fix(webui): bind record lifecycle controls to help

README.md

@@ -12,7 +12,17 @@ authority over their objects and bytes.
 The first working vertical slice includes PostgreSQL/SQLite models and an
 Alembic migration, tenant-scoped APIs, optimistic concurrency and idempotent
 filing, temporal reads, search registration, a full-height Records workspace,
-and provider-neutral filing from Files and Cases.
+provider-neutral filing from Files, Cases, Forms Runtime, and Decisions, and a
+governed close/retention/hold/appraisal/disposition/transfer lifecycle.
+
+The `privacy.dsar.records` capability exports bounded record and lifecycle
+metadata from an explicit record or authoritative source linkage. Canonical
+account, identity, and membership selectors return minimized staff
+accountability attribution; they do not turn a staff action into record-subject
+ownership. Immutable eAkte evidence is retained, while the current record fact
+is routed to manual lifecycle review. Source content, snapshots, opaque
+contexts, payloads, hashes, replay keys, and archive manifests/receipts are not
+exported by Records.
 
 ## Initial Ownership
 
@@ -39,24 +49,38 @@ Implemented optional integrations:
 
 - files
 - cases
+- forms runtime
+- decisions
+- approvals
+- audit
 - search
 
 Planned optional integrations include:
 
-- forms runtime and decisions
 - Campaigns, Postbox, and Reporting
-- DMS/archive providers
+- target-tested DMS/archive providers
 - policy
-- audit
 - transparency
 
 ## Current Boundary
 
-The current kernel supports planned and open records. Restricted per-record
+The current kernel supports planned/open records, exact filing, closure,
-grants, closure, retention calculation, holds, appraisal, disposition,
+retention calculation, holds, appraisal, independent disposition approval,
-transfer, destruction, and external archive effects remain explicit later
+archive-neutral packaging, recovery evidence, and a clearly marked transfer
-work packages. Enabling Records does not trigger destructive or external
+simulation. The simulation never claims archival custody. Restricted
-effects.
+per-record grants, real target conformance, destructive execution, and real
+archive effects remain explicit later work packages.
+
+## Reference Journey
+
+The executable resident-parking-permit fixture proves equivalent assisted and
+authenticated digital eAkten. It files the exact form, attachment, case and
+representation, decision, delivery, and correction revisions; preserves
+authority, purpose, policy, chronology, and custody evidence; exercises hold
+and independent approval; and verifies search, temporal reconstruction, and
+source/package integrity after a SQLite backup/restore round trip. The Records
+workspace keeps the selected `recordId` in the URL so an authorized actor can
+resume the same record and inspect the complete evidence chain.
 
 The detailed target and implementation sequence are documented in
 [docs/EAKTE_ARCHITECTURE.md](docs/EAKTE_ARCHITECTURE.md).

docs/EAKTE_ARCHITECTURE.md

@@ -40,10 +40,14 @@ packages tracked by Records #2-#6:
 - tenant administration for versioned file-plan nodes and record classes,
   explicit volume management, and lifecycle controls in the eAkte workspace.
 
-The remaining boundary is intentionally visible rather than implied: Records
+The cross-module reference journey from Records #8 is executable: equivalent
-#7 requires selection and target testing of an archive/xdomea endpoint and
+assisted and authenticated digital permit records preserve exact form,
-conformance profile; #8 completes the cross-module reference journey and
+attachment, case/representation, decision, delivery, and correction evidence;
-production evidence. Restricted per-record access grants also remain a
+exercise closure, retention, hold, approval, and simulated transfer; and prove
+search and temporal reconstruction after database backup/restore. The
+remaining boundary is intentionally visible rather than implied: Records #7
+requires selection and target testing of an archive/xdomea endpoint and
+conformance profile. Restricted per-record access grants also remain a
 dedicated access-policy slice. Destruction is represented only as an approved
 pending state; no content deletion or real archive effect is currently
 claimed.
@@ -234,6 +238,10 @@ available in an evidence/details view.
 5. Add destruction/recovery, TR-ESOR provider integration, migration, and
    signed reference-journey evidence.
 
