seams; do not broadly explore or change AuthContext or callers. Verify the identity contract before choosing synchronization behavior; do not use object reference as person identity.
+
+### Required preamble and progress contract
+
+The text above is the COMPLETE spec. Read root AGENTS.md and `.codex/skills/frontend-engineering/SKILL.md` only for conventions. Stay in scope. Do not edit WORK_ORDERS.md, MEMORY.md, package files, lockfiles, changelog, CI or unrelated files. Tools are only for reading the named context and editing assigned source/tests, plus one run of the new tests using the existing direct Vitest runner. No installs, package-manager commands, git, self-review or reviewer dispatch. Leave edits uncommitted. Your run is not the gate; the Orchestrator runs the affected set and independent reviews.
+
+Use explicit UTF-8 file I/O. You share this checkout: preserve all other edits, including the foreign scratchpad directory. Native cwd bootstrap is the workspace root; assigned paths and test cwd must be absolute, without changing the shared process cwd. Start with `PLAN: ...`, report `PROGRESS: [n/total] ...` at meaningful actions with gaps below two minutes, and finish with exactly one `RESULT: DONE|BLOCKED <reason>`.
+
+## C. Orchestrator only — NOT addressed to the implementer
+
+> STOP here if you are the implementer. Everything below belongs to the Orchestrator after implementation. Do not execute it or dispatch anyone.
+
+Dispatch a fresh native worker, explicit codex/gpt-6-luna, fresh context. Record requested and exposed effective metadata honestly; native provider/cwd/sandbox are unverified if not exposed.
+
+Gate #1 is the explicit operator approval recorded above. Run independent envelope, regression, duplication and tests lenses plus UI and security concurrently on the corrected diff, read-only, configured Luna. Parent checks profile payload/identity boundaries in addition. Run focused ProfileComponent and existing AccountPage tests and the build. Root owns patch metadata and publication through the existing main-push workflow; no workflow dispatch is authorized by this file. Verify published version before changing Spesix pin, and inspect the intervening 3.12.0-to-current changes. No screenshots are needed for this state correction.
+
+Foreign scratchpad is excluded. Commit only owned explicit paths. Update register with actual author, reviews, checks, release and consumption evidence; never claim completion before those checks.
+
+### Execution and gate evidence
+
+Fresh native `/root/ucm_auth13_author`, requested codex/gpt-6-luna/high, completed only the two assigned files; no git or package operations. Native provider/cwd/sandbox are not exposed. Author's one test attempt failed before collection on Windows Vitest cache EPERM. Parent authoritative elevated run passed: ProfileComponent.refresh (5) and existing AccountPage suites (6), 11 tests in 3 files. Parent added the independently edited-versus-pristine editable-fields case. Existing-dependency TypeScript build passed. Diff whitespace check passed. Root checked unchanged payload construction, statement effects, visibility flags and server-side authority; local edit tracking resets at identity/logout boundaries.
+
+Six fresh CLI codex/gpt-6-luna read-only lanes ran concurrently against the same frozen diff, including package/changelog and complete component/caller context. Each exited 0 with requested model, openai provider and library cwd confirmed in banner. Envelope, duplication, UI and security reported No findings. Regression raised mutable fallback identity for consumers without IDs: not accepted as a defect in the supported AuthContext contract, which maps the immutable API id; without an immutable identity the component cannot establish that two changed fallback identities are the same person, and preserving consent across them would weaken account isolation. Tests raised that identity/logout/hydration guards also pass against the previous code: not accepted; these are explicitly required preservation cases and catch a naive freeze-after-first-hydration fix, while two same-person tests discriminate the actual defect and submitted consent values. Review: codex/gpt-6-luna; lenses envelope, regression, duplication, tests, ui, security; 2 raised, 0 accepted, worst accepted none. Some optional narrow reads failed process setup; reviewers completed from the full inline diff/context. UI attempted a second blocked narrow read; no command actually executed. No screenshots or image reviews.
