feat: collect infrastructure dependency inventories

docs/CONFIGURATION_PACKAGES.md

@@ -200,6 +200,19 @@ Feature providers remain responsible for their own semantics:
 Ops projects the same Core-validated receipt. It must not maintain a second
 parser with different validation or secret-handling rules.
 
+Core also defines the inverse, read-only dependency-inventory contract used
+before the installer changes one of those infrastructure capabilities. An
+enabled module registers
+`infrastructure.dependency_inventory.<module_id>` and returns bounded, stable
+references to its persisted configuration or data, a lifecycle state, scope,
+numeric metrics, and a required operator action. Providers must not return
+secrets or use this read to migrate state. The Core collector validates provider
+identity and capability coverage, orders records deterministically, and marks
+the complete inventory failed when any provider raises or violates the
+contract. Ops is the authorized projection boundary; the installer remains the
+consumer and must match installation id, freshness, completion and impacted
+capability coverage before apply.
+
 The admin wizard backend starts with these routes:
 
 - `GET /api/v1/admin/configuration-packages/catalog`

docs/LOCALIZATION_AND_HELP_QUALITY.md

@@ -103,6 +103,14 @@ modal at narrow widths, closes with Escape, and restores focus to the triggering
 control. Module journeys should add their own exact high-risk mappings; they do
 not need to reimplement the keyboard or dialog mechanics.
 
+The same conformance suite mounts the production Forms Runtime self-service and
+assisted Anwohnerparkausweis surfaces with German module translations. Desktop
+and mobile runs traverse native controls by keyboard, inspect accessible names
+and landmarks, run WCAG 2.1 A/AA automation, verify responsive overflow, and
+retain independent per-field assisted provenance. Physical assistive-technology
+spot checks remain release evidence rather than being represented as browser
+automation.
+
 ## Verification
 
 ```bash

docs/UI_UX_DECISION_LEDGER.md

@@ -236,7 +236,9 @@ instead of reproducing their behavior.
   not self-explanatory.
 - `help` content is contextual guidance, not the accessible name. The persisted
   `show_inline_help_hints` user preference hides only the `InlineHelp` marker by
-  applying `ui-hide-help-hints` at the document root.
+  applying `ui-hide-help-hints` at the document root. When shown, the shared
+  marker is a labelled, keyboard-focusable help control and exposes its tooltip
+  on focus as well as pointer hover.
 - Shared action-bearing components accept an optional disabled reason. In
   particular, `MailServerSettingsPanel` forwards protocol-specific test
   blockers into the shared focusable disabled-action tooltip; modules provide

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "govoplan-core"
-version = "0.1.40"
+version = "0.1.42"
 description = "Reusable GovOPlaN platform core, access, tenancy, and RBAC components."
 readme = "README.md"
 requires-python = ">=3.12"

src/govoplan_core/core/infrastructure_capabilities.py

@@ -2,14 +2,18 @@ from __future__ import annotations
 
 from collections.abc import Mapping
 from dataclasses import dataclass
+from datetime import UTC, datetime
 import json
 import os
 from pathlib import Path
 import re
-from typing import Any
+from typing import Any, Protocol, runtime_checkable
 
 
 DEPLOYMENT_CAPABILITIES_ENV = "GOVOPLAN_DEPLOYMENT_CAPABILITIES_PATH"
+INFRASTRUCTURE_DEPENDENCY_PROVIDER_CAPABILITY_PREFIX = (
+    "infrastructure.dependency_inventory."
+)
 MAX_CAPABILITY_DOCUMENT_BYTES = 256 * 1024
 CAPABILITY_STATES = frozenset(
     {
@@ -20,12 +24,125 @@ CAPABILITY_STATES = frozenset(
     }
 )
 _ENV_REFERENCE_RE = re.compile(r"^env:[A-Za-z_][A-Za-z0-9_]*$")
+_DEPENDENCY_STATES = frozenset(
+    {"active", "inactive", "data_present", "pending_work", "runtime_binding"}
+)
 
 
 class InfrastructureCapabilityReceiptError(ValueError):
     pass
 
 
+@dataclass(frozen=True, slots=True)
+class InfrastructureDependency:
+    """A non-secret module-owned dependency on deployment infrastructure."""
+
+    capability_id: str
+    module_id: str
+    dependency_type: str
+    dependency_ref: str
+    state: str
+    scope: str
+    summary: str
+    metrics: Mapping[str, int]
+    required_action: str
+
+    def __post_init__(self) -> None:
+        for field_name, value, maximum in (
+            ("capability_id", self.capability_id, 120),
+            ("module_id", self.module_id, 120),
+            ("dependency_type", self.dependency_type, 120),
+            ("dependency_ref", self.dependency_ref, 240),
+            ("scope", self.scope, 120),
+            ("summary", self.summary, 1000),
+            ("required_action", self.required_action, 1000),
+        ):
+            if (
+                not value.strip()
+                or len(value) > maximum
+                or any(ord(char) < 32 for char in value)
+            ):
+                raise ValueError(
+                    f"Infrastructure dependency {field_name} is invalid."
+                )
+        if self.state not in _DEPENDENCY_STATES:
+            raise ValueError(
+                f"Infrastructure dependency state is unsupported: {self.state!r}."
+            )
+        if len(self.metrics) > 20 or any(
+            not isinstance(key, str)
+            or not key.strip()
+            or len(key) > 80
+            or any(ord(char) < 32 for char in key)
+            or type(value) is not int
+            or value < 0
+            for key, value in self.metrics.items()
+        ):
+            raise ValueError("Infrastructure dependency metrics are invalid.")
+
+    def to_dict(self) -> dict[str, object]:
+        return {
+            "capability_id": self.capability_id,
+            "module_id": self.module_id,
+            "dependency_type": self.dependency_type,
+            "dependency_ref": self.dependency_ref,
+            "state": self.state,
+            "scope": self.scope,
+            "summary": self.summary,
+            "metrics": dict(sorted(self.metrics.items())),
+            "required_action": self.required_action,
+        }
+
+
+@runtime_checkable
+class InfrastructureDependencyProvider(Protocol):
+    module_id: str
+    capability_ids: tuple[str, ...]
+
+    def infrastructure_dependencies(self) -> tuple[InfrastructureDependency, ...]:
+        ...
+
+
+@dataclass(frozen=True, slots=True)
+class InfrastructureDependencyProviderReport:
+    module_id: str
+    capability_ids: tuple[str, ...]
+    state: str
+    dependency_count: int
+    error: str | None = None
+
+    def to_dict(self) -> dict[str, object]:
+        return {
+            "module_id": self.module_id,
+            "capability_ids": list(self.capability_ids),
+            "state": self.state,
+            "dependency_count": self.dependency_count,
+            "error": self.error,
+        }
+
+
+@dataclass(frozen=True, slots=True)
+class InfrastructureDependencyInventory:
+    installation_id: str
+    generated_at: str
+    complete: bool
+    inspected_capability_ids: tuple[str, ...]
+    providers: tuple[InfrastructureDependencyProviderReport, ...]
