@micha.bigler/ui-core-micha 3.9.1 → 3.10.0

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 3.10.0 — UCM-TEST-1
+
+Added the exported `checkKitIntegration` consumer check for app i18n, providers, kit page rendering, and auth error translation wiring.
+
 ## 3.9.1 — UCM-AUTH-11
 
 `UserListComponent` no longer offers an administrator the delete action for their own account, including when a consumer-supplied `canDeleteUser` callback returns true.

package/README.md

@@ -10,6 +10,22 @@ To add an entry, create a small component in `dev/entries.jsx` and append it to
 
 Spread `uiCoreTranslations` into the default i18n namespace as the supported aggregate; per-feature translation exports remain available to selective apps that accept responsibility for pairing every adopted feature with its bundle.
 
+## Consumer integration check
+
+```js
+import { checkKitIntegration } from '@micha.bigler/ui-core-micha';
+import i18n from '../i18n';
+import { AppProviders } from '../AppProviders';
+
+it('kit integration is sound', async () => {
+  globalThis.IS_REACT_ACT_ENVIRONMENT = true; // skip if your test setup already sets this
+  const { findings } = await checkKitIntegration({ i18n, wrapper: AppProviders });
+  expect(findings).toEqual([]);
+});
+```
+
+`pages` controls which additional kit pages render (default: `LoginPage`, `SignUpPage`, `PasswordInvitePage`); `LoginPage` itself always renders once more for the error-text check regardless of what `pages` contains. Run this check on its own in its test file — it stubs the kit's shared `apiClient` transport for its duration, so a test running real requests through `apiClient` at the same time would see them intercepted too.
+
 ## Dashboard primitives
 
 `StatTile` (a bordered KPI tile) and `SoftChip` (a soft tinted annotation/status chip, tones derived from `theme.palette[tone]`) live under `src/components/` and are exported from the package root.

package/WORK_ORDERS.md

@@ -19,6 +19,7 @@ rules are defined centrally in `webapps/AGENTS.md` → "Work-Order Register".
 | `I18N-*` | The shared kit's i18n **contract** — how a consumer registers ucm's strings, and what happens when it forgets. Distinct from `AUTH-*`, which owns the auth strings themselves |
 | `PRIM-*` | Shared dashboard/data primitives — small presentational components that are neither chart (`CHART-*`) nor app chrome (`SHELL-*`) |
 | `SHELL-*` | Shared app chrome and navigation shells (`UserMenu`, mobile bottom nav, secondary-navigation shell) — used since `SHELL-1`, documented here 2026-08-11 |
+| `TEST-*` | Consumer integration checks the kit ships for apps to run in their own suites |
 
 Introduce a new prefix when none fits and add it here. New WOs always get a
 prefixed ID; never reuse a bare flat number across workstreams.
@@ -27,6 +28,7 @@ prefixed ID; never reuse a bare flat number across workstreams.
 
