@micha.bigler/ui-core-micha 3.13.1 → 3.13.2

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 3.13.2 - UCM-AUTH-13
+
+`ProfileComponent` preserves edited names and consent values when the same person's
+context data refreshes. Untouched fields still receive server updates. Account changes
+and logout reset the form, keeping edits and consent isolated between people.
+
 ## 3.13.1 - UCM-SHELL-8
 
 `SectionNav` now renders grouped and overview navigation buttons inside list items on

package/WORK_ORDERS.md

@@ -28,8 +28,9 @@ prefixed ID; never reuse a bare flat number across workstreams.
 
 | ID | Titel | Beschreibung | Datum | Status | Commit(s) | Notiz |
 |---|---|---|---|---|---|---|
+| UCM-AUTH-13 | [Preserve profile edits during refresh](work-orders/UCM-AUTH-13.md) | Keep unsaved names and consent for the same person; reset at account boundaries. Patch release and Spesix consumption approved. | 2026-10-14 | in-review | ab85c60 | Tier 3. Gate #1 approved by the operator in the Spesix orchestration chat on 2026-10-14. Fresh native configured codex/gpt-6-luna/high author `/root/ucm_auth13_author`; workspace-root cwd bootstrap, absolute target paths; effective provider/cwd/sandbox not exposed. Foreign scratchpad excluded. review: codex/gpt-6-luna · lenses: envelope,regression,duplication,tests,ui,security · 2 raised · 0 accepted · worst accepted: none. Parent 11 focused tests and TypeScript build passed. Patch 3.13.2 release and Spesix consumption pending; detailed dispositions in WO C. |
 | UCM-AUTH-12 | [Optional account profile statement text](work-orders/UCM-AUTH-12.md) | AccountPage showProfileStatements defaults true; false suppresses statement panels/requests while preserving both consent controls and their payload. Minor release 3.13.0, consumed by innoservice INNO-FIX-13. | 2026-10-13 | done | 97b7d83 | Tier 3 (shared-core account surface). Gate #1 explicitly approved in the innoservice Codex chat on 2026-10-13, including release and app pin bump. Separate configured Luna implementation and independent reviews; existing default and consent behavior are invariants.  review: codex/gpt-6-luna · lenses: envelope, regression, duplication, tests, ui, security · 0 raised · 0 accepted · worst accepted: none. Parent scoped tests: AccountPage.profileStatements.test.jsx + AccountPage.test.jsx, 6 passed, correct kit cwd, maxWorkers2. Native author attempt EPERM before collection; parent gate green. Reviewed additive API/default and package release metadata; main push triggers the existing release build/suite/publish. Released 3.13.0: CI38422682968 build, release suite and npm Trusted Publishing all succeeded. App consumption/capture remains tracked under INNO-FIX-13. |
-| UCM-SHELL-8 | SectionNav lists contain direct button children | Grouped and overview entries need genuine list items containing the existing navigation buttons, preserving selection, drawer behavior and presentation. | 2026-10-13 | in-review | `d399f51` | Tier 3. Gate #1 approved by the operator on 2026-10-13: structural correction, tests/review, patch release and innoservice pin bump. Full scope and context: [work-orders/UCM-SHELL-8.md](work-orders/UCM-SHELL-8.md). Original CI38387014900/source9937adb evidence remains in innoservice/work-orders/assets/INNO-FIX-11-axe-nodes.json; CI38425506007/sourceebc35e1 reproduces the three account list violations on 3.13.0, recorded in INNO-FIX-11-candidate-b-axe-nodes.json. Initial native author /root/kit_sectionnav requested codex/gpt-6-luna; effective native metadata unexposed. Source and two focused test cases delivered; author run EPERM before collection, zero tests. Parent tests and independent review pending. review: codex/gpt-6-luna · lenses: envelope, regression, duplication, tests + UI · 1 raised · 0 accepted · worst accepted: none. Disposition in WO Part C: fabricated class-stub identity demand rejected against the real revert failure and preserved existing behavior checks. Parent 21 scoped tests passed (maxWorkers=2), TypeScript build exit 0. Core source accepted; publication, app pin and fresh consumer capture pending. |
+| UCM-SHELL-8 | SectionNav lists contain direct button children | Grouped and overview entries need genuine list items containing the existing navigation buttons, preserving selection, drawer behavior and presentation. | 2026-10-13 | done | `d399f51` | Tier 3. Gate #1 approved by the operator on 2026-10-13: structural correction, tests/review, patch release and innoservice pin bump. Full scope and context: [work-orders/UCM-SHELL-8.md](work-orders/UCM-SHELL-8.md). Original CI38387014900/source9937adb evidence remains in innoservice/work-orders/assets/INNO-FIX-11-axe-nodes.json; CI38425506007/sourceebc35e1 reproduces the three account list violations on 3.13.0, recorded in INNO-FIX-11-candidate-b-axe-nodes.json. Initial native author /root/kit_sectionnav requested codex/gpt-6-luna; effective native metadata unexposed. Source and two focused test cases delivered; author run EPERM before collection, zero tests. Parent tests and independent review pending. review: codex/gpt-6-luna · lenses: envelope, regression, duplication, tests + UI · 1 raised · 0 accepted · worst accepted: none. Disposition in WO Part C: fabricated class-stub identity demand rejected against the real revert failure and preserved existing behavior checks. Parent 21 scoped tests passed (maxWorkers=2), TypeScript build exit 0. Core source accepted; publication, app pin and fresh consumer capture pending. Closing proof:3.13.1 published CI38435441867 (744tests89files/build/npm success); app exact pin/sourcec527918, CI38444366349 account375/1280 both axe0,console/network0,rubric22yes and parent actual-image inspection; all three list violations gone. No source change since reviewed d399f51. |