+
+npm version verified as 3.13.1 before reserving patch 3.13.2. Existing publish.yml builds and runs the library suite on main push before Trusted Publishing; no manual dispatch. Root inspected the consumer's intervening 3.12.0-to-3.13.1 code: AccountPage adds optional showProfileStatements default true, preserving existing controls/payload; SectionNav adds ListItem wrappers with existing selection/callbacks/labels. No changed exports or dependency requirements. Published patch and Spesix installed-package proof remain pending.

package/work-orders/UCM-SHELL-8.md

@@ -0,0 +1,125 @@
+# UCM-SHELL-8: Valid SectionNav list items
+
+# A. Envelope — operator-approved scope
+
+## Goal and expected outcome
+
+SectionNav navigation entries are genuine list items containing the existing buttons.
+The account capture in innoservice reports three serious axe list violations at 1280 px;
+these remain in ui-core-micha 3.13.0. The correction removes their structural cause.
+
+## Scope and non-goals
+
+- Correct grouped and optional overview entries in SectionNav's shared list renderer.
+- Keep selection, aria-current, labels, remembered entry, keyboard operation, callbacks,
+  controlled/uncontrolled drawer behavior and appearance unchanged.
+- Release the correction as patch 3.13.1 and update innoservice's exact package pin.
+- No navigation redesign, new text, token delta, authentication, permissions, data contract,
+  other component, CI configuration or dependency changes beyond that release/pin.
+- No new visual design or prototype: retain the existing presentation.
+
+## Tier, risk and required tests to write
+
+Tier 3: shared-core source with a rendered DOM correction used by consumers.
+Risk: wrapper defaults could alter spacing or interrupt existing button interaction.
+Write focused assertions that every grouped and overview list has li children containing
+the existing button controls, on desktop and inside the mobile drawer. Preserve existing
+selection and drawer tests; prove overview selection still passes null and closes the drawer.
+
+# B. Implementation map — ADDRESSED TO THE IMPLEMENTER
+
+## Target and ownership
+
+Target: `C:/Users/Micha Bigler/Documents/webapps/ui-core-micha`.
+Native bootstrap retains workspace-root cwd; use absolute paths and explicit workdirs.
+You are not alone in the codebase; preserve other agents' changes. Own only:
+- `src/layout/SectionNav.jsx`
+- `tests/SectionNav.test.jsx`
+
+## Context package
+
+`src/layout/SectionNav.jsx:120`, SectionNavList, is shared by the desktop nav and mobile
+drawer. The overview List currently directly contains ListItemButton; grouped Lists at
+159 map item keys to direct ListItemButton children. MUI List defaults to ul and the
+button defaults to div. Correct list containment while preserving the interactive button.
+The overview handler passes null; grouped handlers pass item.key. Selected buttons carry
+aria-current=page; remembered secondary text is shown only on its unselected entry.
+Keep exported sx constants, drawer state handlers, prop defaults and group label IDs.
+Use existing MUI primitives; prevent wrapper padding from changing the presentation.
+
+`tests/SectionNav.test.jsx` renders the real named SectionNav with ThemeProvider and a
+translation mock. Existing labels: Profile, Security, Users, Invite, Support, Notifications;
+optional Overview; trigger accessible name matches /Section Profile/i; drawer title
+Switch section. Existing tests cover selection, remembered text, controlled/uncontrolled
+drawer, theme tokens and grid. Extend this file without mocking SectionNav or changing
+existing tests to accept weaker behavior. Work from these two files, no broad exploration.
+
+## Preamble and progress contract
+
+> This committed WO is the COMPLETE spec. You are the initial implementer, not the reviewer.
+> Edit only the owned source/test paths using explicit UTF-8 I/O. Preserve other changes.
+> Do not edit dependencies, lockfiles, package/version/changelog/register/README/governance,
+> settings, environment, other repos or memory. Never read .env or dump environment/settings.
+> Your tools are for editing source/test files and running the tests you wrote, nothing else.
+> No installs, package-manager commands, containers, git operations, self-review or subagents.
+> Run your newly written SectionNav cases ONCE with the existing Node/Vitest runtime,
+> maxWorkers=2, selected by test names; no affected/full suite, build or app startup.