 | ID | Titel | Beschreibung | Datum | Status | Commit(s) | Notiz |
 |---|---|---|---|---|---|---|
+| UCM-TEST-1 | A kit integration check every app runs in its own suite | Exported `checkKitIntegration({ i18n, wrapper, pages })` -> `{ findings }` (shape of `assertThemeComplete`): kit keys present in the app's i18n, one `i18next` instance, kit pages render in the app's providers without raw keys, the `invalid`-email case shows the field text. Replaces per-app hand-written wiring tests and manual auth walks. Full order [`work-orders/UCM-TEST-1.md`](work-orders/UCM-TEST-1.md) | 2026-10-01 | done | 2cde120 | Tier 3 (shared-core, auth surface) · operator decision 2026-10-01: central check, apps adopt with their next bump · companion: `workflow-templates` WFT-CI-31. Codex implemented (available today, no fallback). Orchestrator independently found + fixed before review: a false-positive in the raw-code render heuristic (a legitimate short lowercase kit-shipped value, e.g. German `"oder"` for `Auth.LOGIN_OR`, would otherwise be flagged as a leaked backend code — added a `KIT_VALUES` exemption + a pinning test), and independently proved Required Test 5 (resolver-bypassed -> error-text finding) via a transient mutation of `resolveErrorText.js`, restored clean. Independent `reviewer` (all 4 lenses) + `ui_reviewer` (Codex gpt-5.6-luna, concurrent background batch, full diff): **review: codex/gpt-5.6-luna · lenses: envelope,regression,duplication,tests,ui · 9 raised · 6 accepted · worst accepted: blocker**. Accepted and fixed: catalogue check didn't force `fallbackLng: false` per lookup, so a consumer's own `fallbackLng` config (survey_app's is `"de"`, not `"false"`) could silently resolve a missing-language key through the fallback and mask it (tests lens) — fixed, plus a dedicated test using a real fallback-configured instance; Required Test 6 only checked adapter reference-identity, not that a real post-check request actually reaches the real adapter (envelope lens) — strengthened with a sentinel-adapter test; React 19's `act()` needs `IS_REACT_ACT_ENVIRONMENT`, undocumented for consumers (ui lens) — added to the README example; README's `pages` description implied it fully replaces the default set, when `LoginPage` always additionally renders for the error-text check regardless (ui lens, nit) — clarified. Accepted, documented rather than redesigned: mutating the shared `apiClient.defaults.adapter` for the check's duration is process-wide and could intercept a concurrent real request from other code in the same test file (regression lens, blocker) — this is the Envelope's own decided stub design (`src/utils/auth-errors.js`-style module-singleton stubbing, same pattern already used throughout this suite), not fixable without abandoning that decision; added a README caveat instead of restructuring. Rejected: `RAW_CODE` only matches lowercase-snake-case, missing uppercase/hyphenated shapes (envelope + tests lenses, same point from both) — every real backend error code in this codebase (`src/utils/auth-errors.js`, allauth headless responses) is lowercase snake_case; widening the regex matches no real shape here and raises false-positive risk for marginal benefit. `KIT_VALUES` could let a leaked code evade detection if it coincidentally equals a real kit translation value (tests lens) — true but reintroducing the "oder" false positive to close it is a worse trade; no real backend code collides with the kit's UI copy in practice. The correctly-wired/legitimate-word/resolver/adapter-restore tests would all pass against a hardcoded `{findings:[]}` stub in isolation (tests lens, nit) — true of any happy-path assertion; each is paired with a failure-case test proving the same code path actually detects the defect (Required Tests 2-5), which is where the real proof lives. `duplication`: no capability-level overlap with `assertThemeComplete` or any shared-core/app module. **Verification** (WO's own instruction): ran `checkKitIntegration` once against survey_app's real wiring — not by touching that repo, but from inside this repo's own resolved environment, replicating `survey_app/frontend/i18n/index.js`'s real merge + config exactly (`fallbackLng: "de"`, survey_app's actual `translations.json`) plus this repo's real `AuthProvider` — **result: `findings: []`**, including against the real fallback-configured instance the tests-lens finding above was about. Orchestrator's own scoped run: `tests/checkKitIntegration.test.jsx` + `tests/resolveErrorText.test.js` (12 tests) + 7 directly-dependent files (33 tests) = 45/45 green via `npx vitest run <files> --pool=threads --maxWorkers=1`. No rendered gate — library-only change, no running app to preview. **Released as `3.10.0`** (minor — new exported capability, per the WO's own instruction). Per-app adoption rows are added by the Expertenchat when each app's next bump is scoped — not part of this WO. |
 | UCM-AUTH-11 | [`UserListComponent` offers an admin the delete action on their own row](work-orders/UCM-AUTH-11.md) | Without a `canDeleteUser` prop, `canDelete` falls back to `canEdit`, which is true for a superuser or role `admin` on EVERY row, their own included (`src/components/UserListComponent.jsx` `defaultCanEdit`/`canDelete`, ~l.128-156); the backend (dcm) still allows an admin's generic self-delete. Default should never offer deleting one's own row. | 2026-09-30 | released | 83bac37 | From django-core-micha `DCM-AUTH-4` (dropped there): operator decision 2026-09-30, UI-only, backend unchanged. Affected consumers measured: kerzenziehen and reimbursements render ucm's `AccountPage` without props (jg-ferien passes its own `userListCanDeleteUser` and already excludes itself). Both apps pin ucm **2.41.3**, so reaching them needs a major bump (3.0.0 removed chart layout props) — tracked as its own follow-up, not this WO. Gate #1 approved 2026-09-30 (operator handover). Codex implemented (available today, no fallback): new `isOwnRow(targetUser)` helper (`String(id) === String(id)`, `false` whenever either id is unresolved — covers the loading-state risk) gates the delete button's RENDER — `{showDeleteAction && !isOwnRow(row) && (...)}` — not its `disabled` state, so a consumer's `canDeleteUser` returning `true` for the own row cannot bring the button back; `canDelete`/`canEdit`/`defaultCanEdit` untouched. Independent `reviewer` (all 4 lenses) + `ui_reviewer` + `sec_reviewer` (Codex gpt-5.6-luna, concurrent background batch, full diff): **review: codex/gpt-5.6-luna · lenses: envelope,regression,duplication,tests,ui,sec · 3 raised · 1 accepted · worst accepted: nit**. Accepted (nit, tests lens): the committed fixtures only ever used numeric ids for both `currentUser` and the own row, so a strict-equality implementation would have passed every committed test despite violating the Envelope's own `3`/`"3"` identity requirement — added a fifth case with a string-vs-number id mismatch. Rejected: envelope lens's claim that "Required Test 5 (mutation proof) is missing" — the WO's own Part B (mirroring `UCM-THEME-15`/`UCM-PRIM-2`'s established pattern in this repo) asks for a TRANSIENT demonstration during implementation, not a permanent fifth test case; the implementer's own `PROGRESS` narration confirms it removed the gate, watched tests 1 and 3 fail (2 delete buttons found instead of 1), then restored — exactly as asked. Envelope lens's claim that "package.json remains 3.9.0 so the release is incomplete" — true at the moment the reviewer read the diff (version bump + register are the Orchestrator's own finalize step, explicitly forbidden to the implementer), not a defect in the change itself; done now. `regression`/`duplication`/`ui`/`sec` lenses: no findings — `sec_reviewer` specifically confirmed the render-gate cannot be reopened via `canDeleteUser`/`canEditUser`/`extraRowActions`, and that the backend's own continued refusal of an admin's self-delete (`DCM-AUTH-4`) means this UI-only fix is not masking a still-open server-side gap. Orchestrator's own scoped run: `tests/UserListComponent.test.jsx` 7/7 green + `tests/userScreenTranslations.test.jsx` (directly-dependent, also renders this component) 4/4 green, via `npx vitest run <files> --pool=threads --maxWorkers=1` (default fork pool repeatedly failed to start workers in this sandbox — an environment flake, not a code issue). No rendered gate — library component, no running app to preview; unit-tested only. **Released as `3.9.1`** (patch — behaviour fix of an existing component, no API change, per the WO's own instruction). `npm view @micha.bigler/ui-core-micha version` will read `3.9.1` once the registry's version-list index catches up to the just-completed publish (provenance-signed publishes report success immediately but can take a few minutes to appear in `npm view`/the registry API — confirmed via the GitHub Actions job log on the prior `UCM-AUTH-10` release, not re-verified here to avoid the same registry-lag false alarm). **Not done in this session** (per the WO's own Part C): registering the kerzenziehen/reimbursements major-bump follow-up rows in their own `WORK_ORDERS.md` registers — flagged for whoever next works in those repos. |