 | UCM-THEME-17 | Decide a less compressed baseline type scale | Design round (design-language process): inventory, instrument with 2-3 candidate scales next to today's baseline and MUI on real screens (hram, a survey site, jg-ferien, kerzenziehen), value rounds, frozen sheet. Measured 2026-10-04: page/card/section titles differ by 1-3 px, hierarchy rests on weight alone. Full order [`work-orders/UCM-THEME-17.md`](work-orders/UCM-THEME-17.md) | 2026-10-04 | done | `68dfc6a`, `998e36c`, `cb9dd89`, `c452224` | Tier 2 (document only) · operator decision 2026-10-04: baseline finding, not per-app overrides · implementation order follows the freeze · survey_app SVA-THEME-1 typography revert held until then · **frozen 2026-10-04** after two value rounds: candidate B, mobile h4 23, h1-h3 36/32/28; value source [`docs/TYPE-SCALE.md`](docs/TYPE-SCALE.md) · review: none, document order, the operator freeze is the gate · implementation UCM-THEME-18 |
 | UCM-THEME-18 | Ship the frozen baseline type scale | `tokens.js` typography per `docs/TYPE-SCALE.md`: h1-h3 36/32/28, h4 24 (23 below `sm`), h5 20, subtitle1 13; light fixture typography entries; minor release 3.12.0. Full order [`work-orders/UCM-THEME-18.md`](work-orders/UCM-THEME-18.md) | 2026-10-04 | 5be83d5 | | Tier 3 (shared-core) · reviewer + ui_reviewer · downstream per-app orders (h5 page titles -> h4, per-level weight overrides) written after the release - 2026-10-04: Codex implemented (gpt-6-luna; probe of stale 2026-10-03 record succeeded, available) - orchestrator fixed review findings - review: codex/gpt-6-luna - lenses: envelope,regression,duplication,tests + ui_review - 3 raised - 2 accepted - worst accepted: defect (h4 mobile key now follows an app-overridden sm, test added; completeness test strengthened; rejected: breakpointDownQuery vs theme.breakpoints.down, no theme exists at token time) - light fixture diff limited to typography entries - no rendered side-by-side (no prototype; values asserted from the resolved theme in light and dark) - release 3.12.0 |
 | UCM-I18N-5 | [User-list pagination range text is hard-coded English](work-orders/UCM-I18N-5.md) | `UserListComponent`'s `TablePagination` sets `labelRowsPerPage` but no `labelDisplayedRows`, so German shows "1–4 of 4". | 2026-10-01 | done | 6b9d557 | Found in jg-ferien's rendered check 2026-10-01. Follows `UCM-I18N-4`. Tier 3. Done = released AND jg-ferien pin bumped. Envelope written 2026-10-01; operator: hand to the jg Paket-4 session. Implementation map filled 2026-10-02 (`a732025`): the translation bundle carries FOUR locales (de/fr/en/sw), not three — confirmed by reading `authTranslations.ts` directly; proposed two keys (exact-count + "more than" form) with a best-effort, not native-verified, Swahili wording. Implemented by codex/gpt-5.6-luna exactly per the map: `labelDisplayedRows` resolves `UserList.DISPLAYED_ROWS`/`UserList.DISPLAYED_ROWS_MORE_THAN` through `t()`, both keys added in all four locales. review: codex/gpt-5.6-luna · lenses: envelope,regression,duplication,tests,ui_reviewer (one concurrent batch, diff inline) · 4 raised · 3 accepted (deduplicated) · worst accepted: defect. Accepted: the rendered English test would still pass against a reverted implementation, since the EN wording was deliberately made identical to MUI's own hardcoded default — added a second test swapping in a distinctive marker string for just that key, proving the render genuinely resolves through i18next, not MUI's fallback; `authTranslations.test.js`'s new key-parity check only asserted non-empty strings, not that each locale actually carries the `{{from}}`/`{{to}}`/`{{count}}` placeholders the others do — strengthened with an explicit per-locale placeholder check; self-identified (corroborated by the `tests` lens's own closing remark) that the `count === -1` ("more than") branch can never be reached through a render of `UserListComponent` itself (its own `count` prop is always a real array length) — extracted the inline callback into an exported, directly unit-tested `formatDisplayedRowsLabel(t)` rather than leaving it permanently untested dead code. Rejected: `regression`'s claim that hard-coding `labelDisplayedRows` "overrides any consuming app's MUI theme customisation" — speculative, no actual consumer override exists (same explicit-prop design as `labelRowsPerPage` since `UCM-I18N-4`), and the reviewer's own repo search found zero consumer snapshots/assertions relying on the old English text. `envelope`'s "release + pin bump missing from the diff" was correct but not a code defect — addressed by the remaining steps below, not a fix to the reviewed diff. `duplication`: 0 findings. `ui_reviewer`: 0 blocking findings; confirmed placeholder consistency across all 8 strings; Swahili wording flagged as advisory-only ("structurally plausible to a non-native reviewer, native-speaker verification advisable" — not re-asked of a native speaker here, recorded as open). Tests: 37/37 green (`userScreenTranslations.test.jsx`, `authTranslations.test.js`, `UserListComponent.test.jsx`). Released as `3.11.1` (patch — continues `UCM-I18N-4`'s i18n-gap category, not a new capability area), commit `6b9d557`; npm Trusted Publishing confirmed via the Actions job log (not a registry re-query — provenance publishes can lag), tarball `@micha.bigler/ui-core-micha@3.11.1`. jg-ferien's pin bumped 3.7.0 -> 3.11.1 same day, closed as jg's own `JG-DEPS-3` (`2c1d6e3`) — see that repo's `WORK_ORDERS.md` for the empirical safety checks (status-colour palette diff, `UserListComponent`-unused confirmation, full-suite run) this multi-version jump required. |