+> If blocked, report it rather than changing repo state. Leave all changes uncommitted.
+> The orchestrator's tests and independent reviews are the acceptance gate, not your run.
+> Start PLAN, emit PROGRESS before relevant actions with no silence over two minutes,
+> then exactly one final RESULT: DONE or RESULT: BLOCKED.
+
+# C. Orchestrator only — NOT ADDRESSED TO THE IMPLEMENTER
+
+> IMPLEMENTER STOP HERE. You ARE the initial implementation instance. No steps below belong to you.
+
+Gate #1: operator explicitly approved this exact structural correction, preserved behavior
+and appearance, tests/review, release and innoservice pin bump on 2026-10-13.
+No source approval was inferred from the earlier registration or clarification question.
+
+Dispatch: fresh native plain worker, requested codex/gpt-6-luna, full WO inline; inherited
+cwd is workspace root, target is the absolute core repo above. Record accepted identity
+and only exposed effective metadata. Assigned ownership is not technical containment.
+Parent owns repo state, package version, changelog, README/register and release/pin.
+
+Independent envelope/regression/duplication/tests lenses plus UI run concurrently on the
+same frozen diff via fresh read-only codex/gpt-6-luna processes. Security reviewer is not
+required: no auth/security behavior changes. Parent also checks exposure/permission parity.
+Parent runs SectionNav and both existing AccountPage test files, then build. Existing main
+publish workflow supplies the full shared-core regression suite and publishing evidence;
+normal reviewed main push, no manual publish dispatch. Confirm successful publication of
+3.13.1 before innoservice exact pin and lockfile update. Keep all app capture/axe checks.
+Fresh app capture at 375/1280 must verify navigation and absence of the three list violations.
+Finalize register with named reviews, deduplicated dispositions and actual test/release proof.
+
+Accepted native implementer: `/root/kit_sectionnav`, explicit requested gpt-6-luna, high
+reasoning, fresh context. Effective native provider/model metadata was not exposed and
+remains unverified. Only the two assigned files changed; no author git/review/repo-state
+operations. Author's single permitted test run failed before collection with temporary-file
+EPERM (zero tests). Parent runs the authoritative gate through the normal runtime path.
+
+Core acceptance: five fresh concurrent CLI reviews (envelope, regression, duplication,
+tests, UI), all exit 0, banners confirm codex/gpt-6-luna, provider openai, read-only.
+Deduplicated disposition: 1 raised, 0 accepted, worst accepted none. Tests lens R1 proposed
+proving the MUI implementation identity against a fabricated class-bearing stub. Rejected:
+the structural assertion fails against the actual pre-change direct div children, existing
+selection/theme/drawer tests retain their behavior checks, and the source still directly
+imports and renders the real MUI ListItemButton. No behavior or identity abstraction is added.
+Other lenses report no findings. Parent targeted pass confirms callbacks/permission filtering,
+labels and selected/remembered state unchanged; wrappers use disablePadding.
+Parent gate: 21 tests in SectionNav.test.jsx, AccountPage.test.jsx and
+AccountPage.profileStatements.test.jsx passed with maxWorkers=2; TypeScript build exit 0.
+Publish workflow's full suite is justified by shared-core consumer ripple. App pin and fresh
+consumer capture remain pending after the reviewed core source/release lands.
+
+Closing consumer proof: published3.13.1 verified by workflow38435441867,
+744tests89files plus build and npm Trusted Publishing successful. Innoservice
+exact pin3.13.1 is in sourcec527918, CI38444366349. Both source-matching account
+captures375/1280 have no axe failures, no console/network failures, and all11
+rubric items yes (22answers). Parent inspected both actual account images: same
+profile/security/admin/help navigation and consent controls, readable at both
+widths. Three previous kit list violations are gone. This completes the scoped
+consumer gate; unrelated Organisation-policy axe failures in that app candidate
+remain owned by INNO-FIX-11 and do not reopen the kit list correction.
+Review remains the named five independent readonly Luna source passes above,
+1deduplicated raised0accepted,worst accepted none; no source changes afterward.