 | UCM-AUTH-10 | Error texts never show a raw backend code | One resolver for every kit error display: backend `i18nKey` > field key `Auth.field.<field>.<code>` > code key (AUTH-2) > backend message > caller default; `apiClient` sends the UI language as `Accept-Language`; `invalid`/`required` field keys for every submitted field; ~40 call sites migrated; reconstructs the missing 3.7.0 changelog entry. Full order [`work-orders/UCM-AUTH-10.md`](work-orders/UCM-AUTH-10.md) | 2026-09-30 | done | 9019d3d | Tier 3 (shared-core, auth screens, header on every request) · operator decision 2026-09-30: code-based UI, backend message as last specific fallback, UI language sent to the backend · found in `survey_app` SVA-DEP-1 acceptance (pre-existing, not a bump regression). Codex implemented (available today, no fallback): new `src/utils/resolveErrorText.js` (plain function, not a hook — called inside `catch` blocks) implementing steps 0-4 via `i18n.exists`/`i18n.t`; `extractErrorInfo`/`normaliseApiError` now carry `field` (`param` allauth / `field` dcm, normalised to one name), `i18nKey`, and `backendMessage` (never falls back to the code — the literal bug) as separate fields; `apiClient` gained a request interceptor sending `Accept-Language: i18next.language` only when `i18next.isInitialized` (never guesses); ~40 call sites across 22 files migrated to the uniform pattern (state now always holds resolved display text, never a bare key; render sites dropped their `t()` wrapper); 48 new `Auth.field.<field>.{invalid,required}` keys (24 fields, enumerated from `authApi.jsx`, all 4 locales + `de_informal` where wording differs); `CHANGELOG.md`'s missing `3.7.0` entry reconstructed. Independent `reviewer` (all 4 lenses) + `ui_reviewer` + `sec_reviewer` (Codex gpt-5.6-luna, concurrent background batch, full diff): **review: codex/gpt-5.6-luna · lenses: envelope,regression,duplication,tests,ui,sec · 12 raised · 4 accepted · worst accepted: defect**. Accepted: (defect, envelope lens — a real guard blind spot) `MFAComponent.jsx`'s `setErrorKey('Auth.MFA_TOTP_ALREADY_ACTIVE')` was a plain literal-key setter the mechanical sweep missed — the call-site-guard test only matches the `.code` pattern, not "any literal setter needs `t()` now that render dropped its wrapper"; would have displayed the raw key on screen, exactly the bug this WO exists to fix. Fixed (wrapped in `t()`); no dedicated test exists for this component, fix verified by direct code inspection only. (nit, ui_reviewer) the new field-key catalogue omitted `RegistrationMethodsManager.jsx`'s 5 boolean policy-toggle fields (`allow_admin_invite`, `allow_self_signup_{access_code,open,email_domain,qr}`); added, all 4 locales. (nit, tests lens) `resolveErrorText.test.js`'s "dcm field shape" case was byte-identical to the allauth-shape case, testing nothing new (the param/field normalisation it claimed to cover already happens one layer down, in `extractErrorInfo`, and is genuinely tested there); removed the redundant duplicate. Rejected: 2 lenses (envelope, ui_reviewer) claimed `SupportRecoveryRequestsTab.jsx` calls `resolveErrorText(i18n, …)` without destructuring `i18n` — verified directly against the file twice, `const { t, i18n } = useTranslation()` is present at line 42 and every call site is a closure over it; a stale/misread finding from both lenses, not a real defect. 3 lenses (envelope, regression, tests) flagged step 3 (`backendMessage` rendered verbatim) as an exposure risk — this is the Envelope's own **decided** design (`Operator decision: … the backend message as the last specific fallback`), not an implementation defect; `sec_reviewer` — the lens specifically briefed with dcm's S4 audit-log rationale and tasked with exactly this question — found no HTML-injection path and confirmed React's text-node escaping covers every render site, which is what the Envelope's own risk-review request was actually asking. `sec_reviewer` additionally flagged `BulkInviteCsvTab.jsx:88`'s `err.message` and `PasswordInvitePage.jsx:117`'s `err.raw.messages` as chain bypasses — the former is a purely local CSV-file-read error with no backend response involved at all (confirmed no `apiClient` call in that `try` block), the latter is `UCM-AUTH-9`'s already-shipped, already-reviewed password-rejection-reason display, unchanged by this WO and out of scope per its own non-goal ("no change to which errors are shown, where, or what triggers one"). `envelope`+`tests` lenses' claim that `auth-errors.js`'s native `.message` still falls back to the code — deliberate, per this WO's own Part B ("you may leave `err.message` with its existing fallback-to-code behaviour untouched") and covered by the implementer's own test; the field the resolver actually reads (`backendMessage`) correctly never falls back, which is what the Envelope's separation requirement is about. Orchestrator's own scoped run: 14 files, 102 tests green (`resolveErrorText`/`loginPageErrorResolution`/`errorCallSiteGuard`/`apiClientLanguage`/`authErrors`/`AccountPage`/`PasswordInvitePage`/`SignUpPage`/`UserListComponent`/`QrSignupManager.registrationContext`/`i18nAggregate`/`authTranslations`/`themeCompleteness`/`i18nGermanVariant`), via `npx vitest run <files> --pool=threads --maxWorkers=1` (the default fork pool repeatedly failed to start workers in this sandbox — an environment flake, not a code issue; the threads pool is stable). **Verification (the operator's exact screenshot case, rendered end to end):** `en` → "Enter a valid email address."; `de` → "Bitte geben Sie eine gültige E-Mail-Adresse ein." — both resolve via step 1 (`Auth.field.email.invalid`), never the raw `invalid` code, confirmed by `tests/loginPageErrorResolution.test.jsx` (`en`) and by the locale-agnostic resolver design (same key, `de` value) for `de`. No rendered browser gate — verified via the real `LoginPage` component rendered against a real i18next instance in the test harness. **Released as `3.9.0`** (minor, per the Envelope's own instruction — `resolveErrorText` is internal-only, not part of the public `src/index.js` surface). `npm view @micha.bigler/ui-core-micha version` should read `3.9.0` once `publish.yml` runs on this push. No consumer bump in this session (non-goal). |
 | UCM-THEME-15 | Derive status and control-border colours against the theme's own page | Baseline-supplied status `main` and `controlBorder` colours are derived against `#FFFFFF` + `background.default` (like `controlBorder.focus`), only when they would fail; a passing theme resolves byte-identically, app-set values are never touched. Full order [`work-orders/UCM-THEME-15.md`](work-orders/UCM-THEME-15.md) | 2026-09-29 | done | 4515e73 | Tier 3 (inside shared-core) · operator decision 2026-09-29: option (a), no exemptible contrast findings · unblocks `survey_app` SVA-THEME-1 and `survey_contact_app` SCA-THEME-1 (site half) after their pin bumps · lands before UCM-THEME-14. Gate #1 carried by the committed Envelope + mini-handover. Codex implemented (available today, no fallback): new `deriveDarkenedPageColour`/`deriveAlphaPageColour` helpers alongside (not replacing) the untouched `deriveFocusColour`/`clearsContrast`, using the kit's own alpha-aware `calculateContrastRatio` (not MUI's `getContrastRatio`, which is not documented to alpha-composite — matters for the translucent `controlBorder.main`/`.hover`); rule 3 (baseline vs app-supplied) checked per-key straight off `appConfig.palette`, never the resolved theme; `withMainShades` exported from `tokens.js` (internal-only, not part of the public package surface) so re-derivation reuses the real shade formula instead of duplicating it. Independent `reviewer` (all 4 lenses) + `ui_reviewer` (Codex gpt-5.6-luna, concurrent background batch, full diff), `ui_reviewer` specifically traced rule 3 through every merge path (the three-arg `paletteTheme` build and the final layered `createTheme` call) including a partial `controlBorder` override (app sets `.hover` only) — confirmed no defect, per-key checks hold: **review: codex/gpt-5.6-luna · lenses: envelope,regression,duplication,tests,ui · 6 raised · 3 accepted · worst accepted: defect**. Accepted (defect, tests+envelope lenses, same finding): the app-override test only covered `success.main`/`controlBorder.main`, leaving `warning`/`error`/`info` and `controlBorder.hover`/`.error` unpinned — extended to cover a second overridden status + all three `controlBorder` states, plus asserted the two NOT-overridden status keys (`error`/`info`) still derive normally on the same tinted page (proves rule 3 is per-key, not per-object). (defect, tests lens) the termination test asserted only the status-derivation path terminates — added assertions that `controlBorder.main/hover/error` are also defined (not thrown) on the unreachable page. (nit, ui_reviewer) `DESIGN.md` said the baseline "promises a passing colour" — overstated, since capped derivation can still leave an unreachable page failing; softened to name the cap explicitly. Rejected: nit that exporting `withMainShades` violates "no API change" (it is an internal `tokens.js`↔`createAppTheme.js` module export, never re-exported from the public `src/index.js` surface — verified directly, zero consumer-visible surface change); nit that the byte-identity test "isn't evidence of the new derivation" (it is a different, explicitly required test — Required Test #2 — a regression/parity guard, not required to also prove the derivation path, which tests #1/#3/#4 already do). Orchestrator's own scoped run: `tests/createAppThemePageContrast.test.js` 9/9 green + 45/45 directly-dependent (`createAppTheme`/`themeCompleteness`), all via `npx vitest run <files> --maxWorkers=1`. No rendered gate — library component, no running app to preview; unit-tested only. **Verification data (re-derived from the built themes, per the Envelope's own acceptance criterion):** baseline `#FAFAFA` — unchanged (`success #1B8038`/`warning #976100`/`error #BF3227`/`info #01579B`/`border.main rgba(33,37,41,.50)`/`border.hover rgba(33,37,41,.65)`/`border.error #BF3227`). `hafen #D8E4E1`, `jg-fegbern #eceae2`, `routing #E8EAF6`, `uph #E6EAF0` (all four move the same two channels): `success rgb(24-25,115-121,50-53)`, `warning rgb(135-143,87-92,0)`, `border.main rgba(33,37,41,0.55)`; `error`/`info`/`border.hover`/`border.error` unchanged (matches the Envelope's table — only success/warning/border.main failed on these). `ygbs #E398C7` (all measured channels failed, all move): `success rgb(16,76,33)`, `warning rgb(90,58,0)`, `error rgb(124,32,25)`, `info rgb(0,65,116)`, `border.main rgba(33,37,41,0.6)`, `border.error rgb(171,45,35)`; `border.hover` unchanged (`.65` alpha already clears 3:1 even on this page). **Released as `3.8.0`** (minor: changed default for currently-failing themes only, no API change, no adopted app moves — per the Envelope's own framing). `npm view @micha.bigler/ui-core-micha version` should read `3.8.0` once `publish.yml` runs on this push. Next: add `planned` pin-bump rows in `survey_app/WORK_ORDERS.md` and `survey_contact_app/WORK_ORDERS.md` (from `2.41.3`, classify via the dependency-bump test in `AGENTS.md` → Tiering) and unblock `SVA-THEME-1`/`SCA-THEME-1` — not done in this session, flagged for the next one touching those repos. |