-The first reference package should file the digital and assisted variants of
+The first reference package files the digital and assisted variants of the
-the same service-to-decision journey into equivalent records and prove search,
+resident-parking-permit service-to-decision journey into equivalent records.
-historical reconstruction, hold, transfer, restore, and access explanation.
+Its fixture and regression test prove search, historical reconstruction, hold,
+independent approval, simulated transfer, restore, current access explanation,
+source digest revalidation, and transfer-manifest integrity. Its UI contract
+pins URL-based resume, exact-source filing presets, governance context,
+evidence semantics, lifecycle actions, and recovery inspection.

docs/RECORDS_DOMAIN_BOUNDARY.md

@@ -38,8 +38,8 @@ The native kernel currently provides:
 - independent valid and recorded time with current/at/all temporal reads;
 - tenant, purpose, actor/capacity, source authority, institutional context,
   provenance, and idempotency fields;
-- provider-neutral exact-source capabilities, initially implemented by Files
+- provider-neutral exact-source capabilities implemented by Files versions,
-  file versions and Cases revisions;
+  Cases revisions, Forms Runtime submissions, and Decisions revisions;
 - tenant APIs, search projection, uninstall/retirement guards, and a Records
   workspace using shared WebUI controls.
 - immutable close/reopen, retention, hold, appraisal, and independently
@@ -49,17 +49,40 @@ The native kernel currently provides:
 - Core recovery-ledger adoption, atomic terminal evidence, Audit projection,
   source and package restore diagnostics, catalog administration, volumes, and
   lifecycle UI.
+- an executable assisted/digital resident-parking-permit reference package
+  that proves equivalent filing semantics, URL resume, search, temporal
+  reconstruction, and evidence integrity after database backup/restore.
 
 Restricted object grants remain a separate governed slice. A target-tested
 archive adapter and any destructive effect remain deliberately unimplemented;
 approved destruction is only a pending lifecycle state.
 
-## First Implementation Slice
+## Data-subject requests
+
+Records publishes `privacy.dsar.records`. A record-subject search must include
+an exact record, revision, item, volume, chronology, hold, disposition,
+transfer-package, or authoritative source-module reference. A canonical
+account, identity, or membership match identifies staff accountability
+activity only; creating, filing, reviewing, or transferring an eAkte does not
+make that staff member the subject of its contents.
+
+The provider exports bounded record identity, revision, filing, chronology,
+hold, disposition, and transfer lifecycle metadata. It excludes source
+content, record snapshots and search text, opaque institutional contexts and
+payloads, digests, replay keys, launch URLs, approval identifiers, archive
+manifests and receipts, and unrelated records. Exact source content remains in
+the source owner's DSAR provider. Record revisions and lifecycle evidence are
+immutable retention evidence; the current record fact receives a
+non-executable manual-review action. Actual correction, closure, appraisal,
+hold, disposition, or transfer must use the governed eAkte lifecycle.
+
+## Next Boundary Slice
 
 Complete restricted access and one target-tested archive provider without
-moving source-module ownership into Records. Extend the executable reference
+moving source-module ownership into Records. The executable reference journey
-journey across assisted service, decision, filing, hold, restore, search, and
+already covers assisted/digital intake, decision, filing, hold, restore,
-archive simulation before claiming production maturity.
+search, and archive simulation; it is evidence for the native boundary, not a
+claim of target archive conformance or transferred custody.
 
 The complete native/external boundary, temporal and purpose-aware record model,
 disposition lifecycle, German public-sector provider profiles, and staged

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@govoplan/records",
-  "version": "0.1.19",
+  "version": "0.1.22",
   "private": true,
   "description": "GovOPlaN eAkte and institutional records module.",
   "type": "module",

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "govoplan-records"
-version = "0.1.19"
+version = "0.1.22"
 description = "GovOPlaN eAkte and institutional records module."
 readme = "README.md"
 requires-python = ">=3.12"