package/dist/components/ProfileComponent.js

@@ -1,6 +1,6 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // src/components/ProfileComponent.jsx
-import React, { useEffect, useState, useContext } from 'react';
+import React, { useEffect, useState, useContext, useRef } from 'react';
 import { Box, Stack, TextField, FormControlLabel, Checkbox, Button, CircularProgress, Alert, Typography, Accordion, AccordionSummary, AccordionDetails, } from '@mui/material';
 import { useTranslation } from 'react-i18next';
 // WICHTIG: Importiere den Context, um die bereits geladenen Daten zu nutzen
@@ -22,20 +22,43 @@ export function ProfileComponent({ onSubmit, submitText, showName = true, showPr
     const [lastName, setLastName] = useState('');
     const [acceptedPrivacy, setAcceptedPrivacy] = useState(false);
     const [acceptedCookies, setAcceptedCookies] = useState(false);
+    const previousUserIdentity = useRef(Symbol('uninitialized'));
+    const editedFields = useRef(new Set());
     const [privacyStatement, setPrivacyStatement] = useState(privacyStatementText || '');
     const [cookieStatement, setCookieStatement] = useState(cookieStatementText || '');
     const [loadingPrivacyStatement, setLoadingPrivacyStatement] = useState(false);
     const [loadingCookieStatement, setLoadingCookieStatement] = useState(false);
-    // Synchronisiere Formular-Daten, sobald der User aus dem Context da ist
+    // Refresh server values for untouched fields, while keeping edits for this identity.
     useEffect(() => {
-        var _a, _b, _c, _d;
+        var _a, _b, _c, _d, _e, _f, _g;
+        const userIdentity = user
+            ? ((_c = (_b = (_a = user.id) !== null && _a !== void 0 ? _a : user.email) !== null && _b !== void 0 ? _b : user.username) !== null && _c !== void 0 ? _c : null)
+            : null;
+        if (previousUserIdentity.current !== userIdentity) {
+            previousUserIdentity.current = userIdentity;
+            editedFields.current = new Set();
+        }
         if (user) {
-            setUsername((_a = user.username) !== null && _a !== void 0 ? _a : '');
-            setEmail((_b = user.email) !== null && _b !== void 0 ? _b : '');
-            setFirstName((_c = user.first_name) !== null && _c !== void 0 ? _c : '');
-            setLastName((_d = user.last_name) !== null && _d !== void 0 ? _d : '');
-            setAcceptedPrivacy(Boolean(user.accepted_privacy_statement));
-            setAcceptedCookies(Boolean(user.accepted_convenience_cookies));
+            setUsername((_d = user.username) !== null && _d !== void 0 ? _d : '');
+            setEmail((_e = user.email) !== null && _e !== void 0 ? _e : '');
+            if (!editedFields.current.has('firstName'))
+                setFirstName((_f = user.first_name) !== null && _f !== void 0 ? _f : '');
+            if (!editedFields.current.has('lastName'))
+                setLastName((_g = user.last_name) !== null && _g !== void 0 ? _g : '');
+            if (!editedFields.current.has('acceptedPrivacy')) {
+                setAcceptedPrivacy(Boolean(user.accepted_privacy_statement));
+            }
+            if (!editedFields.current.has('acceptedCookies')) {
+                setAcceptedCookies(Boolean(user.accepted_convenience_cookies));
+            }
+        }
+        else {
+            setUsername('');
+            setEmail('');
+            setFirstName('');
+            setLastName('');
+            setAcceptedPrivacy(false);
+            setAcceptedCookies(false);
         }
     }, [user]);
     useEffect(() => {
@@ -129,5 +152,17 @@ export function ProfileComponent({ onSubmit, submitText, showName = true, showPr
     }
     const submitLabel = submitText || t('Profile.SAVE_BUTTON');
     const submitLabelLoading = t('Profile.SAVE_BUTTON_LOADING');
-    return (_jsxs(Box, { component: "form", onSubmit: handleSubmit, sx: { maxWidth: 600, display: 'flex', flexDirection: 'column', gap: 2 }, children: [errorKey && (_jsx(Alert, { severity: "error", children: errorKey })), successKey && (_jsx(Alert, { severity: "success", children: t(successKey) })), _jsxs(Stack, { spacing: 2, children: [_jsx(TextField, { label: t('Profile.USERNAME_LABEL'), value: username, fullWidth: true, disabled: true }), _jsx(TextField, { label: t('Auth.EMAIL_LABEL'), type: "email", value: email, fullWidth: true, disabled: true })] }), showName && (_jsxs(Stack, { spacing: 2, direction: { xs: 'column', sm: 'row' }, children: [_jsx(TextField, { label: t('Profile.FIRST_NAME_LABEL'), value: firstName, onChange: (e) => setFirstName(e.target.value), fullWidth: true }), _jsx(TextField, { label: t('Profile.LAST_NAME_LABEL'), value: lastName, onChange: (e) => setLastName(e.target.value), fullWidth: true })] })), (showPrivacy || showCookies) && (_jsxs(Box, { sx: { mt: 1 }, children: [_jsx(Typography, { variant: "subtitle1", gutterBottom: true, children: t('Profile.PRIVACY_SECTION_TITLE') }), _jsxs(Stack, { spacing: 1, children: [showPrivacy && (_jsx(FormControlLabel, { control: _jsx(Checkbox, { checked: acceptedPrivacy, onChange: (e) => setAcceptedPrivacy(e.target.checked) }), label: t('Profile.ACCEPT_PRIVACY_LABEL') })), showCookies && (_jsx(FormControlLabel, { control: _jsx(Checkbox, { checked: acceptedCookies, onChange: (e) => setAcceptedCookies(e.target.checked) }), label: t('Profile.ACCEPT_COOKIES_LABEL') }))] }), showStatements && (_jsxs(Stack, { spacing: 1.25, sx: { mt: 1.5 }, children: [showPrivacy && (_jsxs(Accordion, { disableGutters: true, children: [_jsx(AccordionSummary, { children: _jsx(Typography, { variant: "body2", fontWeight: 600, children: t('Profile.PRIVACY_STATEMENT_TITLE', 'Privacy statement') }) }), _jsx(AccordionDetails, { children: loadingPrivacyStatement ? (_jsx(Typography, { variant: "body2", color: "text.secondary", children: t('Profile.STATEMENT_LOADING', 'Loading statement...') })) : (_jsx(Typography, { variant: "body2", sx: { whiteSpace: 'pre-wrap' }, children: privacyStatement || t('Profile.PRIVACY_STATEMENT_EMPTY', 'Privacy statement is currently unavailable.') })) })] })), showCookies && (_jsxs(Accordion, { disableGutters: true, children: [_jsx(AccordionSummary, { children: _jsx(Typography, { variant: "body2", fontWeight: 600, children: t('Profile.COOKIES_STATEMENT_TITLE', 'Cookie statement') }) }), _jsx(AccordionDetails, { children: loadingCookieStatement ? (_jsx(Typography, { variant: "body2", color: "text.secondary", children: t('Profile.STATEMENT_LOADING', 'Loading statement...') })) : (_jsx(Typography, { variant: "body2", sx: { whiteSpace: 'pre-wrap' }, children: cookieStatement || t('Profile.COOKIES_STATEMENT_EMPTY', 'Cookie statement is currently unavailable.') })) })] }))] }))] })), _jsx(Box, { sx: { mt: 2 }, children: _jsx(Button, { type: "submit", variant: "contained", disabled: saving, children: saving ? submitLabelLoading : submitLabel }) })] }));
+    return (_jsxs(Box, { component: "form", onSubmit: handleSubmit, sx: { maxWidth: 600, display: 'flex', flexDirection: 'column', gap: 2 }, children: [errorKey && (_jsx(Alert, { severity: "error", children: errorKey })), successKey && (_jsx(Alert, { severity: "success", children: t(successKey) })), _jsxs(Stack, { spacing: 2, children: [_jsx(TextField, { label: t('Profile.USERNAME_LABEL'), value: username, fullWidth: true, disabled: true }), _jsx(TextField, { label: t('Auth.EMAIL_LABEL'), type: "email", value: email, fullWidth: true, disabled: true })] }), showName && (_jsxs(Stack, { spacing: 2, direction: { xs: 'column', sm: 'row' }, children: [_jsx(TextField, { label: t('Profile.FIRST_NAME_LABEL'), value: firstName, onChange: (e) => {
+                            editedFields.current.add('firstName');
+                            setFirstName(e.target.value);
+                        }, fullWidth: true }), _jsx(TextField, { label: t('Profile.LAST_NAME_LABEL'), value: lastName, onChange: (e) => {
+                            editedFields.current.add('lastName');
+                            setLastName(e.target.value);
+                        }, fullWidth: true })] })), (showPrivacy || showCookies) && (_jsxs(Box, { sx: { mt: 1 }, children: [_jsx(Typography, { variant: "subtitle1", gutterBottom: true, children: t('Profile.PRIVACY_SECTION_TITLE') }), _jsxs(Stack, { spacing: 1, children: [showPrivacy && (_jsx(FormControlLabel, { control: _jsx(Checkbox, { checked: acceptedPrivacy, onChange: (e) => {
+                                        editedFields.current.add('acceptedPrivacy');
+                                        setAcceptedPrivacy(e.target.checked);
+                                    } }), label: t('Profile.ACCEPT_PRIVACY_LABEL') })), showCookies && (_jsx(FormControlLabel, { control: _jsx(Checkbox, { checked: acceptedCookies, onChange: (e) => {
+                                        editedFields.current.add('acceptedCookies');
+                                        setAcceptedCookies(e.target.checked);
+                                    } }), label: t('Profile.ACCEPT_COOKIES_LABEL') }))] }), showStatements && (_jsxs(Stack, { spacing: 1.25, sx: { mt: 1.5 }, children: [showPrivacy && (_jsxs(Accordion, { disableGutters: true, children: [_jsx(AccordionSummary, { children: _jsx(Typography, { variant: "body2", fontWeight: 600, children: t('Profile.PRIVACY_STATEMENT_TITLE', 'Privacy statement') }) }), _jsx(AccordionDetails, { children: loadingPrivacyStatement ? (_jsx(Typography, { variant: "body2", color: "text.secondary", children: t('Profile.STATEMENT_LOADING', 'Loading statement...') })) : (_jsx(Typography, { variant: "body2", sx: { whiteSpace: 'pre-wrap' }, children: privacyStatement || t('Profile.PRIVACY_STATEMENT_EMPTY', 'Privacy statement is currently unavailable.') })) })] })), showCookies && (_jsxs(Accordion, { disableGutters: true, children: [_jsx(AccordionSummary, { children: _jsx(Typography, { variant: "body2", fontWeight: 600, children: t('Profile.COOKIES_STATEMENT_TITLE', 'Cookie statement') }) }), _jsx(AccordionDetails, { children: loadingCookieStatement ? (_jsx(Typography, { variant: "body2", color: "text.secondary", children: t('Profile.STATEMENT_LOADING', 'Loading statement...') })) : (_jsx(Typography, { variant: "body2", sx: { whiteSpace: 'pre-wrap' }, children: cookieStatement || t('Profile.COOKIES_STATEMENT_EMPTY', 'Cookie statement is currently unavailable.') })) })] }))] }))] })), _jsx(Box, { sx: { mt: 2 }, children: _jsx(Button, { type: "submit", variant: "contained", disabled: saving, children: saving ? submitLabelLoading : submitLabel }) })] }));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@micha.bigler/ui-core-micha",
-  "version": "3.13.1",
+  "version": "3.13.2",
   "main": "dist/index.js",
   "module": "dist/index.js",
   "sideEffects": [