package/dist/index.js

@@ -6,6 +6,8 @@
 import './theme/fonts';
 // --- 0. Theme ---
 export { createAppTheme, assertThemeComplete, assertKitSxDisjoint, calculateContrastRatio, KIT_COMPONENT_SX_REGISTRY, reportOffPaletteColours, reportKitSxBypasses, reportRedundantThemeValues, reportThemeAdoption, THEME_COMPLETENESS_SURFACES, } from './theme';
+// --- 0.1 Consumer integration ---
+export { checkKitIntegration } from './testing/checkKitIntegration';
 // --- 1. Auth Context (Essentiell für den Wrapper) ---
 export { AuthContext, AuthProvider } from './auth/AuthContext';
 export { UserMenu } from './auth/UserMenu';

package/dist/testing/checkKitIntegration.js

@@ -0,0 +1,201 @@
+import React, { act } from 'react';
+import { createRoot } from 'react-dom/client';
+import { MemoryRouter } from 'react-router-dom';
+import i18next from 'i18next';
+import apiClient from '../auth/apiClient';
+import { LoginPage } from '../pages/LoginPage';
+import { SignUpPage } from '../pages/SignUpPage';
+import { PasswordInvitePage } from '../pages/PasswordInvitePage';
+import { uiCoreTranslations } from '../i18n/uiCoreTranslations';
+const KIT_LANGUAGES = ['de', 'en', 'fr', 'sw'];
+const LOGIN_PATH = '/api/auth/browser/v1/auth/login';
+const RAW_CODE = /^[a-z][a-z0-9_]*$/;
+function pageName(Page) {
+    return (Page === null || Page === void 0 ? void 0 : Page.displayName) || (Page === null || Page === void 0 ? void 0 : Page.name) || 'page';
+}
+function appLanguages(i18n) {
+    var _a, _b;
+    const candidates = [
+        (_a = i18n === null || i18n === void 0 ? void 0 : i18n.options) === null || _a === void 0 ? void 0 : _a.supportedLngs,
+        Object.keys(((_b = i18n === null || i18n === void 0 ? void 0 : i18n.options) === null || _b === void 0 ? void 0 : _b.resources) || {}),
+        i18n === null || i18n === void 0 ? void 0 : i18n.languages,
+    ];
+    for (const candidate of candidates) {
+        const languages = Array.isArray(candidate)
+            ? candidate.filter((language) => language && language !== 'cimode')
+            : [];
+        if (languages.length > 0)
+            return languages;
+    }
+    return [];
+}
+function textNodes(container) {
+    var _a;
+    const result = [];
+    const document = container.ownerDocument;
+    const filter = ((_a = document.defaultView) === null || _a === void 0 ? void 0 : _a.NodeFilter) || NodeFilter;
+    const walker = document.createTreeWalker(container, filter.SHOW_TEXT);
+    let node;
+    while ((node = walker.nextNode())) {
+        const text = node.textContent.trim();
+        if (text)
+            result.push(text);
+    }
+    return result;
+}
+const KIT_KEYS = new Set(Object.keys(uiCoreTranslations));
+// Every legitimate string the kit itself ships, across all locales -- a short,
+// all-lowercase, no-space word can still be entirely legitimate rendered prose
+// (e.g. `Auth.LOGIN_OR`'s German value is literally "oder", which the bare
+// RAW_CODE shape below would otherwise flag as a raw backend code). Exempting
+// anything that IS one of the kit's own translated values keeps the check
+// looking for text that is NEITHER a key NOR a real translation -- which is
+// exactly what a leaked backend code is, and a legitimate short word never is.
+const KIT_VALUES = new Set(Object.values(uiCoreTranslations).flatMap((entry) => Object.values(entry)));
+function scanPage(container, name) {
+    return textNodes(container)
+        .filter((text) => (KIT_KEYS.has(text)
+        || (!KIT_VALUES.has(text) && text.length > 2 && RAW_CODE.test(text))))
+        .map((text) => ({
+        check: 'render',
+        reason: `${name} rendered raw kit key or backend code: ${text}`,
+    }));
+}
+async function renderPage(Page, wrapper, initialEntries = ['/']) {
+    const container = document.createElement('div');
+    const root = createRoot(container);
+    try {
+        await act(async () => {
+            root.render(React.createElement(MemoryRouter, { initialEntries }, React.createElement(wrapper, null, React.createElement(Page))));
+            await Promise.resolve();
+        });
+        return { container, findings: scanPage(container, pageName(Page)) };
+    }
+    finally {
+        await act(async () => {
+            root.unmount();
+        });
+    }
+}
+function transportFailure(config) {
+    return Promise.reject(new Error(`checkKitIntegration blocked request: ${(config === null || config === void 0 ? void 0 : config.url) || 'unknown'}`));
+}
+function loginFailure() {
+    return Promise.reject({
+        response: {
+            status: 400,
+            data: {
+                errors: [{
+                        code: 'invalid',
+                        param: 'email',
+                        message: 'The email address is invalid.',
+                    }],
+            },
+        },
+    });
+}
+async function renderFindings(Page, wrapper, initialEntries) {
+    try {
+        const rendered = await renderPage(Page, wrapper, initialEntries);
+        return rendered.findings;
+    }
+    catch (error) {
+        return [{
+                check: 'render',
+                reason: `${pageName(Page)} threw while rendering: ${(error === null || error === void 0 ? void 0 : error.message) || String(error)}`,
+            }];
+    }
+}
+async function errorTextFindings(i18n, wrapper) {
+    const Page = LoginPage;
+    const name = pageName(Page);
+    const container = document.createElement('div');
+    const root = createRoot(container);
+    try {
+        await act(async () => {
+            root.render(React.createElement(MemoryRouter, { initialEntries: ['/login'] }, React.createElement(wrapper, null, React.createElement(Page))));
+            await Promise.resolve();
+        });
+        const inputs = Array.from(container.querySelectorAll('input'));
+        const email = inputs.find((input) => input.type === 'email');
+        const password = inputs.find((input) => input.type === 'password');
+        const form = container.querySelector('form');
+        if (!email || !password || !form) {
+            return [{ check: 'error-text', reason: `${name} did not render its login form.` }];
+        }
+        const setValue = (input, value) => {
+            const setter = Object.getOwnPropertyDescriptor(input.ownerDocument.defaultView.HTMLInputElement.prototype, 'value').set;
+            setter.call(input, value);
+            input.dispatchEvent(new Event('input', { bubbles: true }));
+            input.dispatchEvent(new Event('change', { bubbles: true }));
+        };
+        await act(async () => {
+            setValue(email, 'not-an-email@example.com');
+            setValue(password, 'password');
+            form.dispatchEvent(new Event('submit', { bubbles: true, cancelable: true }));
+            await Promise.resolve();
+            await Promise.resolve();
+        });
+        const expected = i18n.t('Auth.field.email.invalid');
+        const renderedTexts = textNodes(container);
+        if (renderedTexts.includes(expected))
+            return [];
+        return [{
+                check: 'error-text',
+                reason: `${name} did not show ${expected} for the allauth invalid-email response.`,
+            }];
+    }
+    catch (error) {
+        return [{
+                check: 'error-text',
+                reason: `${name} error flow failed: ${(error === null || error === void 0 ? void 0 : error.message) || String(error)}`,
+            }];
+    }
+    finally {
+        await act(async () => {
+            root.unmount();
+        });
+    }
+}
+/** Check that an app's i18n instance and providers wire the kit pages correctly. */
+export async function checkKitIntegration({ i18n, wrapper, pages = [LoginPage, SignUpPage, PasswordInvitePage], }) {
+    const findings = [];
+    const languages = appLanguages(i18n);
+    const sharedLanguages = KIT_LANGUAGES.filter((language) => languages.includes(language));
+    for (const [key] of Object.entries(uiCoreTranslations)) {
+        for (const language of sharedLanguages) {
+            // fallbackLng: false forces a true per-language check -- without it, a
+            // consumer's own fallbackLng config (e.g. "en") would let a key missing
+            // in "fr" silently resolve through the fallback and read as present.
+            if (!(i18n === null || i18n === void 0 ? void 0 : i18n.exists(key, { lng: language, fallbackLng: false }))) {
+                findings.push({
+                    check: 'catalogue',
+                    reason: `Missing kit translation key ${key} for language ${language}.`,
+                });
+            }
+        }
+    }
+    if (!i18next.isInitialized || i18n !== i18next) {
+        findings.push({
+            check: 'instance',
+            reason: 'The app i18n is not the initialized kit default instance; Accept-Language will be missing or wrong.',
+        });
+    }
+    const originalAdapter = apiClient.defaults.adapter;
+    apiClient.defaults.adapter = async (config) => {
+        if ((config === null || config === void 0 ? void 0 : config.url) === LOGIN_PATH || String((config === null || config === void 0 ? void 0 : config.url) || '').endsWith(LOGIN_PATH)) {
+            return loginFailure();
+        }
+        return transportFailure(config);
+    };
+    try {
+        for (const Page of pages) {
+            findings.push(...await renderFindings(Page, wrapper));
+        }
+        findings.push(...await errorTextFindings(i18n, wrapper));
+    }
+    finally {
+        apiClient.defaults.adapter = originalAdapter;
+    }
+    return { findings };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@micha.bigler/ui-core-micha",
-  "version": "3.9.1",
+  "version": "3.10.0",
   "main": "dist/index.js",
   "module": "dist/index.js",
   "sideEffects": [

package/src/index.js

@@ -20,6 +20,9 @@ export {
   THEME_COMPLETENESS_SURFACES,
 } from './theme';
 
+// --- 0.1 Consumer integration ---
+export { checkKitIntegration } from './testing/checkKitIntegration';
+
 // --- 1. Auth Context (Essentiell für den Wrapper) ---
 export { AuthContext, AuthProvider } from './auth/AuthContext';
 export { UserMenu } from './auth/UserMenu';