src/govoplan_records/backend/manifest.py

@@ -16,6 +16,7 @@ from govoplan_core.core.module_guards import (
 )
 from govoplan_core.core.modules import (
     CapabilityDocumentation,
+    DocumentationCondition,
     DocumentationLink,
     DocumentationTopic,
     FrontendModule,
@@ -26,6 +27,7 @@ from govoplan_core.core.modules import (
     ModuleManifest,
     NavItem,
     PermissionDefinition,
+    ProductAreaContribution,
     RoleTemplate,
 )
 from govoplan_core.core.provider_governance import declared_module_architecture
@@ -37,6 +39,10 @@ from govoplan_core.core.search import SearchSourceProviderRegistration
 from govoplan_core.core.views import ViewSurface
 from govoplan_core.db.base import Base
 from govoplan_records.backend.db import models as record_models
+from govoplan_records.backend.dsar_provider import (
+    RECORDS_DSAR_CAPABILITY,
+    RecordsDsarProvider,
+)
 from govoplan_records.backend.search_source import create_records_search_source
 from govoplan_records.backend.service import SqlRecordRegistry
 from govoplan_records.backend.archive import (
@@ -47,7 +53,7 @@ from govoplan_records.backend.archive import (
 
 MODULE_ID = "records"
 MODULE_NAME = "Records"
-MODULE_VERSION = "0.1.19"
+MODULE_VERSION = "0.1.22"
 READ_SCOPE = "records:workspace:read"
 WRITE_SCOPE = "records:workspace:write"
 ADMIN_SCOPE = "records:workspace:admin"
@@ -93,6 +99,11 @@ def _records_registry(context: ModuleContext) -> SqlRecordRegistry:
     return SqlRecordRegistry(context.registry)
 
 
+def _dsar_provider(context: ModuleContext) -> RecordsDsarProvider:
+    del context
+    return RecordsDsarProvider()
+
+
 def _simulated_archive_provider(
     context: ModuleContext,
 ) -> SimulatedRecordArchiveProvider:
@@ -183,6 +194,61 @@ ROLE_TEMPLATES = (
 )
 