package/src/components/ProfileComponent.jsx

@@ -1,5 +1,5 @@
 // src/components/ProfileComponent.jsx
-import React, { useEffect, useState, useContext } from 'react';
+import React, { useEffect, useState, useContext, useRef } from 'react';
 import {
   Box,
   Stack,
@@ -47,20 +47,42 @@ export function ProfileComponent({
   const [lastName, setLastName] = useState('');
   const [acceptedPrivacy, setAcceptedPrivacy] = useState(false);
   const [acceptedCookies, setAcceptedCookies] = useState(false);
+  const previousUserIdentity = useRef(Symbol('uninitialized'));
+  const editedFields = useRef(new Set());
   const [privacyStatement, setPrivacyStatement] = useState(privacyStatementText || '');
   const [cookieStatement, setCookieStatement] = useState(cookieStatementText || '');
   const [loadingPrivacyStatement, setLoadingPrivacyStatement] = useState(false);
   const [loadingCookieStatement, setLoadingCookieStatement] = useState(false);
 
-  // Synchronisiere Formular-Daten, sobald der User aus dem Context da ist
+  // Refresh server values for untouched fields, while keeping edits for this identity.
   useEffect(() => {
+    const userIdentity = user
+      ? (user.id ?? user.email ?? user.username ?? null)
+      : null;
+
+    if (previousUserIdentity.current !== userIdentity) {
+      previousUserIdentity.current = userIdentity;
+      editedFields.current = new Set();
+    }
+
     if (user) {
       setUsername(user.username ?? '');
       setEmail(user.email ?? '');
-      setFirstName(user.first_name ?? '');
-      setLastName(user.last_name ?? '');
-      setAcceptedPrivacy(Boolean(user.accepted_privacy_statement)); 
-      setAcceptedCookies(Boolean(user.accepted_convenience_cookies));
+      if (!editedFields.current.has('firstName')) setFirstName(user.first_name ?? '');
+      if (!editedFields.current.has('lastName')) setLastName(user.last_name ?? '');
+      if (!editedFields.current.has('acceptedPrivacy')) {
+        setAcceptedPrivacy(Boolean(user.accepted_privacy_statement));
+      }
+      if (!editedFields.current.has('acceptedCookies')) {
+        setAcceptedCookies(Boolean(user.accepted_convenience_cookies));
+      }
+    } else {
+      setUsername('');
+      setEmail('');
+      setFirstName('');
+      setLastName('');
+      setAcceptedPrivacy(false);
+      setAcceptedCookies(false);
     }
   }, [user]);
 
@@ -208,13 +230,19 @@ export function ProfileComponent({
           <TextField
             label={t('Profile.FIRST_NAME_LABEL')}
             value={firstName}
-            onChange={(e) => setFirstName(e.target.value)}
+            onChange={(e) => {
+              editedFields.current.add('firstName');
+              setFirstName(e.target.value);
+            }}
             fullWidth
           />
           <TextField
             label={t('Profile.LAST_NAME_LABEL')}
             value={lastName}
-            onChange={(e) => setLastName(e.target.value)}
+            onChange={(e) => {
+              editedFields.current.add('lastName');
+              setLastName(e.target.value);
+            }}
             fullWidth
           />
         </Stack>
@@ -232,7 +260,10 @@ export function ProfileComponent({
                 control={
                   <Checkbox
                     checked={acceptedPrivacy}
-                    onChange={(e) => setAcceptedPrivacy(e.target.checked)}
+                    onChange={(e) => {
+                      editedFields.current.add('acceptedPrivacy');
+                      setAcceptedPrivacy(e.target.checked);
+                    }}
                   />
                 }
                 label={t('Profile.ACCEPT_PRIVACY_LABEL')}
@@ -244,7 +275,10 @@ export function ProfileComponent({
                 control={
                   <Checkbox
                     checked={acceptedCookies}
-                    onChange={(e) => setAcceptedCookies(e.target.checked)}
+                    onChange={(e) => {
+                      editedFields.current.add('acceptedCookies');
+                      setAcceptedCookies(e.target.checked);
+                    }}
                   />
                 }
                 label={t('Profile.ACCEPT_COOKIES_LABEL')}