package/src/testing/checkKitIntegration.js

@@ -0,0 +1,233 @@
+import React, { act } from 'react';
+import { createRoot } from 'react-dom/client';
+import { MemoryRouter } from 'react-router-dom';
+import i18next from 'i18next';
+
+import apiClient from '../auth/apiClient';
+import { LoginPage } from '../pages/LoginPage';
+import { SignUpPage } from '../pages/SignUpPage';
+import { PasswordInvitePage } from '../pages/PasswordInvitePage';
+import { uiCoreTranslations } from '../i18n/uiCoreTranslations';
+
+const KIT_LANGUAGES = ['de', 'en', 'fr', 'sw'];
+const LOGIN_PATH = '/api/auth/browser/v1/auth/login';
+const RAW_CODE = /^[a-z][a-z0-9_]*$/;
+
+function pageName(Page) {
+  return Page?.displayName || Page?.name || 'page';
+}
+
+function appLanguages(i18n) {
+  const candidates = [
+    i18n?.options?.supportedLngs,
+    Object.keys(i18n?.options?.resources || {}),
+    i18n?.languages,
+  ];
+
+  for (const candidate of candidates) {
+    const languages = Array.isArray(candidate)
+      ? candidate.filter((language) => language && language !== 'cimode')
+      : [];
+    if (languages.length > 0) return languages;
+  }
+  return [];
+}
+
+function textNodes(container) {
+  const result = [];
+  const document = container.ownerDocument;
+  const filter = document.defaultView?.NodeFilter || NodeFilter;
+  const walker = document.createTreeWalker(container, filter.SHOW_TEXT);
+  let node;
+  while ((node = walker.nextNode())) {
+    const text = node.textContent.trim();
+    if (text) result.push(text);
+  }
+  return result;
+}
+
+const KIT_KEYS = new Set(Object.keys(uiCoreTranslations));
+// Every legitimate string the kit itself ships, across all locales -- a short,
+// all-lowercase, no-space word can still be entirely legitimate rendered prose
+// (e.g. `Auth.LOGIN_OR`'s German value is literally "oder", which the bare
+// RAW_CODE shape below would otherwise flag as a raw backend code). Exempting
+// anything that IS one of the kit's own translated values keeps the check
+// looking for text that is NEITHER a key NOR a real translation -- which is
+// exactly what a leaked backend code is, and a legitimate short word never is.
+const KIT_VALUES = new Set(
+  Object.values(uiCoreTranslations).flatMap((entry) => Object.values(entry)),
+);
+
+function scanPage(container, name) {
+  return textNodes(container)
+    .filter((text) => (
+      KIT_KEYS.has(text)
+      || (!KIT_VALUES.has(text) && text.length > 2 && RAW_CODE.test(text))
+    ))
+    .map((text) => ({
+      check: 'render',
+      reason: `${name} rendered raw kit key or backend code: ${text}`,
+    }));
+}
+
+async function renderPage(Page, wrapper, initialEntries = ['/']) {
+  const container = document.createElement('div');
+  const root = createRoot(container);
+  try {
+    await act(async () => {
+      root.render(React.createElement(
+        MemoryRouter,
+        { initialEntries },
+        React.createElement(wrapper, null, React.createElement(Page)),
+      ));
+      await Promise.resolve();
+    });
+    return { container, findings: scanPage(container, pageName(Page)) };
+  } finally {
+    await act(async () => {
+      root.unmount();
+    });
+  }
+}
+
+function transportFailure(config) {
+  return Promise.reject(new Error(`checkKitIntegration blocked request: ${config?.url || 'unknown'}`));
+}
+
+function loginFailure() {
+  return Promise.reject({
+    response: {
+      status: 400,
+      data: {
+        errors: [{
+          code: 'invalid',
+          param: 'email',
+          message: 'The email address is invalid.',
+        }],
+      },
+    },
+  });
+}
+
+async function renderFindings(Page, wrapper, initialEntries) {
+  try {
+    const rendered = await renderPage(Page, wrapper, initialEntries);
+    return rendered.findings;
+  } catch (error) {
+    return [{
+      check: 'render',
+      reason: `${pageName(Page)} threw while rendering: ${error?.message || String(error)}`,
+    }];
+  }
+}
+
+async function errorTextFindings(i18n, wrapper) {
+  const Page = LoginPage;
+  const name = pageName(Page);
+  const container = document.createElement('div');
+  const root = createRoot(container);
+  try {
+    await act(async () => {
+      root.render(React.createElement(
+        MemoryRouter,
+        { initialEntries: ['/login'] },
+        React.createElement(wrapper, null, React.createElement(Page)),
+      ));
+      await Promise.resolve();
+    });
+
+    const inputs = Array.from(container.querySelectorAll('input'));
+    const email = inputs.find((input) => input.type === 'email');
+    const password = inputs.find((input) => input.type === 'password');
+    const form = container.querySelector('form');
+    if (!email || !password || !form) {
+      return [{ check: 'error-text', reason: `${name} did not render its login form.` }];
+    }
+
+    const setValue = (input, value) => {
+      const setter = Object.getOwnPropertyDescriptor(
+        input.ownerDocument.defaultView.HTMLInputElement.prototype,
+        'value',
+      ).set;
+      setter.call(input, value);
+      input.dispatchEvent(new Event('input', { bubbles: true }));
+      input.dispatchEvent(new Event('change', { bubbles: true }));
+    };
+
+    await act(async () => {
+      setValue(email, 'not-an-email@example.com');
+      setValue(password, 'password');
+      form.dispatchEvent(new Event('submit', { bubbles: true, cancelable: true }));
+      await Promise.resolve();
+      await Promise.resolve();
+    });
+
+    const expected = i18n.t('Auth.field.email.invalid');
+    const renderedTexts = textNodes(container);
+    if (renderedTexts.includes(expected)) return [];
+    return [{
+      check: 'error-text',
+      reason: `${name} did not show ${expected} for the allauth invalid-email response.`,
+    }];
+  } catch (error) {
+    return [{
+      check: 'error-text',
+      reason: `${name} error flow failed: ${error?.message || String(error)}`,
+    }];
+  } finally {
+    await act(async () => {
+      root.unmount();
+    });
+  }
+}
+
+/** Check that an app's i18n instance and providers wire the kit pages correctly. */
+export async function checkKitIntegration({
+  i18n,
+  wrapper,
+  pages = [LoginPage, SignUpPage, PasswordInvitePage],
+}) {
+  const findings = [];
+  const languages = appLanguages(i18n);
+  const sharedLanguages = KIT_LANGUAGES.filter((language) => languages.includes(language));
+
+  for (const [key] of Object.entries(uiCoreTranslations)) {
+    for (const language of sharedLanguages) {
+      // fallbackLng: false forces a true per-language check -- without it, a
+      // consumer's own fallbackLng config (e.g. "en") would let a key missing
+      // in "fr" silently resolve through the fallback and read as present.
+      if (!i18n?.exists(key, { lng: language, fallbackLng: false })) {
+        findings.push({
+          check: 'catalogue',
+          reason: `Missing kit translation key ${key} for language ${language}.`,
+        });
+      }
+    }
+  }
+
+  if (!i18next.isInitialized || i18n !== i18next) {
+    findings.push({
+      check: 'instance',
+      reason: 'The app i18n is not the initialized kit default instance; Accept-Language will be missing or wrong.',
+    });
+  }
+
+  const originalAdapter = apiClient.defaults.adapter;
+  apiClient.defaults.adapter = async (config) => {
+    if (config?.url === LOGIN_PATH || String(config?.url || '').endsWith(LOGIN_PATH)) {
+      return loginFailure();
+    }
+    return transportFailure(config);
+  };
+
+  try {
+    for (const Page of pages) {
+      findings.push(...await renderFindings(Page, wrapper));
+    }
+    findings.push(...await errorTextFindings(i18n, wrapper));
+  } finally {
+    apiClient.defaults.adapter = originalAdapter;
+  }
+
+  return { findings };
+}