 DOCUMENTATION = (
+    DocumentationTopic(
+        id="records.data-subject-requests",
+        title="eAkte data-subject requests",
+        summary="Export minimized record metadata while preserving retention, hold, disposition, and archive evidence.",
+        body=(
+            "Records correlates exact record, revision, item, volume, chronology, hold, disposition, transfer-package, and provider-owned source references inside one tenant. Account, identity, and membership selectors expose staff accountability attribution but never imply that the staff member is the subject of a record. A record-subject export therefore needs an authoritative record or source linkage. "
+            "The export includes bounded record, filing, chronology, hold, disposition, and transfer lifecycle metadata. Source content, snapshots, search text, opaque contexts and payloads, hashes, replay keys, launch URLs, archive manifests and receipts, approval identifiers, and unrelated records are excluded. Immutable evidence is retained. The current record fact receives non-executable manual review and can change only through the governed eAkte lifecycle."
+        ),
+        layer="configured",
+        documentation_types=("admin", "user"),
+        audience=("user", "records_manager", "operator", "module_admin", "auditor"),
+        order=90,
+        related_modules=(
+            "core",
+            "cases",
+            "files",
+            "forms_runtime",
+            "workflow_engine",
+            "approvals",
+            "dms",
+        ),
+        links=(
+            DocumentationLink(
+                label="Records domain boundary",
+                href="govoplan-records/docs/RECORDS_DOMAIN_BOUNDARY.md",
+                kind="repository",
+            ),
+        ),
+        metadata={
+            "kind": "reference",
+            "help_contexts": [
+                "records.data-subject-requests",
+                "records.lifecycle",
+            ],
+        },
+        translations={
+            "de": {
+                "title": "Datenschutzanfragen zur eAkte",
+                "summary": (
+                    "Minimierte Aktenmetadaten ausgeben und dabei Aufbewahrungs-, Sperr-, Aussonderungs- und Archivnachweise bewahren."
+                ),
+                "body": (
+                    "Records gleicht innerhalb eines Mandanten exakte Verweise auf Akte, Revision, Eintrag, Band, Chronologie, "
+                    "Sperre, Aussonderung, Übergabepaket und anbietergeführte Quellen ab. Konto-, Identitäts- und "
+                    "Mitgliedschaftsselektoren zeigen Verantwortungszuordnungen von Beschäftigten, bedeuten aber niemals, dass die "
+                    "beschäftigte Person Gegenstand einer Akte ist. Eine Auskunft zur aktenbetroffenen Person erfordert deshalb eine "
+                    "führende Akten- oder Quellverknüpfung. Die Ausgabe enthält begrenzte Metadaten zu Akte, Veraktung, Chronologie, "
+                    "Sperre, Aussonderung und Übergabe. Quellinhalt, Schnappschüsse, Suchtext, undurchsichtige Kontexte und Nutzdaten, "
+                    "Prüfsummen, Wiederholungsschlüssel, Start-URLs, Archivmanifeste und -belege, Genehmigungskennungen und fremde "
+                    "Akten bleiben ausgeschlossen. Unveränderliche Nachweise werden aufbewahrt. Der aktuelle Aktenfakt erhält eine "
+                    "nicht ausführbare manuelle Prüfung und kann nur über den gesteuerten eAkte-Lebenszyklus verändert werden."
+                ),
+            }
+        },
+    ),
     DocumentationTopic(
         id="records.workspace",
         title="eAkte workspace",
@@ -192,11 +258,13 @@ DOCUMENTATION = (
             "volumes, filing decisions, and chronology. Files and other source modules continue to own "
             "their content. Filing resolves and preserves an exact source revision only after the source "
             "module confirms current access. The titlebar temporal selection changes valid and recorded "
-            "time while current authorization always remains in force."
+            "time while current authorization always remains in force. The selected record is preserved "
+            "as a recordId URL parameter so an authorized actor can resume the same evidence view."
         ),
         layer="configured",
         documentation_types=("admin", "user"),
         audience=("user", "records_manager", "operator", "module_admin", "auditor"),
+        conditions=(DocumentationCondition(required_scopes=(READ_SCOPE,)),),
         order=100,
         related_modules=OPTIONAL_DEPENDENCIES,
         links=(
@@ -221,6 +289,7 @@ DOCUMENTATION = (
             }
         },
         metadata={
+            "kind": "workflow",
             "help_contexts": [
                 "records.workspace",
                 "records.file-plan",
@@ -243,7 +312,7 @@ DOCUMENTATION = (
     DocumentationTopic(
         id="records.filing",
         title="Exact record filing",
-        summary="File immutable Files or Cases revisions through a provider-neutral capability.",
+        summary="File immutable Files, Cases, Forms Runtime, or Decisions revisions through a provider-neutral capability.",
         body=(
             "Every filing requires a record, purpose, filing reason, idempotency key, and exact source "
             "revision. Records stores source identity, authority mode, digest and content metadata where "
@@ -254,7 +323,14 @@ DOCUMENTATION = (
         documentation_types=("admin", "user"),
         audience=("user", "records_manager", "operator", "module_admin", "auditor"),
         order=110,
-        related_modules=("files", "cases", "policy", "audit"),
+        related_modules=(
+            "files",
+            "cases",
+            "forms_runtime",
+            "decisions",
+            "policy",
+            "audit",
+        ),
         links=(
             DocumentationLink(
                 label="Records domain boundary",
@@ -276,6 +352,7 @@ DOCUMENTATION = (
             }
         },
         metadata={
+            "kind": "reference",
             "help_contexts": [
                 "records.action.file",
                 "records.field.source-module",
@@ -344,6 +421,66 @@ DOCUMENTATION = (
             ],
         },
     ),
+    DocumentationTopic(
+        id="records.reference-journey",
+        title="Assisted and digital eAkte reference journey",
+        summary="Reconstruct the resident-parking-permit evidence chain and verify recovery without implying archive custody.",
+        body=(
+            "Equivalent assisted and authenticated digital resident-parking-permit records preserve exact "
+            "form, attachment, case and representation, formal decision, delivery receipt, and correction "
+            "revisions. The record view explains each source version, authority mode, relationship, filing "
+            "purpose, institutional context, legal basis, retention policy, chronology, hold, independent "
+            "approval, and transfer result. The selected recordId remains in the URL for authorized resume. "
+            "Automated evidence restores a database backup, searches and temporally reconstructs both records, "
+            "and revalidates source digests and the archive-neutral manifest. A simulated receipt explicitly "
+            "states that custody was not transferred; real archive conformance remains target-specific."
+        ),
+        layer="configured",
+        documentation_types=("admin", "user"),
+        audience=("user", "records_manager", "operator", "module_admin", "auditor"),
+        order=130,
+        related_modules=(
+            "forms_runtime",
+            "files",
+            "cases",
+            "decisions",
+            "approvals",
+            "search",
+        ),
+        links=(
+            DocumentationLink(
+                label="eAkte architecture",
+                href="govoplan-records/docs/EAKTE_ARCHITECTURE.md",
+                kind="repository",
+            ),
+        ),
+        translations={
+            "de": {
+                "title": "Referenzablauf für assistierte und digitale eAkten",
+                "summary": "Die Nachweiskette des Anwohnerparkausweises rekonstruieren und die Wiederherstellung prüfen, ohne Archivverwahrung zu behaupten.",
+                "body": (
+                    "Gleichwertige assistierte und authentifizierte digitale Akten zum Anwohnerparkausweis "
+                    "bewahren exakte Revisionen von Formular, Anlage, Vorgang und Vertretung, förmlicher "
+                    "Entscheidung, Zustellbeleg und Korrektur. Die Aktenansicht erläutert Quellversion, "
+                    "Autoritätsmodus, Beziehung, Veraktungszweck, institutionellen Kontext, Rechtsgrundlage, "
+                    "Aufbewahrungsrichtlinie, Chronologie, Sperre, unabhängige Freigabe und Übergabeergebnis. "
+                    "Die ausgewählte recordId bleibt zum berechtigten Fortsetzen in der URL. Automatisierte "
+                    "Nachweise stellen eine Datenbanksicherung wieder her, suchen und rekonstruieren beide "
+                    "Akten temporal und prüfen Quellprüfsummen sowie das archivneutrale Manifest erneut. Ein "
+                    "simulierter Beleg stellt ausdrücklich klar, dass keine Verwahrung übertragen wurde."
+                ),
+            }
+        },
+        metadata={
+            "help_contexts": [
+                "records.governance-context",
+                "records.record-items",
+                "records.chronology",
+                "records.lifecycle",
+                "records.lifecycle.recovery",
+            ],
+        },
+    ),
 )
 