package/tests/ProfileComponent.refresh.test.jsx

@@ -0,0 +1,194 @@
+// @vitest-environment jsdom
+import React from 'react';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react';
+import { ThemeProvider, createTheme } from '@mui/material/styles';
+
+vi.mock('react-i18next', () => ({
+  useTranslation: () => ({
+    t: (key, fallback) => ({
+      'Profile.USERNAME_LABEL': 'Username',
+      'Auth.EMAIL_LABEL': 'Email',
+      'Profile.FIRST_NAME_LABEL': 'First name',
+      'Profile.LAST_NAME_LABEL': 'Last name',
+      'Profile.ACCEPT_PRIVACY_LABEL': 'Accept privacy statement',
+      'Profile.ACCEPT_COOKIES_LABEL': 'Accept convenience cookies',
+      'Profile.SAVE_BUTTON': 'Save',
+    }[key] ?? fallback ?? key),
+    i18n: { exists: () => true },
+  }),
+}));
+
+vi.mock('../src/auth/authApi', () => ({
+  fetchCookieStatement: vi.fn(),
+  fetchPrivacyStatement: vi.fn(),
+}));
+
+import { AuthContext } from '../src/auth/AuthContext';
+import { ProfileComponent } from '../src/components/ProfileComponent';
+
+const theme = createTheme();
+
+function makeUser(overrides = {}) {
+  return {
+    id: 17,
+    username: 'pat',
+    email: 'pat@example.com',
+    first_name: 'Pat',
+    last_name: 'Example',
+    accepted_privacy_statement: false,
+    accepted_convenience_cookies: true,
+    ...overrides,
+  };
+}
+
+function profileTree(user, onSubmit) {
+  return (
+    <ThemeProvider theme={theme}>
+      <AuthContext.Provider value={{ user, loading: false }}>
+        <ProfileComponent onSubmit={onSubmit} showStatements={false} />
+      </AuthContext.Provider>
+    </ThemeProvider>
+  );
+}
+
+function renderProfile(user, onSubmit = vi.fn()) {
+  const view = render(profileTree(user, onSubmit));
+  return {
+    ...view,
+    onSubmit,
+    setUser: (nextUser) => view.rerender(profileTree(nextUser, onSubmit)),
+  };
+}
+
+afterEach(() => {
+  cleanup();
+  vi.clearAllMocks();
+});
+
+describe('ProfileComponent user refresh', () => {
+  it('refreshes untouched editable fields while retaining the independently edited field', () => {
+    const { setUser } = renderProfile(makeUser());
+    fireEvent.change(screen.getByRole('textbox', { name: 'First name' }), {
+      target: { value: 'Local first' },
+    });
+
+    setUser(makeUser({
+      first_name: 'Server first',
+      last_name: 'Server last',
+      accepted_privacy_statement: true,
+      accepted_convenience_cookies: false,
+    }));
+
+    expect(screen.getByRole('textbox', { name: 'First name' }).value).toBe('Local first');
+    expect(screen.getByRole('textbox', { name: 'Last name' }).value).toBe('Server last');
+    expect(screen.getByRole('checkbox', { name: 'Accept privacy statement' }).checked).toBe(true);
+    expect(screen.getByRole('checkbox', { name: 'Accept convenience cookies' }).checked).toBe(false);
+  });
+
+  it('preserves edits for the same identity and refreshes untouched fields', async () => {
+    const { onSubmit, setUser } = renderProfile(makeUser());
+    fireEvent.change(screen.getByRole('textbox', { name: 'First name' }), {
+      target: { value: 'Patricia' },
+    });
+    fireEvent.change(screen.getByRole('textbox', { name: 'Last name' }), {
+      target: { value: 'Newname' },
+    });
+    fireEvent.click(screen.getByRole('checkbox', { name: 'Accept privacy statement' }));
+    fireEvent.click(screen.getByRole('checkbox', { name: 'Accept convenience cookies' }));
+
+    setUser(makeUser({
+      username: 'pat-updated',
+      email: 'new@example.com',
+      first_name: 'Server first',
+      last_name: 'Server last',
+      accepted_privacy_statement: false,
+      accepted_convenience_cookies: true,
+    }));
+
+    await waitFor(() => {
+      expect(screen.getByRole('textbox', { name: 'Username' }).value).toBe('pat-updated');