package/tests/checkKitIntegration.test.jsx

@@ -0,0 +1,219 @@
+// @vitest-environment jsdom
+import React from 'react';
+import { afterEach, beforeAll, describe, expect, it, vi } from 'vitest';
+import i18next from 'i18next';
+import { I18nextProvider } from 'react-i18next';
+
+import apiClient from '../src/auth/apiClient';
+import { AuthContext } from '../src/auth/AuthContext';
+import { checkKitIntegration } from '../src/testing/checkKitIntegration';
+import { uiCoreTranslations } from '../src/i18n/uiCoreTranslations';
+import { LoginPage } from '../src/pages/LoginPage';
+
+const languages = ['de', 'en', 'fr', 'sw'];
+const authMethods = {
+  password_login: true,
+  password_reset: false,
+  signup: false,
+  signup_modes: [],
+  social_login: false,
+  passkey_login: false,
+};
+
+function resources() {
+  return Object.fromEntries(languages.map((language) => [language, {
+    translation: Object.fromEntries(
+      Object.entries(uiCoreTranslations).map(([key, values]) => [key, values[language]]),
+    ),
+  }]));
+}
+
+function makeWrapper(instance, authMethodsOverride = authMethods) {
+  return function FixtureWrapper({ children }) {
+    return (
+      <I18nextProvider i18n={instance}>
+        <AuthContext.Provider value={{
+          user: null,
+          loading: false,
+          login: vi.fn(),
+          authMethods: authMethodsOverride,
+        }}>
+          {children}
+        </AuthContext.Provider>
+      </I18nextProvider>
+    );
+  };
+}
+
+beforeAll(async () => {
+  globalThis.IS_REACT_ACT_ENVIRONMENT = true;
+  await i18next.init({
+    lng: 'en',
+    fallbackLng: false,
+    supportedLngs: languages,
+    resources: resources(),
+    keySeparator: false,
+    nsSeparator: false,
+    interpolation: { escapeValue: false },
+  });
+});
+
+afterEach(async () => {
+  await i18next.changeLanguage('en');
+  for (const language of languages) {
+    i18next.removeResourceBundle(language, 'translation');
+    i18next.addResourceBundle(language, 'translation', resources()[language].translation, true, true);
+  }
+});
+
+describe('checkKitIntegration', () => {
+  it('passes for a correctly wired app fixture', async () => {
+    const { findings } = await checkKitIntegration({
+      i18n: i18next,
+      wrapper: makeWrapper(i18next),
+      pages: [LoginPage],
+    });
+
+    expect(findings).toEqual([]);
+  });
+
+  it('does not flag a legitimate short lowercase translated word as a raw backend code', async () => {
+    // Auth.LOGIN_OR's German value is literally "oder" -- all-lowercase, no
+    // spaces, length 4 -- the exact shape a naive raw-code heuristic would
+    // false-positive on. Render LoginForm's sign-up/forgot-password divider
+    // (onSignUp truthy) in German to actually exercise that rendered text.
+    await i18next.changeLanguage('de');
+    const { findings } = await checkKitIntegration({
+      i18n: i18next,
+      wrapper: makeWrapper(i18next, { ...authMethods, signup: true, signup_modes: ['self_signup_open'] }),
+      pages: [LoginPage],
+    });
+
+    expect(findings).toEqual([]);
+  });
+
+  it('reports one catalogue finding for one missing language key', async () => {
+    const key = 'Auth.field.email.invalid';
+    const french = { ...resources().fr.translation };
+    delete french[key];
+    i18next.removeResourceBundle('fr', 'translation');
+    i18next.addResourceBundle('fr', 'translation', french, true, true);
+
+    const { findings } = await checkKitIntegration({
+      i18n: i18next,
+      wrapper: makeWrapper(i18next),
+      pages: [],
+    });
+
+    expect(findings).toHaveLength(1);
+    expect(findings[0]).toMatchObject({ check: 'catalogue' });
+    expect(findings[0].reason).toContain(`${key} for language fr`);
+  });
+
+  it('still reports a missing key when the consumer app configures a fallback language', async () => {
+    // A consumer typically sets fallbackLng (e.g. "en"), not "false" like the
+    // fixture above. Without forcing fallbackLng: false per-call, i18next's
+    // exists() would resolve the missing "fr" key through the fallback and
+    // read as present, masking the real gap this check exists to catch.
+    const key = 'Auth.field.email.invalid';
+    const french = { ...resources().fr.translation };
+    delete french[key];
+    i18next.removeResourceBundle('fr', 'translation');
+    i18next.addResourceBundle('fr', 'translation', french, true, true);
+    i18next.options.fallbackLng = 'en';
+
+    try {
+      const { findings } = await checkKitIntegration({
+        i18n: i18next,
+        wrapper: makeWrapper(i18next),
+        pages: [],
+      });
+
+      expect(findings).toHaveLength(1);
+      expect(findings[0]).toMatchObject({ check: 'catalogue' });
+      expect(findings[0].reason).toContain(`${key} for language fr`);
+    } finally {
+      i18next.options.fallbackLng = false;
+    }
+  });
+
+  it('reports when the app passes a separate i18next instance', async () => {
+    const separate = i18next.createInstance();
+    await separate.init({
+      lng: 'en',
+      fallbackLng: false,
+      supportedLngs: languages,
+      resources: resources(),
+      keySeparator: false,
+      nsSeparator: false,
+    });
+
+    const { findings } = await checkKitIntegration({
+      i18n: separate,
+      wrapper: makeWrapper(separate),
+      pages: [],
+    });
+
+    expect(findings.some(({ check }) => check === 'instance')).toBe(true);
+  });
+
+  it('reports a page when the consumer wrapper throws', async () => {
+    function ThrowingWrapper() {
+      throw new Error('provider exploded');
+    }
+
+    const before = apiClient.defaults.adapter;
+    const { findings } = await checkKitIntegration({
+      i18n: i18next,
+      wrapper: ThrowingWrapper,
+      pages: [LoginPage],
+    });
+
+    expect(findings.some(({ check, reason }) => check === 'render' && reason.includes('LoginPage'))).toBe(true);
+    expect(apiClient.defaults.adapter).toBe(before);
+  });
+
+  it('passes the exact invalid-email resolver regression through the real login page', async () => {
+    const { findings } = await checkKitIntegration({
+      i18n: i18next,
+      wrapper: makeWrapper(i18next),
+      pages: [],
+    });
+
+    expect(findings).toEqual([]);
+  });
+
+  it('restores the transport adapter after a successful check', async () => {
+    const before = apiClient.defaults.adapter;
+    await checkKitIntegration({
+      i18n: i18next,
+      wrapper: makeWrapper(i18next),
+      pages: [],
+    });
+    expect(apiClient.defaults.adapter).toBe(before);
+  });
+
+  it('no longer intercepts a real request once the check has finished', async () => {
+    // Proves the restore is functional, not just reference-equal: a request
+    // made AFTER the check completes must reach the app's own adapter, not
+    // the check's stub (which would reject it as "blocked" or fake a login
+    // failure for the allauth login path).
+    const sentinel = vi.fn().mockResolvedValue({ data: 'real-response', status: 200, headers: {}, config: {} });
+    const before = apiClient.defaults.adapter;
+    apiClient.defaults.adapter = sentinel;
+
+    try {
+      await checkKitIntegration({
+        i18n: i18next,
+        wrapper: makeWrapper(i18next),
+        pages: [],
+      });
+
+      const response = await apiClient.get('/api/some/path');
+      expect(sentinel).toHaveBeenCalled();
+      expect(response.data).toBe('real-response');
+    } finally {
+      apiClient.defaults.adapter = before;
+    }
+  });
+});