+    dependencies: tuple[InfrastructureDependency, ...]
+    schema_version: int = 1
+
+    def to_dict(self) -> dict[str, object]:
+        return {
+            "schema_version": self.schema_version,
+            "installation_id": self.installation_id,
+            "generated_at": self.generated_at,
+            "complete": self.complete,
+            "inspected_capability_ids": list(self.inspected_capability_ids),
+            "providers": [item.to_dict() for item in self.providers],
+            "dependencies": [item.to_dict() for item in self.dependencies],
+        }
+
+
 @dataclass(frozen=True, slots=True)
 class InfrastructureCapability:
     id: str
@@ -214,6 +331,134 @@ def deployment_capability_status(
     }
 
 
+def collect_infrastructure_dependency_inventory(
+    registry: object,
+    *,
+    installation_id: str,
+    observed_at: datetime | None = None,
+) -> InfrastructureDependencyInventory:
+    """Collect actual module-owned dependencies without importing module internals."""
+
+    normalized_installation_id = installation_id.strip()
+    if not normalized_installation_id or len(normalized_installation_id) > 100:
+        raise ValueError("Infrastructure dependency installation id is invalid.")
+    capability_names = getattr(registry, "capability_names", None)
+    capability = getattr(registry, "capability", None)
+    if not callable(capability_names) or not callable(capability):
+        raise ValueError("Infrastructure dependency inventory requires a module registry.")
+
+    provider_names = tuple(
+        name
+        for name in capability_names()
+        if isinstance(name, str)
+        and name.startswith(INFRASTRUCTURE_DEPENDENCY_PROVIDER_CAPABILITY_PREFIX)
+    )
+    reports: list[InfrastructureDependencyProviderReport] = []
+    dependencies: list[InfrastructureDependency] = []
+    inspected_capability_ids: set[str] = set()
+    complete = True
+
+    for provider_name in sorted(provider_names):
+        expected_module_id = provider_name.removeprefix(
+            INFRASTRUCTURE_DEPENDENCY_PROVIDER_CAPABILITY_PREFIX
+        )
+        module_id = expected_module_id or "unknown"
+        declared_ids: tuple[str, ...] = ()
+        try:
+            provider = capability(provider_name)
+            if not isinstance(provider, InfrastructureDependencyProvider):
+                raise TypeError("provider does not implement the inventory contract")
+            module_id = provider.module_id.strip()
+            declared_ids = tuple(
+                sorted(
+                    {
+                        item.strip()
+                        for item in provider.capability_ids
+                        if isinstance(item, str) and item.strip()
+                    }
+                )
+            )
+            if (
+                module_id != expected_module_id
+                or len(module_id) > 120
+                or any(ord(char) < 32 for char in module_id)
+                or not declared_ids
+                or len(declared_ids) > 30
+                or any(
+                    len(item) > 120 or any(ord(char) < 32 for char in item)
+                    for item in declared_ids
+                )
+            ):
+                raise ValueError("provider identity or capability declaration is invalid")
+            provider_dependencies = tuple(provider.infrastructure_dependencies())
+            if len(provider_dependencies) > 10_000:
+                raise ValueError("provider dependency inventory is too large")
+            seen_refs: set[tuple[str, str, str]] = set()
+            for item in provider_dependencies:
+                if not isinstance(item, InfrastructureDependency):
+                    raise TypeError("provider returned an invalid dependency")
+                if item.module_id != module_id or item.capability_id not in declared_ids:
+                    raise ValueError("provider returned a dependency outside its declaration")
+                identity = (
+                    item.capability_id,
+                    item.dependency_type,
+                    item.dependency_ref,
+                )
+                if identity in seen_refs:
+                    raise ValueError("provider returned a duplicate dependency")
+                seen_refs.add(identity)
+            if len(dependencies) + len(provider_dependencies) > 10_000:
+                raise ValueError("combined dependency inventory is too large")
+            dependencies.extend(provider_dependencies)
+            inspected_capability_ids.update(declared_ids)
+            reports.append(
+                InfrastructureDependencyProviderReport(
+                    module_id=module_id,
+                    capability_ids=declared_ids,
+                    state="complete",
+                    dependency_count=len(provider_dependencies),
+                )
+            )
+        except Exception as exc:
+            complete = False
+            inspected_capability_ids.update(declared_ids)
+            reports.append(
+                InfrastructureDependencyProviderReport(
+                    module_id=module_id,
+                    capability_ids=declared_ids,
+                    state="error",
+                    dependency_count=0,
+                    error=(
+                        f"{type(exc).__name__}: provider inventory could not be completed"
+                    ),
+                )
+            )
+
+    timestamp = observed_at or datetime.now(UTC)
+    if timestamp.tzinfo is None:
+        timestamp = timestamp.replace(tzinfo=UTC)
+    return InfrastructureDependencyInventory(
+        installation_id=normalized_installation_id,
+        generated_at=timestamp.astimezone(UTC).isoformat(),
+        complete=complete,
+        inspected_capability_ids=tuple(sorted(inspected_capability_ids)),
+        providers=tuple(
+            sorted(reports, key=lambda item: (item.module_id, item.capability_ids))
+        ),
+        dependencies=tuple(
+            sorted(
+                dependencies,
+                key=lambda item: (
+                    item.capability_id,
+                    item.module_id,
+                    item.dependency_type,
+                    item.dependency_ref,
+                ),
+            )
+        ),
+    )
+
+
 def _capability(value: object) -> InfrastructureCapability:
     if not isinstance(value, Mapping):
         raise InfrastructureCapabilityReceiptError(
@@ -352,10 +597,16 @@ def _unavailable_status(*, configured: bool, error: str | None) -> dict[str, obj
 __all__ = [
     "CAPABILITY_STATES",
     "DEPLOYMENT_CAPABILITIES_ENV",
+    "INFRASTRUCTURE_DEPENDENCY_PROVIDER_CAPABILITY_PREFIX",