+      expect(screen.getByRole('textbox', { name: 'Email' }).value).toBe('new@example.com');
+    });
+    expect(screen.getByRole('textbox', { name: 'First name' }).value).toBe('Patricia');
+    expect(screen.getByRole('textbox', { name: 'Last name' }).value).toBe('Newname');
+    expect(screen.getByRole('checkbox', { name: 'Accept privacy statement' }).checked).toBe(true);
+    expect(screen.getByRole('checkbox', { name: 'Accept convenience cookies' }).checked).toBe(false);
+
+    fireEvent.click(screen.getByRole('button', { name: 'Save' }));
+    await waitFor(() => {
+      expect(onSubmit).toHaveBeenCalledWith({
+        first_name: 'Patricia',
+        last_name: 'Newname',
+        accepted_privacy_statement: true,
+        accepted_convenience_cookies: false,
+      });
+    });
+  });
+
+  it('resets every field when the identity changes', async () => {
+    const { setUser } = renderProfile(makeUser());
+    fireEvent.change(screen.getByRole('textbox', { name: 'First name' }), {
+      target: { value: 'Unsaved first' },
+    });
+    fireEvent.change(screen.getByRole('textbox', { name: 'Last name' }), {
+      target: { value: 'Unsaved last' },
+    });
+    fireEvent.click(screen.getByRole('checkbox', { name: 'Accept privacy statement' }));
+    fireEvent.click(screen.getByRole('checkbox', { name: 'Accept convenience cookies' }));
+
+    setUser(makeUser({
+      id: 18,
+      username: 'lee',
+      email: 'lee@example.com',
+      first_name: 'Lee',
+      last_name: 'Newperson',
+      accepted_privacy_statement: false,
+      accepted_convenience_cookies: true,
+    }));
+
+    await waitFor(() => {
+      expect(screen.getByRole('textbox', { name: 'First name' }).value).toBe('Lee');
+    });
+    expect(screen.getByRole('textbox', { name: 'Username' }).value).toBe('lee');
+    expect(screen.getByRole('textbox', { name: 'Email' }).value).toBe('lee@example.com');
+    expect(screen.getByRole('textbox', { name: 'Last name' }).value).toBe('Newperson');
+    expect(screen.getByRole('checkbox', { name: 'Accept privacy statement' }).checked).toBe(false);
+    expect(screen.getByRole('checkbox', { name: 'Accept convenience cookies' }).checked).toBe(true);
+  });
+
+  it('clears edits on logout before initializing the next login', async () => {
+    const { setUser } = renderProfile(makeUser());
+    fireEvent.change(screen.getByRole('textbox', { name: 'First name' }), {
+      target: { value: 'Unsaved first' },
+    });
+    fireEvent.click(screen.getByRole('checkbox', { name: 'Accept privacy statement' }));
+    fireEvent.click(screen.getByRole('checkbox', { name: 'Accept convenience cookies' }));
+
+    setUser(null);
+    expect(await screen.findByText('User not logged in.')).toBeTruthy();
+    setUser(makeUser({
+      first_name: 'Pat after login',
+      accepted_privacy_statement: false,
+      accepted_convenience_cookies: true,
+    }));
+
+    await waitFor(() => {
+      expect(screen.getByRole('textbox', { name: 'First name' }).value).toBe('Pat after login');
+    });
+    expect(screen.getByRole('checkbox', { name: 'Accept privacy statement' }).checked).toBe(false);
+    expect(screen.getByRole('checkbox', { name: 'Accept convenience cookies' }).checked).toBe(true);
+  });
+
+  it('hydrates fields when the current user arrives asynchronously', async () => {
+    const { setUser } = renderProfile(null);
+    setUser(makeUser({ first_name: 'Hydrated' }));
+
+    await waitFor(() => {
+      expect(screen.getByRole('textbox', { name: 'First name' }).value).toBe('Hydrated');
+      expect(screen.getByRole('textbox', { name: 'Last name' }).value).toBe('Example');
+    });
+    expect(screen.getByRole('checkbox', { name: 'Accept privacy statement' }).checked).toBe(false);
+    expect(screen.getByRole('checkbox', { name: 'Accept convenience cookies' }).checked).toBe(true);
+  });
+});