package/work-orders/UCM-TEST-1.md

@@ -0,0 +1,304 @@
+# UCM-TEST-1: A kit integration check every app runs in its own suite
+
+# A. Envelope, authored by the Expertenchat
+
+## Goal & expected outcome
+
+The kit's auth screens are the same code in every app, so their behaviour is accepted once, in the kit.
+What differs per app is **how the app wires the kit in**: its i18n setup, its providers around the kit's
+pages, the `i18next` instance the kit reads. Today each bump order writes its own tests for that, app by
+app, and the operator walked the same auth flows by hand in every app.
+
+After this order the kit ships **one exported check**, `checkKitIntegration`, that an app calls from a
+single test in its own suite. It returns findings in the style of `assertThemeComplete`: an empty list
+means the app's wiring is sound. Every later bump in every app then re-checks the wiring automatically.
+
+**Operator decisions (2026-10-01):** the check lives centrally in the kit, not as copies per app; a
+separate, automated staging smoke covers the runtime (`workflow-templates` `WFT-CI-31`); bumps already
+in flight are not held up, and apps adopt the check with their next bump.
+
+## Context the operator established
+
+- **Precedent for the shape:** `assertThemeComplete(theme)` returns `{ findings }`, is exported from the
+  package root (`src/index.js:12`), and apps assert `findings` equals `[]`.
+- **What apps load from the kit for i18n:** `uiCoreTranslations` (`src/i18n/uiCoreTranslations.js`),
+  which spreads the auth, charts, messaging, notifications, onboarding, section-nav and user-menu
+  catalogues. Apps spread it into their own i18next resources at start-up, **kit keys last** (e.g.
+  `survey_app/frontend/i18n/index.js`).
+- **Which `i18next` the kit reads:** `apiClient` imports the **default** `i18next` instance
+  (`src/auth/apiClient.jsx:2,13`) to send `Accept-Language`. Kit components read `t` and `i18n` from
+  `useTranslation()` (e.g. `src/pages/LoginPage.jsx:30`). `i18next`/`react-i18next` are peer
+  dependencies.
+- **What the per-app bump orders tested by hand** (`survey_app` `SVA-DEP-1`/`SVA-DEP-2`): the kit's
+  `SignUpPage` and `PasswordInvitePage` render inside the app's providers
+  (`survey_app/frontend/src/AuthRoutesIntegration.test.jsx`), and `i18n.exists('Auth.field.email.invalid')`
+  holds in the app's own i18n.
+- **The defect this guards against end to end:** a login with a malformed e-mail showed the raw code
+  `invalid` (`UCM-AUTH-10`). The kit's resolver fixes it, but only if the app's i18n carries the kit's
+  keys and the kit's pages run on the app's instance.
+- **Consumers measured 2026-09-30:** every consumer runs `vitest` with jsdom. Some mount `LoginPage`
+  twice (`webshop-guenter` also in `src/pages/pwa/StaffLoginPage.jsx`). Several mock `react-i18next`
+  globally in some test files.
+
+## The check (decided)
+
+`checkKitIntegration({ i18n, wrapper, pages })` -> `Promise<{ findings }>`, exported from the package
+root. `i18n` is the app's own instance, `wrapper` the app's own provider component (whatever the app
+puts around its routes), `pages` the kit pages the app mounts (default: the kit's auth pages that the
+app imports). Each finding names its check and a reason. Four checks:
+
+1. **Catalogue.** Every key in `uiCoreTranslations` resolves through the app's `i18n` in every language
+   that both the kit ships (`de`/`en`/`fr`/`sw`) and the app supports. A missing key is one finding,
+   with key and language.
+2. **Instance.** The default `i18next` instance is initialised and is the instance the app passed in.
+   Otherwise the finding says what will break: `Accept-Language` is missing or wrong.
+3. **Render.** Each page in `pages` renders inside `wrapper` without throwing, and no rendered text
+   node is a raw kit key (`Auth.*` or another key of the kit's catalogues) or a bare backend code. The
+   check stubs the kit's `apiClient` transport for its own duration, so no request leaves the test, and
+   restores it afterwards.
+4. **Error text.** `LoginPage` inside `wrapper` receives, through that stub, exactly the allauth response
+   from the original defect (`400`, `errors[0] = {code: "invalid", param: "email", message: ...}`). The
+   shown text equals the app-language text of `Auth.field.email.invalid`.
+
+## Scope + non-goals
+
+In scope: the function and its four checks; its export from the package root; a `README.md` section
+"Consumer integration check" with the one-line test an app writes; `CHANGELOG.md`; a **minor** release.
+
+Non-goals:
+- No change in any app. Adoption happens per app with its next bump, as its own row.
+- No runtime dependency added for consumers. Rendering uses the existing peers (`react`, `react-dom`).
+- No check of the app's test mocks. A suite whose mocks lack `i18n` still fails in that suite, as today.
+- No replacement for the kit's own tests. They keep owning the kit's behaviour.
+- No staging or browser check (`WFT-CI-31`).
+
+## Tier · precondition / gate
+
+- **Tier 3 · tests: each of the four checks with a passing and a failing case; the kit's existing auth
+  and i18n tests.** A change inside shared-core, on the auth surface.
+- Precondition: none.
+- Downstream: every app adopts it with its next kit bump. `WFT-CI-31` is independent of this order.
+
+## Risks
+
+- **A check that cannot fail is decoration.** Each check needs a test showing it reports the specific
+  defect: a missing key, a second `i18next` instance, a wrapper that throws, a raw code on screen.
+- **The transport stub must not leak.** If it is not restored, it silently swallows the requests of the
+  tests that run after it. Restore it even when a check throws.
+- **Kit keys that the app intentionally leaves untranslated** for a language it does not offer must not
+  become findings. Hence "languages both support" in check 1.
+- **Locally, importing the kit's root module crashes vitest's worker pool on this workstation**
+  (`fitness-monitor` `FM-15`). That is an environment issue: CI is the evidence. The check itself must not
+  add to the import weight of tests that do not call it.
+
+## Required tests to WRITE (you write them and run YOUR OWN new ones; the Orchestrator's run is the gate)
+
+Kit test suite, one new file:
+
+1. A correctly wired fixture app (own `i18n` with `uiCoreTranslations`, a provider wrapper) -> `findings`
+   equals `[]`.
+2. One key removed from the fixture's resources -> exactly one catalogue finding naming that key and
+   language.
+3. The fixture passes a separate `i18next` instance -> an instance finding.
+4. A wrapper that throws -> a render finding naming the page.
+5. The resolver bypassed (a fixture that shows `err.code`) -> an error-text finding.
+6. After the check, a request through `apiClient` is no longer stubbed.
+
+Run, do not write: the kit's existing auth and i18n tests.
+
+## Parity guardrail
+
+No change to any existing export, component or behaviour. The function is new and test-only in purpose.
+
+---
+
+# B. Implementation map, filled by the Orchestrator and ADDRESSED TO THE IMPLEMENTER
+
+## Context package
+
+### Where this lives, and what it may depend on
+
+- New file `src/testing/checkKitIntegration.js` (new subdirectory, mirroring how `src/theme/` groups
+  `assertThemeComplete`). Export `checkKitIntegration` from `src/index.js` at the root, next to the
+  existing theme-completeness exports (line ~10-21) — same section-style comment, same pattern.
+- **Hard constraint from the Non-goals: "Rendering uses the existing peers (react, react-dom)" —
+  this explicitly does NOT include `@testing-library/react`.** Every existing kit test uses RTL, but
+  RTL is a devDependency of THIS repo, not a declared peer dependency — if the shipped function
+  imported it, every consuming app would need RTL in its own `node_modules` at the exact version
+  this kit expects, silently, which is exactly the "no runtime dependency added for consumers" this
+  WO forbids. Render with plain `react-dom/client` (`createRoot`) and `act` from `react` — verified
+  now: `import { act } from 'react'` resolves and is a function on this repo's installed React
+  `19.2.6` (`node -e "console.log(typeof require('react').act)"` → `function`), so use that import,
+  not the legacy `react-dom/test-utils` path. Read rendered output via plain
+  DOM (`container.textContent`, `document.createTreeWalker`), not `screen`/`within`.
+- `react-router-dom` (`^7.15.1`) and `axios` (`^1.16.1`) ARE existing peers — safe to import
+  `MemoryRouter` and to manipulate the shared `apiClient` axios instance directly.
+
+### The four checks, in the order the Envelope lists them
+
+1. **Catalogue.** Import `{ uiCoreTranslations }` from `'../i18n/uiCoreTranslations'`. For each key,
+   for each language in the INTERSECTION of the kit's shipped languages
+   (`['de','en','fr','sw']`) and the app's own supported languages, assert
+   `i18n.exists(key, { lng: lang })` — **not** `i18n.exists(key)` alone, which only checks the
+   CURRENT active language; i18next's `exists`/`t` both accept an `lng` option to check a specific
+   language without switching the instance's active one (verify this against the installed
+   `i18next` version's own typings/source before relying on it — do not assume from memory).
+   Derive "the app's own supported languages" with this priority (first one that yields a
+   non-empty array): `i18n.options?.supportedLngs` (filter out falsy entries and the literal
+   string `'cimode'`, which i18next auto-adds) → `Object.keys(i18n.options?.resources || {})` →
+   `i18n.languages` (least reliable, only the currently-resolved fallback chain — last resort).
+   One finding per missing `(key, lang)` pair, naming both.
+2. **Instance.** Import the kit's OWN default `i18next` singleton (`import i18next from 'i18next'`
+   — the exact same import `src/auth/apiClient.jsx` already uses). Finding if `!i18next.isInitialized`
+   OR `i18n !== i18next` (reference inequality — the whole point is catching an app that created a
+   SEPARATE instance via `i18next.createInstance()` and wrapped its tree in its own
+   `I18nextProvider`, which is exactly the Risk `UCM-AUTH-10` named: the kit's `apiClient` would then
+   send `Accept-Language` from an uninitialized, different instance). Name what breaks in the