     "InfrastructureCapability",
     "InfrastructureCapabilityReceipt",
     "InfrastructureCapabilityReceiptError",
+    "InfrastructureDependency",
+    "InfrastructureDependencyInventory",
+    "InfrastructureDependencyProvider",
+    "InfrastructureDependencyProviderReport",
     "InfrastructurePostInstallTask",
+    "collect_infrastructure_dependency_inventory",
     "deployment_capability_status",
     "infrastructure_capability_receipt_from_mapping",
     "load_infrastructure_capability_receipt",

tests/test_infrastructure_capabilities.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 import json
 import os
+from datetime import UTC, datetime
 from pathlib import Path
 import tempfile
 import unittest
@@ -9,12 +10,53 @@ from unittest.mock import patch
 
 from govoplan_core.core.infrastructure_capabilities import (
     InfrastructureCapabilityReceiptError,
+    InfrastructureDependency,
+    collect_infrastructure_dependency_inventory,
     deployment_capability_status,
     infrastructure_capability_receipt_from_mapping,
     load_infrastructure_capability_receipt,
 )
 
 
+class _InventoryProvider:
+    module_id = "mail"
+    capability_ids = ("mail.smtp",)
+
+    def infrastructure_dependencies(self) -> tuple[InfrastructureDependency, ...]:
+        return (
+            InfrastructureDependency(
+                capability_id="mail.smtp",
+                module_id="mail",
+                dependency_type="smtp_endpoint",
+                dependency_ref="mail-server:server-1",
+                state="active",
+                scope="system",
+                summary="One active SMTP endpoint uses the deployment relay.",
+                metrics={"credential_binding_count": 1},
+                required_action="Rebind or retire the endpoint before removal.",
+            ),
+        )
+
+
+class _FailingInventoryProvider:
+    module_id = "files"
+    capability_ids = ("files.storage",)
+
+    def infrastructure_dependencies(self) -> tuple[InfrastructureDependency, ...]:
+        raise RuntimeError("database URL must not escape")
+
+
+class _Registry:
+    def __init__(self, providers: dict[str, object]) -> None:
+        self.providers = providers
+
+    def capability_names(self) -> tuple[str, ...]:
+        return tuple(self.providers)
+
+    def capability(self, name: str) -> object | None:
+        return self.providers.get(name)
+
+
 def _receipt_payload() -> dict[str, object]:
     return {
         "schema_version": 1,
@@ -48,6 +90,40 @@ def _receipt_payload() -> dict[str, object]:
 
 
 class InfrastructureCapabilityReceiptTests(unittest.TestCase):
+    def test_collects_non_secret_provider_dependency_inventory(self) -> None:
+        inventory = collect_infrastructure_dependency_inventory(
+            _Registry(
+                {
+                    "infrastructure.dependency_inventory.mail": _InventoryProvider(),
+                    "unrelated.capability": object(),
+                }
+            ),
+            installation_id="govoplan-test",
+            observed_at=datetime(2026, 8, 24, 12, 0, tzinfo=UTC),
+        )
+
+        self.assertTrue(inventory.complete)
+        self.assertEqual(("mail.smtp",), inventory.inspected_capability_ids)
+        self.assertEqual("mail-server:server-1", inventory.dependencies[0].dependency_ref)
+        self.assertEqual("2026-08-24T12:00:00+00:00", inventory.generated_at)
+        self.assertNotIn("database URL", json.dumps(inventory.to_dict()))
+
+    def test_provider_failure_makes_inventory_incomplete_without_leaking_error(self) -> None:
+        inventory = collect_infrastructure_dependency_inventory(
+            _Registry(
+                {
+                    "infrastructure.dependency_inventory.files": (
+                        _FailingInventoryProvider()
+                    )
+                }
+            ),
+            installation_id="govoplan-test",
+        )
+
+        self.assertFalse(inventory.complete)
+        self.assertEqual("error", inventory.providers[0].state)
+        self.assertNotIn("database URL", str(inventory.providers[0].error))
+
     def test_parses_typed_capability_and_task_lookup(self) -> None:
         receipt = infrastructure_capability_receipt_from_mapping(_receipt_payload())
 

webui/conformance/ConformanceApp.tsx

@@ -1,6 +1,9 @@
 import { useMemo, useState } from "react";
 import { FileText, GitBranch, Inbox, Search, ShieldCheck } from "lucide-react";
 import { useLocation } from "react-router";
+import FormInstancePage from "../../../govoplan-forms-runtime/webui/src/features/forms/FormInstancePage";
+import FormsRuntimePage from "../../../govoplan-forms-runtime/webui/src/features/forms/FormsRuntimePage";
+import PublicFormPage from "../../../govoplan-forms-runtime/webui/src/features/forms/PublicFormPage";
 import QuickAccessRail from "../../../govoplan-quick-access/webui/src/components/QuickAccessRail";
 import ActionToolbar from "../src/components/ActionToolbar";
 import Button from "../src/components/Button";
@@ -40,6 +43,16 @@ export default function ConformanceApp() {
   const [editorDirty, setEditorDirty] = useState(true);
   const [metricDrilldown, setMetricDrilldown] = useState("");
 
+  if (location.pathname.startsWith("/forms/public/")) {
+    return <PublicFormPage settings={CONFORMANCE_SETTINGS} auth={FORMS_RUNTIME_AUTH} />;
+  }
+  if (location.pathname === "/forms-runtime") {
+    return <FormsRuntimePage settings={CONFORMANCE_SETTINGS} auth={FORMS_RUNTIME_AUTH} />;
+  }
+  if (location.pathname.startsWith("/forms-runtime/")) {
+    return <FormInstancePage settings={CONFORMANCE_SETTINGS} auth={FORMS_RUNTIME_AUTH} />;
+  }
+
   return (
     <main className="conformance-root" data-conformance-id="shared-ui-lab">
       <PageLayout
@@ -290,6 +303,16 @@ const CONFORMANCE_AUTH = {
   groups_loaded: true
 } satisfies AuthInfo;
 
+const FORMS_RUNTIME_AUTH = {
+  ...CONFORMANCE_AUTH,
+  scopes: [
+    "forms_runtime:submission:assist",
+    "forms_runtime:submission:participate",
+    "forms_runtime:workspace:read",
+    "forms_runtime:workspace:write"
+  ]
+} satisfies AuthInfo;
+
 const CONFORMANCE_SETTINGS: ApiSettings = {
   apiBaseUrl: "",
   apiKey: "",

webui/conformance/QuickAccessCoreFacade.ts

@@ -1,20 +1,52 @@
-// Narrow facade used only by the conformance build. It lets the optional
+// Narrow facade used only by the conformance build. It lets optional modules
-// Quick Access module exercise its real rail without pulling the composed
+// exercise their real task surfaces without pulling the composed application's
-// application's generated module catalogue into this isolated test bundle.
+// generated module catalogue into this isolated test bundle.