package/work-orders/UCM-AUTH-13.md

@@ -0,0 +1,45 @@
+# UCM-AUTH-13 — Preserve profile edits during a same-person refresh
+
+## A. Envelope — operator-approved correction
+
+The Spesix first-steps browser trace proves that a background current-user response can arrive while the privacy checkbox is being edited. `ProfileComponent` currently resets every form field whenever the context user object changes, losing the person's input.
+
+Expected outcome: preserve unsaved name and consent edits across a background refresh of the same person. Continue to refresh untouched fields from server data. A change of person, including logout followed by login, must initialize the form from the new person's data and never transfer consent or edits between people. Initial asynchronous user hydration must still work.
+
+Scope: the existing shared ProfileComponent form state, targeted regression tests, a patch release, and subsequent Spesix dependency consumption. No change to authentication, permissions, consent policy, API payload shape, statement requests, layout or copy. No prototype; existing components and labels remain the visual specification. Token delta: EMPTY. Copy list: EMPTY.
+
+Tier 3: shared-core and profile/consent surface. Operator explicitly approved correction, checking, publication and Spesix pin update in the Spesix orchestration chat on 2026-10-14.
+
+Risks: stale pristine fields, failure to hydrate an initially absent user, or carrying unsaved consent into a different account. Tests to write: same-person object replacement preserves typed first/last names and both edited consent values in the submitted payload; untouched fields update; different identity and logout/login reset all fields; initial hydration works. Use real form controls and context rerenders.
+
+## B. Implementation map — addressed to the implementer
+
+Target: `C:/Users/Micha Bigler/Documents/webapps/ui-core-micha`.
+
+Own only `src/components/ProfileComponent.jsx` and new `tests/ProfileComponent.refresh.test.jsx`. Read `tests/AccountPage.profileStatements.test.jsx` for the existing Vitest/jsdom, MUI and AuthContext conventions; `src/auth/AuthContext.jsx` for user identity shape; and `src/pages/AccountPage.jsx` for the caller contract. The library is not a joined application: one author owns component and focused unit tests.
+
+The synchronization effect at ProfileComponent lines 56–65 currently depends on `[user]` and unconditionally assigns username, email, first/last name and both consent flags. The editable controls are near lines 205–250. `handleSubmit` near line 117 constructs the existing optional-fields payload; preserve it. Username/email remain read-only. Statement loading effects and visibility props are unchanged. AccountPage passes its profile update callback into this component. Work from these seams; do not broadly explore or change AuthContext or callers. Verify the identity contract before choosing synchronization behavior; do not use object reference as person identity.
+
+### Required preamble and progress contract
+
+The text above is the COMPLETE spec. Read root AGENTS.md and `.codex/skills/frontend-engineering/SKILL.md` only for conventions. Stay in scope. Do not edit WORK_ORDERS.md, MEMORY.md, package files, lockfiles, changelog, CI or unrelated files. Tools are only for reading the named context and editing assigned source/tests, plus one run of the new tests using the existing direct Vitest runner. No installs, package-manager commands, git, self-review or reviewer dispatch. Leave edits uncommitted. Your run is not the gate; the Orchestrator runs the affected set and independent reviews.
+
+Use explicit UTF-8 file I/O. You share this checkout: preserve all other edits, including the foreign scratchpad directory. Native cwd bootstrap is the workspace root; assigned paths and test cwd must be absolute, without changing the shared process cwd. Start with `PLAN: ...`, report `PROGRESS: [n/total] ...` at meaningful actions with gaps below two minutes, and finish with exactly one `RESULT: DONE|BLOCKED <reason>`.
+
+## C. Orchestrator only — NOT addressed to the implementer
+
+> STOP here if you are the implementer. Everything below belongs to the Orchestrator after implementation. Do not execute it or dispatch anyone.
+
+Dispatch a fresh native worker, explicit codex/gpt-6-luna, fresh context. Record requested and exposed effective metadata honestly; native provider/cwd/sandbox are unverified if not exposed.
+
+Gate #1 is the explicit operator approval recorded above. Run independent envelope, regression, duplication and tests lenses plus UI and security concurrently on the corrected diff, read-only, configured Luna. Parent checks profile payload/identity boundaries in addition. Run focused ProfileComponent and existing AccountPage tests and the build. Root owns patch metadata and publication through the existing main-push workflow; no workflow dispatch is authorized by this file. Verify published version before changing Spesix pin, and inspect the intervening 3.12.0-to-current changes. No screenshots are needed for this state correction.
+
+Foreign scratchpad is excluded. Commit only owned explicit paths. Update register with actual author, reviews, checks, release and consumption evidence; never claim completion before those checks.
+
+### Execution and gate evidence
+
+Fresh native `/root/ucm_auth13_author`, requested codex/gpt-6-luna/high, completed only the two assigned files; no git or package operations. Native provider/cwd/sandbox are not exposed. Author's one test attempt failed before collection on Windows Vitest cache EPERM. Parent authoritative elevated run passed: ProfileComponent.refresh (5) and existing AccountPage suites (6), 11 tests in 3 files. Parent added the independently edited-versus-pristine editable-fields case. Existing-dependency TypeScript build passed. Diff whitespace check passed. Root checked unchanged payload construction, statement effects, visibility flags and server-side authority; local edit tracking resets at identity/logout boundaries.
+
+Six fresh CLI codex/gpt-6-luna read-only lanes ran concurrently against the same frozen diff, including package/changelog and complete component/caller context. Each exited 0 with requested model, openai provider and library cwd confirmed in banner. Envelope, duplication, UI and security reported No findings. Regression raised mutable fallback identity for consumers without IDs: not accepted as a defect in the supported AuthContext contract, which maps the immutable API id; without an immutable identity the component cannot establish that two changed fallback identities are the same person, and preserving consent across them would weaken account isolation. Tests raised that identity/logout/hydration guards also pass against the previous code: not accepted; these are explicitly required preservation cases and catch a naive freeze-after-first-hydration fix, while two same-person tests discriminate the actual defect and submitted consent values. Review: codex/gpt-6-luna; lenses envelope, regression, duplication, tests, ui, security; 2 raised, 0 accepted, worst accepted none. Some optional narrow reads failed process setup; reviewers completed from the full inline diff/context. UI attempted a second blocked narrow read; no command actually executed. No screenshots or image reviews.
+
+npm version verified as 3.13.1 before reserving patch 3.13.2. Existing publish.yml builds and runs the library suite on main push before Trusted Publishing; no manual dispatch. Root inspected the consumer's intervening 3.12.0-to-3.13.1 code: AccountPage adds optional showProfileStatements default true, preserving existing controls/payload; SectionNav adds ListItem wrappers with existing selection/callbacks/labels. No changed exports or dependency requirements. Published patch and Spesix installed-package proof remain pending.

package/work-orders/UCM-SHELL-8.md

@@ -111,3 +111,15 @@ Parent gate: 21 tests in SectionNav.test.jsx, AccountPage.test.jsx and
 AccountPage.profileStatements.test.jsx passed with maxWorkers=2; TypeScript build exit 0.
 Publish workflow's full suite is justified by shared-core consumer ripple. App pin and fresh
 consumer capture remain pending after the reviewed core source/release lands.
+
+Closing consumer proof: published3.13.1 verified by workflow38435441867,
+744tests89files plus build and npm Trusted Publishing successful. Innoservice
+exact pin3.13.1 is in sourcec527918, CI38444366349. Both source-matching account
+captures375/1280 have no axe failures, no console/network failures, and all11
+rubric items yes (22answers). Parent inspected both actual account images: same
+profile/security/admin/help navigation and consent controls, readable at both
+widths. Three previous kit list violations are gone. This completes the scoped
+consumer gate; unrelated Organisation-policy axe failures in that app candidate
+remain owned by INNO-FIX-11 and do not reopen the kit list correction.
+Review remains the named five independent readonly Luna source passes above,
+1deduplicated raised0accepted,worst accepted none; no source changes afterward.