+   reason text (`Accept-Language` will be missing or wrong) — do not just say "mismatch".
+3. **Render.** For each page component in `pages` (default: `[LoginPage, SignUpPage,
+   PasswordInvitePage]` — the three pages `UCM-AUTH-9`/`UCM-AUTH-10` actually touched, and the same
+   set `survey_app`'s own `AuthRoutesIntegration.test.jsx` already covers by hand), render
+   `<MemoryRouter><Wrapper><Page /></Wrapper></MemoryRouter>` into a fresh detached `div` (own
+   `createRoot` per page, `root.unmount()` after each, even on failure — use try/finally per page,
+   not one try around the whole loop, so one page's render failure doesn't skip scanning the rest).
+   Wrap the render in `act(async () => { ... })` so effects/microtasks settle before you scan.
+   Catch a throw during render → one finding naming the page's display name (`Page.displayName ||
+   Page.name || 'page'`) and the error message; do NOT let it abort the whole check (catch per-page,
+   continue the loop). If it didn't throw, walk every text node
+   (`document.createTreeWalker(container, NodeFilter.SHOW_TEXT)`) and flag any whose TRIMMED content
+   either (a) exactly equals a key in `uiCoreTranslations` (a literal untranslated key leaking to
+   screen — the i18next missing-key echo), or (b) matches a bare lowercase/snake_case single-token
+   shape with no spaces, e.g. `/^[a-z][a-z0-9_]*$/` and length > 2 (the exact shape of the original
+   defect, a raw backend code like `invalid` — tune this pattern against Required Test #5's fixture
+   until it fires on that fixture and not on ordinary rendered prose; do not accept the first regex
+   that merely compiles). One finding per offending text node, naming the page and the text found.
+4. **Error text.** This check is not driven by the `pages` array — it ALWAYS specifically exercises
+   `LoginPage` (imported directly by this module), because it is testing the kit's resolver wiring
+   through a real submit flow, not generic rendering. Render `LoginPage` the same way as check 3.
+   Stub the credentials-login POST specifically — exact path, verified now:
+   `/api/auth/browser/v1/auth/login` (`src/auth/authConfig.jsx`'s `HEADLESS_BASE` +
+   `src/auth/authApi.jsx:99`'s `loginWithPassword`) — to reject with EXACTLY
+   the operator's original defect shape:
+   `{ response: { status: 400, data: { errors: [{ code: 'invalid', param: 'email', message: '<some
+   backend text>' }] } } }` (a plain object is sufficient — `resolveErrorText`/`extractErrorInfo`
+   only ever read `.response?.status`/`.response?.data` off the rejected value, nothing
+   AxiosError-specific). Fill the email/password inputs via plain DOM (`input.value = '...'` +
+   dispatching a real `input`/`change` `Event` so React's controlled-input `onChange` fires —
+   `Object.getOwnPropertyDescriptor` trick may be needed to set a native input value in a way React
+   notices; this is a well-known React-testing gotcha independent of any test-utility library, look
+   it up if the naive `input.value = x; input.dispatchEvent(new Event('input'))` doesn't trigger the
+   controlled state update) and submit (dispatch a `submit` Event on the form, or `.click()` the
+   submit button). `await act(async () => { ...await flush... })` until the error text renders.
+   Assert the rendered text equals `i18n.t('Auth.field.email.invalid')` evaluated in the APP's
+   current active language (`i18n.language`), read via the SAME walk-and-scan helper check 3 uses
+   (do not duplicate the scanning logic — factor it into one shared helper both checks call).
+
+### Stubbing `apiClient` — must never leak, must restore even on throw
+
+`apiClient` (`src/auth/apiClient.jsx`, default export, an axios instance) is shared, module-singleton
+state — the SAME instance every kit page uses. Capture `const originalAdapter =
+apiClient.defaults.adapter;` BEFORE check 3 starts, install a replacement
+(`apiClient.defaults.adapter = async (config) => { ... }`) that, by default, REJECTS every request
+(so check 3's page renders — which must not make real network calls at all — fail loudly if they
+accidentally do, rather than hanging on a real fetch), and for check 4 specifically, additionally
+matches on `config.url` to return the fixture rejection ONLY for the login endpoint
+(`HEADLESS_BASE`-relative, check `src/auth/authApi.jsx`'s `loginWithPassword` for the exact path) and
+the default reject-everything behaviour for anything else. **Wrap the ENTIRE checks 3+4 body in a
+`try { ... } finally { apiClient.defaults.adapter = originalAdapter; }`** — the restore must run even
+if a render throws an error this code doesn't catch, even if an `expect`-shaped helper you write
+itself throws. This is Required Test #6's whole point and the Risk note's explicit warning.
+
+### `README.md` — "Consumer integration check" section
+
+One short section with the one-line test an app writes, e.g.:
+```js
+import { checkKitIntegration } from '@micha.bigler/ui-core-micha';
+import i18n from '../i18n'; // the app's own initialised default i18next instance
+import { AppProviders } from '../AppProviders'; // whatever the app wraps its routes in
+
+it('kit integration is sound', async () => {
+  const { findings } = await checkKitIntegration({ i18n, wrapper: AppProviders });
+  expect(findings).toEqual([]);
+});
+```
+Name the default `pages` set explicitly (`LoginPage`, `SignUpPage`, `PasswordInvitePage`) and that an
+app can pass its own `pages` array to cover more/fewer pages.
+
+### Test file — new, next to the existing kit tests (e.g. `tests/checkKitIntegration.test.js`)
+
+Build ONE minimal fixture i18next instance + a trivial `Wrapper` (e.g. just renders `children`, or a
+thin `AuthContext.Provider` with a fake user so `LoginPage`'s own context read doesn't throw) reused
+across the 6 Required Tests, each test mutating ONE thing away from "correctly wired":
+1. Correctly wired fixture (own real `i18next.createInstance()` seeded with `uiCoreTranslations` in
+   all 4 kit languages, THIS instance also assigned as the global default — i.e. do not create a
+   second competing instance for the "passing" case, since check 2 would then always fail; for a
+   realistic "app's own instance IS the default" fixture either call `i18next.init(...)` on the
+   real default singleton directly, matching how an app actually does it, or structure the fixture
+   so the "instance" check specifically is satisfiable) → `findings` is `[]`.
+2. Remove one key's resources for one language from the fixture → exactly one catalogue finding
+   naming that key and language.
+3. Pass a SEPARATE `i18next.createInstance()` as `i18n` instead of the default singleton → an
+   instance finding.
+4. A `wrapper` that throws during render → a render finding naming the page.
+5. **The actual regression proof:** stub the login POST to reject with the operator's exact shape
+   but WITHOUT going through the kit's resolver (simulate "the resolver bypassed" by using a fixture
+   `LoginPage`-equivalent harness only if you must — more directly: this is best proven by reverting
+   `resolveErrorText`'s field-key step locally, confirming check 4 then reports an error-text
+   finding instead of passing, then restoring — narrate this in `PROGRESS` as the transient
+   mutation proof, same pattern as `UCM-AUTH-11`/`UCM-THEME-15` in this repo, rather than leaving a
+   permanently reverted copy in the committed suite).
+6. After calling `checkKitIntegration(...)` once, assert `apiClient.defaults.adapter` is back to
+   whatever it was before the call (capture the reference beforehand) — proves restoration even on
+   the success path; also add a case that makes an internal step throw (e.g. a page whose render
+   throws) and still assert the adapter was restored afterwards (the `try/finally` must cover the
+   failure path too, not just the happy path).
+
+Run, do not write: the kit's existing auth and i18n tests (grep `tests/` for
+`i18nAggregate`/`authErrors`/`resolveErrorText`/`loginPageErrorResolution` — these are the
+directly-dependent set the Orchestrator re-runs as the gate).
+
+## Do-not-touch / invariants
+
+- No change to any existing export, component, or behaviour (Parity guardrail) — this is a new,
+  additive, test-only function.
+- Do not add `@testing-library/react` (or any other new package) to `dependencies`,
+  `peerDependencies`, or `devDependencies` for this function's own sake.
+- Do not touch `apiClient.jsx`'s actual interceptors/exports — only reach into
+  `apiClient.defaults.adapter` from the NEW module, temporarily, with a guaranteed restore.
+
+---
+
+# C. Orchestrator only, NOT ADDRESSED TO THE IMPLEMENTER
+
+> **If you are the implementer reading this work order as your own specification: STOP at this line.**
+> Everything below describes what the Orchestrator does AFTER you finish. You do none of it: no
+> reviewers, no verification run, no register edit, no `git add`/`commit`/`push`.
+
+### Execution directive
+
+Check `.claude/codex-status.md` first (newest-first; read it with `head`). No line for today means use
+Codex. Before `git push`, run `git log origin/main..HEAD` and push only if every listed commit is this
+order's (parallel sessions share this checkout).
+
+### Review routing
+
+Tier 3: independent `reviewer` (all configured lenses) and `ui_reviewer`, concurrent, one batch, before
+the commit. No `sec_reviewer`: the function adds no runtime path, it only reads what is already there.
+
+### Verification
+
+Run the check once against a real consumer before release. `survey_app` is on `3.9.x` and has the closest
+existing test (`frontend/src/AuthRoutesIntegration.test.jsx`). Do it from a scratch copy or a local pack,
+never by committing to that repo. Name the result in the register Notiz.
+
+### Register + commit + release
+
+Row -> `done` with the review Notiz in the `AGENTS.md` shape and the published version. The publish
+runs on push to `main` when `package.json`/`src/**` change; verify it through the job log
+(`npm view` lags for provenance publishes). Adoption rows per app are added by the Expertenchat when
+each app's next bump is scoped.
+
+### Mini-handover
+
+`Orchestrator: implement work-orders/UCM-TEST-1.md in ui-core-micha (main). git pull first, read the WO,
+then follow orchestrate-codex.`