-export { apiFetch } from "../src/api/client";
+export { apiFetch, apiPath } from "../src/api/client";
+export { default as ActionBlockerHint } from "../src/components/ActionBlockerHint";
+export { default as ActionToolbar } from "../src/components/ActionToolbar";
+export { default as Button } from "../src/components/Button";
+export { default as ConfirmDialog } from "../src/components/ConfirmDialog";
+export { default as DescriptionList, DescriptionItem } from "../src/components/DescriptionList";
+export { default as Dialog } from "../src/components/Dialog";
+export { DialogForm, DialogSection } from "../src/components/DialogAnatomy";
 export { default as DismissibleAlert } from "../src/components/DismissibleAlert";
 export { default as DocumentationHelpLink } from "../src/components/help/DocumentationHelpLink";
+export type { DocumentationHelpReference } from "../src/components/help/documentationHelp";
+export { default as FileDropZone } from "../src/components/FileDropZone";
+export { default as FormField } from "../src/components/FormField";
+export { FormGrid } from "../src/components/ContentGrid";
 export { default as IconButton } from "../src/components/IconButton";
 export { default as LoadingFrame } from "../src/components/LoadingFrame";
-export { useGuardedNavigate } from "../src/components/UnsavedChangesGuard";
+export { default as LoadingIndicator } from "../src/components/LoadingIndicator";
-export { usePlatformLanguage } from "../src/i18n/LanguageContext";
+export { default as PageScrollViewport } from "../src/components/PageScrollViewport";
+export {
+  default as SelectionList,
+  SelectionListItem,
+  SelectionListItemContent
+} from "../src/components/SelectionList";
+export { default as StatePanel } from "../src/components/StatePanel";
+export { default as StatusBadge } from "../src/components/StatusBadge";
+export { default as ToggleSwitch } from "../src/components/ToggleSwitch";
+export {
+  useGuardedNavigate,
+  useUnsavedDraftGuard
+} from "../src/components/UnsavedChangesGuard";
+export {
+  i18nMessage,
+  usePlatformLanguage
+} from "../src/i18n/LanguageContext";
+export { usePlatformModuleInstalled } from "../src/platform/ModuleContext";
 export {
   dispatchQuickAccessResult,
   quickAccessLaunchState
 } from "../src/platform/launchContext";
-export { i18nMessage } from "../src/i18n/LanguageContext";
+export { hasScope } from "../src/utils/permissions";
+export { default as WorkspaceActionBar } from "../src/components/WorkspaceActionBar";
+export { default as WorkspaceFrame } from "../src/components/WorkspaceFrame";
 export type {
   ApiSettings,
+  PlatformRouteContext,
+  PlatformTranslations,
   QuickAccessRailProps,
   QuickAccessToolsUiCapability
 } from "../src/types";

webui/conformance/main.tsx

@@ -1,7 +1,8 @@
 import React from "react";
 import ReactDOM from "react-dom/client";
-import { BrowserRouter } from "react-router";
+import { BrowserRouter, Route, Routes } from "react-router";
 import ConformanceApp from "./ConformanceApp";
+import { generatedTranslations as formsRuntimeTranslations } from "../../../govoplan-forms-runtime/webui/src/i18n/generatedTranslations";
 import { UnsavedChangesProvider } from "../src/components/UnsavedChangesGuard";
 import { PlatformLanguageProvider } from "../src/i18n/LanguageContext";
 import { PlatformModulesProvider } from "../src/platform/ModuleContext";
@@ -14,6 +15,7 @@ import "../src/styles/badges.css";
 import "../src/styles/components.css";
 import "../src/styles/dialogs.css";
 import "@govoplan/quick-access-webui/styles/quick-access.css";
+import "../../../govoplan-forms-runtime/webui/src/styles/forms-runtime.css";
 import "./conformance.css";
 
 const theme = new URLSearchParams(window.location.search).get("theme");
@@ -35,9 +37,15 @@ ReactDOM.createRoot(document.getElementById("root")!).render(
   <React.StrictMode>
     <BrowserRouter>
       <PlatformModulesProvider modules={CONFORMANCE_MODULES}>
-        <PlatformLanguageProvider preferredLanguageCode="de">
+        <PlatformLanguageProvider
+          preferredLanguageCode="de"
+          moduleTranslations={[formsRuntimeTranslations]}>
           <UnsavedChangesProvider>
-            <ConformanceApp />
+            <Routes>
+              <Route path="/forms/public/:publicId" element={<ConformanceApp />} />
+              <Route path="/forms-runtime/:instanceId" element={<ConformanceApp />} />
+              <Route path="*" element={<ConformanceApp />} />
+            </Routes>
           </UnsavedChangesProvider>
         </PlatformLanguageProvider>
       </PlatformModulesProvider>

webui/conformance/tests/ui-conformance.spec.ts

@@ -19,6 +19,125 @@ async function expectNoAccessibilityViolations(page: import("@playwright/test").
   expect(violations).toEqual([]);
 }
 
+for (const viewport of [
+  { name: "desktop", width: 1280, height: 900 },
+  { name: "mobile", width: 390, height: 844 }
+]) {
+  test(`resident permit self-service is keyboard and accessibility conformant on ${viewport.name}`, async ({ page }) => {
+    const journey = await mockPublicResidentPermitJourney(page);
+    await page.setViewportSize(viewport);
+    await page.goto("/forms/public/resident-parking-permit?theme=light");
+
+    await expect(page.getByRole("heading", { level: 1, name: "Anwohnerparkausweis beantragen" })).toBeVisible();
+    await expectNoAccessibilityViolations(page);
+
+    const name = page.getByLabel("Name der antragstellenden Person");
+    await name.focus();
+    await page.keyboard.type("Ada Lovelace");
+    await page.keyboard.press("Tab");
+    await expect(page.getByLabel("E-Mail-Adresse")).toBeFocused();
+    await page.keyboard.type("ada.lovelace@example.test");
+    await page.keyboard.press("Tab");
+    await expect(page.getByLabel("Hauptwohnsitz")).toBeFocused();
+    await page.keyboard.type("Musterstraße 17, 10115 Berlin");
+    await page.keyboard.press("Tab");
+    await expect(page.getByLabel("Kfz-Kennzeichen")).toBeFocused();
+    await page.keyboard.type("B-AL 1843");
+    await page.keyboard.press("Tab");
+    await expect(page.getByRole("button", { name: "Entwurf speichern" })).toBeFocused();
+    await page.keyboard.press("Enter");
+    await expect.poll(() => journey.savedValues()).toEqual({
+      applicant_name: "Ada Lovelace",
+      applicant_email: "ada.lovelace@example.test",
+      residence_address: "Musterstraße 17, 10115 Berlin",
+      licence_plate: "B-AL 1843"
+    });
+
+    await page.getByRole("button", { name: "Absenden" }).click();
+    const confirm = page.getByRole("alertdialog", { name: "Formular absenden" });
+    await expect(confirm).toBeVisible();
+    await expectNoAccessibilityViolations(page);
+    await confirm.getByRole("button", { name: "Absenden" }).click();
+    await expect(page.getByText("Übermittlung eingegangen")).toBeVisible();
+    await expect(page.getByText("receipt-rpp-2026-0001")).toBeVisible();
+    await expectNoHorizontalOverflow(page);
+  });
+
+  test(`resident permit assisted intake preserves per-field provenance on ${viewport.name}`, async ({ page }) => {
+    const journey = await mockAssistedResidentPermitJourney(page);
+    await page.setViewportSize(viewport);
+    await page.goto("/forms-runtime?theme=light");
+
+    await page.getByRole("button", { name: "Assistierte Erfassung" }).click();
+    const startDialog = page.getByRole("dialog", { name: "Assistierte Erfassung starten" });
+    await expect(startDialog).toBeVisible();
+    await expectNoAccessibilityViolations(page);
+    await startDialog.getByLabel("Referenz der betroffenen Partei").fill("party:resident-ada-lovelace");
+    await startDialog.getByLabel("Referenz der zuständigen Funktion").fill("function:parking-permits");
+    await startDialog.getByLabel("Zweck").fill("Anwohnerparkausweis beantragen");
+    await startDialog.getByLabel("Referenz der Rechtsgrundlage").fill("law:resident-parking-permit");
+    await startDialog.getByLabel("Barrierefreiheits- oder Kommunikationsunterstützung").fill("Leichte Sprache");
+    const notice = startDialog.getByRole("checkbox", { name: "Datenschutz- und Verfahrenshinweis wurde erteilt" });
+    await notice.focus();
+    await page.keyboard.press("Space");
+    await expect(notice).toBeChecked();
+    await startDialog.getByLabel("Referenz der betroffenen Partei").focus();
+    await page.keyboard.press("Tab");
+    await expect(page.locator(":focus")).toHaveAttribute("aria-label", "Feldhilfe anzeigen");
+    await page.keyboard.press("Tab");
+    await expect(startDialog.getByLabel("Referenz der vertretenen Partei")).toBeFocused();
+    await startDialog.getByRole("button", { name: "Sitzung starten" }).click();
+
+    await expect(page).toHaveURL(/\/forms-runtime\/assisted-rpp-1$/);
+    await expect(page.getByRole("heading", { level: 1, name: "Anwohnerparkausweis beantragen" })).toBeVisible();
+    await page.getByLabel("Name der antragstellenden Person").fill("Ada Lovelace");
+    await page.getByLabel("E-Mail-Adresse").fill("ada.lovelace@example.test");
+    await page.getByLabel("Hauptwohnsitz").fill("Musterstraße 17, 10115 Berlin");
+    await page.getByLabel("Kfz-Kennzeichen").fill("B-AL 1843");
+    await page.getByLabel("Änderungsgrund").fill("Angaben gemeinsam mit der antragstellenden Person erfasst.");
+    await page.getByRole("button", { name: "Entwurf speichern" }).click();
+
+    await page.getByRole("button", { name: "Rücklesen und absenden" }).click();
+    const readback = page.getByRole("dialog", { name: "Assistiertes Rücklesen erfassen" });
+    await expect(readback).toBeVisible();
+    await expect(readback.getByRole("group", { name: "Hauptwohnsitz" })).toBeVisible();
+    await expectNoAccessibilityViolations(page);
+
+    const addressSource = readback.getByRole("group", { name: "Hauptwohnsitz" });
+    await addressSource.getByLabel("Wertquelle").selectOption("document");
+    await addressSource.getByLabel("Quellenvertrauen").selectOption("verified");
+    await addressSource.getByLabel("Erklärende Partei oder Quellenreferenz").fill("files:residence-proof-2026");
+    const plateSource = readback.getByRole("group", { name: "Kfz-Kennzeichen" });
+    await plateSource.getByLabel("Wertquelle").focus();
+    await page.keyboard.press("ArrowDown");
+    await page.keyboard.press("ArrowDown");
+    await page.keyboard.press("ArrowDown");
+    await page.keyboard.press("Enter");
+    await plateSource.getByLabel("Quellenvertrauen").selectOption("verified");
+    await plateSource.getByLabel("Erklärende Partei oder Quellenreferenz").fill("register:vehicle-B-AL-1843");
+    await readback.getByRole("button", { name: "Erfassen und fortfahren" }).click();
+
+    await expect.poll(() => journey.confirmationSources()).toMatchObject({
+      applicant_name: { source: "person_statement", confidence: "stated" },
+      residence_address: {
+        source: "document",
+        confidence: "verified",
+        declared_by_ref: "files:residence-proof-2026"
+      },
+      licence_plate: {
+        source: "system",
+        confidence: "verified",
+        declared_by_ref: "register:vehicle-B-AL-1843"
+      }
+    });
+    const submit = page.getByRole("alertdialog", { name: "Formular absenden" });
+    await submit.getByRole("button", { name: "Absenden" }).click();
+    await expect(page.getByText("receipt-assisted-rpp-2026-0001")).toBeVisible();
+    await expect(page.getByText("Rücklesen erfasst")).toBeVisible();
+    await expectNoHorizontalOverflow(page);
+  });
+}
+
 test("shared components remain accessible and keyboard operable", async ({ page }) => {
   await page.goto("/?theme=light");
   await expect(page.getByRole("heading", { level: 1, name: "Zentrale GovOPlaN-Oberflächen" })).toBeVisible();
@@ -229,6 +348,301 @@ test("narrow layout preserves task order without horizontal overflow", async ({
   await expect(page.locator("[data-conformance-id='shared-ui-lab']")).toHaveScreenshot("shared-ui-light-narrow.png", { animations: "disabled", maxDiffPixelRatio: 0.005 });
 });
 
+async function expectNoHorizontalOverflow(page: import("@playwright/test").Page) {
+  const overflowing = await page.evaluate(() => Array.from(document.querySelectorAll<HTMLElement>("body *"))
+    .filter((element) => {
+      const style = window.getComputedStyle(element);
+      return style.display !== "none" && style.visibility !== "hidden";
+    })
+    .map((element) => {
+      const rect = element.getBoundingClientRect();
+      return {
+        element: `${element.tagName.toLowerCase()}.${Array.from(element.classList).join(".")}`,
+        left: Math.round(rect.left),
+        right: Math.round(rect.right)
+      };
+    })
+    .filter(({ left, right }) => left < -1 || right > window.innerWidth + 1)
+    .slice(0, 20));
+  expect(overflowing).toEqual([]);
+}
+
+async function mockPublicResidentPermitJourney(page: import("@playwright/test").Page) {
+  let current = residentPermitInstance("public-rpp-1", "started", 1, {});
+  let savedValues: Record<string, unknown> = {};
+
+  await page.route("**/api/v1/forms-runtime/**", async (route) => {
+    const request = route.request();
+    const path = new URL(request.url()).pathname;
+    const method = request.method();
+    if (path.endsWith("/public/profiles/resident-parking-permit/start") && method === "POST") {
+      return fulfillJson(route, {
+        session_id: "session-public-rpp-1",
+        mode: "anonymous",
+        status: "active",
+        expires_at: "2026-08-25T10:00:00Z",
+        instance: current,
+        token: "public-rpp-token",
+        replayed: false
+      });
+    }
+    if (path.endsWith("/public/intake") && method === "GET") {
+      return fulfillJson(route, { instance: current, definition: residentPermitDefinition() });
+    }
+    if (path.endsWith("/public/intake") && method === "PATCH") {
+      const payload = request.postDataJSON() as { values: Record<string, unknown> };
+      savedValues = payload.values;
+      current = residentPermitInstance("public-rpp-1", "draft", 2, payload.values);
+      return fulfillJson(route, current);
+    }
+    if (path.endsWith("/public/intake/submit") && method === "POST") {
+      const payload = request.postDataJSON() as { values: Record<string, unknown> };
+      current = {
+        ...residentPermitInstance("public-rpp-1", "submitted", 3, payload.values),
+        receipt_id: "receipt-rpp-2026-0001"
+      };
+      return fulfillJson(route, current);
+    }
+    return route.abort("failed");
+  });
+
+  return { savedValues: () => savedValues };
+}
+
+async function mockAssistedResidentPermitJourney(page: import("@playwright/test").Page) {
+  let current = residentPermitInstance("assisted-rpp-1", "started", 1, {}, true);
+  let confirmationSources: Record<string, unknown> = {};
+  let confirmations: unknown[] = [];
+
+  await page.route("**/api/v1/forms-runtime/**", async (route) => {
+    const request = route.request();
+    const path = new URL(request.url()).pathname;
+    const method = request.method();
+
+    if (path.endsWith("/instances") && method === "GET") {
+      return fulfillJson(route, { instances: [], total: 0, offset: 0, limit: 200 });
+    }
+    if (path.endsWith("/assisted-intake/profiles") && method === "GET") {
+      return fulfillJson(route, { profiles: [{
+        profile_id: "assisted-profile-rpp",
+        public_id: "resident-parking-permit",
+        definition_ref: residentPermitDefinition().reference,
+        mode: "assisted",
+        enabled: true,
+        revision: 1,
+        draft_ttl_seconds: 2_592_000,
+        invitation_ttl_seconds: 1_209_600,
+        rate_limit_per_minute: 60,
+        metadata: { definition_title: "Anwohnerparkausweis beantragen" }
+      }] });
+    }
+    if (path.endsWith("/assisted-intake/start") && method === "POST") {
+      return fulfillJson(route, {
+        session_id: "assisted-session-rpp-1",
+        mode: "assisted",
+        status: "active",
+        expires_at: "2026-08-25T10:00:00Z",
+        instance: current,
+        token: null,
+        replayed: false
+      });
+    }
+    if (path.endsWith("/instances/assisted-rpp-1/definition") && method === "GET") {
+      return fulfillJson(route, residentPermitDefinition());
+    }
+    if (path.endsWith("/instances/assisted-rpp-1/history") && method === "GET") {
+      return fulfillJson(route, { revisions: [current] });
+    }
+    if (path.endsWith("/instances/assisted-rpp-1/events") && method === "GET") {
+      return fulfillJson(route, { events: [{
+        event_id: `event-${current.revision}`,
+        event_type: current.status === "submitted" ? "submitted" : "draft_saved",
+        instance_revision: current.revision,
+        status: current.status,
+        occurred_at: current.recorded_at,
+        actor_id: "operator-1",
+        payload: {}
+      }] });
+    }
+    if (path.endsWith("/instances/assisted-rpp-1/handoffs") && method === "GET") {
+      return fulfillJson(route, { handoffs: [] });
+    }
+    if (path.endsWith("/instances/assisted-rpp-1/assisted-confirmations") && method === "GET") {
+      return fulfillJson(route, { confirmations });
+    }
+    if (path.endsWith("/instances/assisted-rpp-1/assisted-confirmations") && method === "POST") {
+      const payload = request.postDataJSON() as { field_sources: Record<string, unknown> };
+      confirmationSources = payload.field_sources;
+      const confirmation = {
+        confirmation_id: "confirmation-rpp-1",
+        instance_id: "assisted-rpp-1",
+        instance_revision: current.revision,
+        outcome: "confirmed",
+        method: "spoken_readback",
+        confirmed_by_ref: "party:resident-ada-lovelace",
+        operator_actor_id: "operator-1",
+        confirmed_at: "2026-08-24T10:10:00Z",
+        payload_sha256: "a".repeat(64),
+        correction_note: null,
+        metadata: { field_sources: confirmationSources }
+      };
+      confirmations = [confirmation];
+      return fulfillJson(route, confirmation);
+    }
+    if (path.endsWith("/instances/assisted-rpp-1/submit") && method === "POST") {
+      const payload = request.postDataJSON() as { values: Record<string, unknown> };
+      current = {
+        ...residentPermitInstance("assisted-rpp-1", "submitted", current.revision + 1, payload.values, true),
+        receipt_id: "receipt-assisted-rpp-2026-0001"
+      };
+      return fulfillJson(route, current);
+    }
+    if (path.endsWith("/instances/assisted-rpp-1") && method === "PATCH") {
+      const payload = request.postDataJSON() as { values: Record<string, unknown> };
+      current = residentPermitInstance("assisted-rpp-1", "draft", current.revision + 1, payload.values, true);
+      return fulfillJson(route, current);
+    }
+    if (path.endsWith("/instances/assisted-rpp-1") && method === "GET") {
+      return fulfillJson(route, current);
+    }
+    return route.abort("failed");
+  });
+
+  return { confirmationSources: () => confirmationSources };
+}
+
+function residentPermitDefinition() {
+  return {
+    reference: {
+      kind: "form",
+      owner_module: "forms",
+      object_id: "resident-parking-permit-application",
+      tenant_id: "tenant-1",
+      version: "3",
+      label: "Anwohnerparkausweis beantragen"
+    },
+    key: "resident_parking_permit.apply",
+    temporal: { revision: "3", recorded_at: "2026-08-24T10:00:00Z" },
+    title: "Resident parking permit application",
+    description: "Apply digitally or together with an authorized service worker.",
+    fields: [
+      residentPermitField("applicant_name", "Applicant name", "text", { min_length: 2, max_length: 200 }),
+      residentPermitField("applicant_email", "Applicant email", "email", { format: "email" }),
+      residentPermitField("residence_address", "Primary residence", "text", { max_length: 500 }),
+      residentPermitField("licence_plate", "Licence plate", "text", { max_length: 20 })
+    ],
+    publication_state: "published",
+    allow_drafts: true,
+    max_attachments: 0,
+    signature_requirement: "none",
+    policy_refs: ["law:resident-parking-permit"],
+    handoff_kinds: [],
+    fallback_locale: "de",
+    localizations: [{
+      locale: "de",
+      title: "Anwohnerparkausweis beantragen",
+      description: "Beantragen Sie den Anwohnerparkausweis digital oder gemeinsam mit einer berechtigten Servicestelle.",
+      field_labels: {
+        applicant_name: "Name der antragstellenden Person",
+        applicant_email: "E-Mail-Adresse",
+        residence_address: "Hauptwohnsitz",
+        licence_plate: "Kfz-Kennzeichen"
+      },
+      field_help_texts: {},
+      option_labels: {},
+      page_titles: {},
+      section_titles: {}
+    }]
+  };
+}
+
+function residentPermitField(
+  key: string,
+  label: string,
+  valueType: "text" | "email",
+  constraints: Record<string, unknown>
+) {
+  return {
+    key,
+    label,
+    value_type: valueType,
+    required: true,
+    help_text: null,
+    options: [],
+    constraints,
+    default_value: null,
+    visibility_condition: null
+  };
+}
+
+function residentPermitInstance(
+  instanceId: string,
+  status: string,
+  revision: number,
+  values: Record<string, unknown>,
+  assisted = false
+) {
+  return {
+    reference: {
+      kind: "form_instance",
+      owner_module: "forms_runtime",
+      object_id: instanceId,
+      tenant_id: "tenant-1",
+      version: String(revision),
+      label: "Anwohnerparkausweis beantragen"
+    },
+    tenant_id: "tenant-1",
+    instance_id: instanceId,
+    revision,
+    status,
+    definition_ref: residentPermitDefinition().reference,
+    values,
+    validation_results: [],
+    attachment_refs: [],
+    signature_refs: [],
+    handoff_refs: [],
+    service_ref: null,
+    receipt_id: null as string | null,
+    recorded_at: "2026-08-24T10:00:00Z",
+    change_reason: revision === 1 ? "Assisted session started." : "Draft saved.",
+    created_by: "operator-1",
+    changed_by: "operator-1",
+    metadata: assisted ? {
+      intake: {
+        session_id: "assisted-session-rpp-1",
+        profile_id: "assisted-profile-rpp",
+        mode: "assisted",
+        channel: "counter",
+        affected_party_ref: "party:resident-ada-lovelace",
+        represented_party_ref: null,
+        authority_basis: "self",
+        purpose: "Anwohnerparkausweis beantragen",
+        legal_basis_ref: "law:resident-parking-permit",
+        consent_basis: "in-person-confirmation",
+        notice_given: true,
+        responsible_function_ref: "function:parking-permits",
+        language: "de",
+        accessibility_needs: ["Leichte Sprache"],
+        field_sources: {},
+        operator: { actor_id: "operator-1", auth_method: "session" }
+      }
+    } : {},
+    status_access: null,
+    replayed: false
+  };
+}
+
+async function fulfillJson(
+  route: import("@playwright/test").Route,
+  body: unknown
+) {
+  await route.fulfill({
+    status: 200,
+    contentType: "application/json",
+    body: JSON.stringify(body)
+  });
+}
+
 function quickAccessPayload(includeMessages: boolean) {
   const files = {
     id: "files",

webui/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@govoplan/core-webui",
-  "version": "0.1.40",
+  "version": "0.1.42",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@govoplan/core-webui",
-      "version": "0.1.40",
+      "version": "0.1.42",
       "dependencies": {
         "@govoplan/access-webui": "file:../../govoplan-access/webui",
         "@govoplan/addresses-webui": "file:../../govoplan-addresses/webui",
@@ -378,7 +378,7 @@
     },
     "../../govoplan-forms-runtime/webui": {
       "name": "@govoplan/forms-runtime-webui",
-      "version": "0.1.18",
+      "version": "0.1.20",
       "peerDependencies": {
         "@govoplan/core-webui": "^0.1.18",
         "lucide-react": "^1.23.0",

webui/package-lock.release.json

@@ -1,28 +1,28 @@
 {
   "name": "@govoplan/core-webui",
-  "version": "0.1.40",
+  "version": "0.1.42",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@govoplan/core-webui",
-      "version": "0.1.40",
+      "version": "0.1.42",
       "dependencies": {
         "@govoplan/access-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-access.git#v0.1.23",
         "@govoplan/admin-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-admin.git#v0.1.22",
-        "@govoplan/audit-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-audit.git#v0.1.18",
+        "@govoplan/audit-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-audit.git#v0.1.20",
         "@govoplan/calendar-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-calendar.git#v0.1.22",
         "@govoplan/campaign-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-campaign.git#v0.1.27",
         "@govoplan/cases-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-cases.git#v0.1.20",
-        "@govoplan/dashboard-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-dashboard.git#v0.1.18",
+        "@govoplan/dashboard-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-dashboard.git#v0.1.20",
         "@govoplan/docs-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-docs.git#v0.1.22",
-        "@govoplan/files-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-files.git#v0.1.23",
+        "@govoplan/files-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-files.git#v0.1.24",
         "@govoplan/helpdesk-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-helpdesk.git#v0.1.20",
         "@govoplan/idm-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-idm.git#v0.1.24",
-        "@govoplan/mail-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-mail.git#v0.1.25",
+        "@govoplan/mail-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-mail.git#v0.1.26",
-        "@govoplan/ops-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-ops.git#v0.1.18",
+        "@govoplan/ops-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-ops.git#v0.1.21",
         "@govoplan/organizations-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-organizations.git#v0.1.20",
-        "@govoplan/policy-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-policy.git#v0.1.18",
+        "@govoplan/policy-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-policy.git#v0.1.22",
         "@govoplan/tickets-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-tickets.git#v0.1.22",
         "@govoplan/wiki-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-wiki.git#v0.1.22",
         "@tiptap/core": "^3.29.2",
@@ -789,8 +789,8 @@
       }
     },
     "node_modules/@govoplan/audit-webui": {
-      "version": "0.1.18",
+      "version": "0.1.20",
-      "resolved": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-audit.git#6e63f6920ad5fb71f5d40e785eaed263905d658c",
+      "resolved": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-audit.git#f2d7b9b29a497607d20f57886448247a8561df8d",
       "peerDependencies": {
         "@govoplan/core-webui": "^0.1.18",
         "lucide-react": "^1.23.0",
@@ -859,8 +859,8 @@
       }
     },
     "node_modules/@govoplan/dashboard-webui": {
-      "version": "0.1.18",
+      "version": "0.1.20",
-      "resolved": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-dashboard.git#ede16c5439f71ed36b50994d5ad7f656212a43c4",
+      "resolved": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-dashboard.git#ec240ed2199637a68751e348887908a82d4cfe65",
       "peerDependencies": {
         "@govoplan/core-webui": "^0.1.18",
         "lucide-react": "^1.23.0",
@@ -894,8 +894,8 @@
       }
     },
     "node_modules/@govoplan/files-webui": {
-      "version": "0.1.23",
+      "version": "0.1.24",
-      "resolved": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-files.git#11b9b7c4c6d919b9f6649034445edfea0c77d042",
+      "resolved": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-files.git#6176e9f40e070387f03c15d10b3b3d2f132508b5",
       "peerDependencies": {
         "@govoplan/core-webui": "^0.1.18",
         "@vitejs/plugin-react": "^5.2.0",
@@ -948,8 +948,8 @@
       }
     },
     "node_modules/@govoplan/mail-webui": {
-      "version": "0.1.25",
+      "version": "0.1.26",
-      "resolved": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-mail.git#ecc1283de76f154919c786cb84354afb8f2299c1",
+      "resolved": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-mail.git#c62c7783d6f522b7ec13063024885bb88e257012",
       "peerDependencies": {
         "@govoplan/core-webui": "^0.1.18",
         "lucide-react": "^1.23.0",
@@ -964,8 +964,8 @@
       }
     },
     "node_modules/@govoplan/ops-webui": {
-      "version": "0.1.18",
+      "version": "0.1.21",
-      "resolved": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-ops.git#71666db45c8e602ea439495017e5849cad44ec4b",
+      "resolved": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-ops.git#ac6b211827571c69b058fc857bbddd15125519c6",
       "peerDependencies": {
         "@govoplan/core-webui": "^0.1.18",
         "@vitejs/plugin-react": "^5.2.0",
@@ -1002,8 +1002,8 @@
       }
     },
     "node_modules/@govoplan/policy-webui": {
-      "version": "0.1.18",
+      "version": "0.1.22",
-      "resolved": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-policy.git#65159dec5fb6594fddfc2c5f8ab199c1e23994a2",
+      "resolved": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-policy.git#29a9aea3b186b45fcf1b7bed9ebbd1712390f5c6",
       "peerDependencies": {
         "@govoplan/core-webui": "^0.1.18",
         "lucide-react": "^1.23.0",
@@ -2127,9 +2127,9 @@
       }
     },
     "node_modules/electron-to-chromium": {
-      "version": "1.5.412",
+      "version": "1.5.413",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.412.tgz",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.413.tgz",
-      "integrity": "sha512-z4rMe3esBzlzovKHj4gxJnsCGZRK5l4baUvm+gCGJBPE+gsyUMKsuU9tnEUtI1dOebXz1ytAPGjvXhmQ7rIPwA==",
+      "integrity": "sha512-F1XPKvt7HVfly5WND90ec16nFsdr4g5x/cVUP3EqjeyXynupabGDqpMa84wwvuYGDnldXLBz6DLXyZXWO9TPvw==",
       "license": "ISC"
     },
     "node_modules/esbuild": {
@@ -2289,9 +2289,9 @@
       }
     },
     "node_modules/lucide-react": {
-      "version": "1.33.0",
+      "version": "1.34.0",
-      "resolved": "https://registry.npmjs.org/lucide-react/-/lucide-react-1.33.0.tgz",
+      "resolved": "https://registry.npmjs.org/lucide-react/-/lucide-react-1.34.0.tgz",
-      "integrity": "sha512-MTRwMy0ZlL8Ur/vOAiJ9XGHE+kFPC7brq6MxAm0GiGXEBj0qy0jA/pG4N675oSzciO/UCdX8T+5yUQdmDeTLxg==",
+      "integrity": "sha512-vnjGJNI7Htk5+oWW8gXGuaLgwgAb0T6/iZbBrp9JCfRFwdNWZ0YTm3eyxjOLgwN6r8iyAf3UA70zNmBRBNv7yg==",
       "license": "ISC",
       "peerDependencies": {
         "react": "^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0"

webui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@govoplan/core-webui",
-  "version": "0.1.40",
+  "version": "0.1.42",
   "private": true,
   "type": "module",
   "main": "src/index.ts",

webui/package.release.json

@@ -1,6 +1,6 @@
 {
   "name": "@govoplan/core-webui",
-  "version": "0.1.40",
+  "version": "0.1.42",
   "private": true,
   "type": "module",
   "main": "src/index.ts",
@@ -28,19 +28,19 @@
   "dependencies": {
     "@govoplan/access-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-access.git#v0.1.23",
     "@govoplan/admin-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-admin.git#v0.1.22",
-    "@govoplan/audit-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-audit.git#v0.1.18",
+    "@govoplan/audit-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-audit.git#v0.1.20",
     "@govoplan/calendar-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-calendar.git#v0.1.22",
     "@govoplan/cases-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-cases.git#v0.1.20",
-    "@govoplan/dashboard-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-dashboard.git#v0.1.18",
+    "@govoplan/dashboard-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-dashboard.git#v0.1.20",
     "@govoplan/docs-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-docs.git#v0.1.22",
-    "@govoplan/files-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-files.git#v0.1.23",
+    "@govoplan/files-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-files.git#v0.1.24",
     "@govoplan/helpdesk-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-helpdesk.git#v0.1.20",
     "@govoplan/idm-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-idm.git#v0.1.24",
-    "@govoplan/mail-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-mail.git#v0.1.25",
+    "@govoplan/mail-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-mail.git#v0.1.26",
     "@govoplan/campaign-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-campaign.git#v0.1.27",
     "@govoplan/organizations-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-organizations.git#v0.1.20",
-    "@govoplan/ops-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-ops.git#v0.1.18",
+    "@govoplan/ops-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-ops.git#v0.1.21",
-    "@govoplan/policy-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-policy.git#v0.1.18",
+    "@govoplan/policy-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-policy.git#v0.1.22",
     "@govoplan/tickets-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-tickets.git#v0.1.22",
     "@govoplan/wiki-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-wiki.git#v0.1.22",
     "@tiptap/core": "^3.29.2",

webui/src/components/HoverTooltip.tsx

@@ -207,6 +207,7 @@ export default function HoverTooltip({
       <span
         ref={triggerRef}
         className={className}
+        role={ariaLabel ? "button" : undefined}
         tabIndex={triggerTabIndex}
         aria-label={translatedAriaLabel}
         aria-describedby={isOpen ? tooltipId : undefined}

webui/src/components/help/InlineHelp.tsx

@@ -13,7 +13,7 @@ export default function InlineHelp({ children, className = "" }: InlineHelpProps
       content={children}
       className={`inline-help ${className}`.trim()}
       ariaLabel="i18n:govoplan-core.show_field_help.e3dfe98f"
-      triggerTabIndex={-1}>
+      triggerTabIndex={0}>
       <span className="inline-help-mark" aria-hidden="true">?</span>
     </HoverTooltip>
   );

webui/src/i18n/generatedTranslations.ts

@@ -1276,8 +1276,8 @@ export const generatedTranslations: PlatformTranslations = {
     "i18n:govoplan-core.share.09ca55ca": "Freigabe",
     "i18n:govoplan-core.set_concrete_system_retention_values_blank_day_f.98b9a627": "Set concrete system retention values. Blank day fields mean unlimited retention.",
     "i18n:govoplan-core.settings.c7f73bb5": "Einstellungen",
-    "i18n:govoplan-core.show_content.0528d8d2": "Show content",
+    "i18n:govoplan-core.show_content.0528d8d2": "Inhalt anzeigen",
-    "i18n:govoplan-core.show_field_help.e3dfe98f": "Show field help",
+    "i18n:govoplan-core.show_field_help.e3dfe98f": "Feldhilfe anzeigen",
     "i18n:govoplan-core.show_guided_warnings_while_editing.bc5dba85": "Show guided warnings while editing",
     "i18n:govoplan-core.show_header_only.24afefca": "Show header only",
     "i18n:govoplan-core.show_inline_guidance_and_warnings_while_campaign.a892f5e9": "Show inline guidance and warnings while campaign data is being edited.",

webui/src/styles/badges.css

@@ -1,5 +1,5 @@
 .status-badge { display: inline-flex; align-items: center; height: 24px; border-radius: var(--radius-pill); padding: 0 9px; font-size: 12px; font-weight: 800; background: var(--status-neutral-bg); color: var(--text-soft); text-transform: uppercase; }
-.status-ready, .status-sent, .status-appended, .status-success, .status-active { background: var(--success-soft); color: var(--success-text-strong); }
+.status-ready, .status-sent, .status-appended, .status-success, .status-active { background: var(--success-soft); color: var(--success-text); }
 .status-warning, .status-needs-review, .status-pending { background: var(--warning-soft); color: var(--warning-text-strong); }
 .status-blocked, .status-error, .status-danger, .status-failed, .status-failed-permanent { background: var(--danger-bg); color: var(--danger-text-strong); }
 .status-queued, .status-sending { background: var(--info-soft); color: var(--info-text-strong); }