 
@@ -392,6 +529,17 @@ manifest = ModuleManifest(
                 surface_id="records.navigation",
             ),
         ),
+        product_areas=(
+            ProductAreaContribution(
+                id="records-documents",
+                module_id=MODULE_ID,
+                label="i18n:govoplan-core.product_area.records_documents",
+                icon="folder",
+                description="i18n:govoplan-core.product_area.records_documents_description",
+                surface_ids=("records.navigation", "records.workspace"),
+                order=30,
+            ),
+        ),
         view_surfaces=(
             ViewSurface(
                 id="records.workspace.file-plan",
@@ -431,10 +579,12 @@ manifest = ModuleManifest(
         ModuleInterfaceProvider(name="records.registry", version="1.0.0"),
         ModuleInterfaceProvider(name="records.filing", version="1.0.0"),
         ModuleInterfaceProvider(name="records.archive", version="1.0.0"),
+        ModuleInterfaceProvider(name=RECORDS_DSAR_CAPABILITY, version="0.1.0"),
     ),
     capability_factories={
         CAPABILITY_RECORDS_FILING: _records_registry,
         record_archive_capability(SIMULATION_PROVIDER_ID): _simulated_archive_provider,
+        RECORDS_DSAR_CAPABILITY: _dsar_provider,
     },
     capability_documentation={
         CAPABILITY_RECORDS_FILING: CapabilityDocumentation(
@@ -449,6 +599,11 @@ manifest = ModuleManifest(
             ),
             contract_version="1.0.0",
         ),
+        RECORDS_DSAR_CAPABILITY: CapabilityDocumentation(
+            label="Records data-subject request provider",
+            summary="Finds minimized eAkte and operator-attribution evidence without bypassing record retention.",
+            contract_version="0.1.0",
+        ),
     },
     migration_spec=MigrationSpec(
         module_id=MODULE_ID,

tests/fixtures/service_to_decision_journey.json

@@ -1,18 +1,193 @@
 {
-  "id": "assisted-service-to-decision-record",
+  "id": "resident-parking-permit-assisted-record",
-  "description": "A completed assisted service is filed, closed, held, appraised, independently approved, and exercised through the archive simulation boundary.",
+  "description": "A completed assisted resident parking permit service is filed as an eAkte, closed, held, appraised, independently approved, restored from backup, and exercised through the archive simulation boundary.",
   "record": {
     "record_id": "record-1",
     "record_number": "2026/0001",
-    "class_id": "class-permit"
+    "class_id": "class-permit",
+    "title": "Permit application Ada Example"
   },
+  "institutional_context": {
+    "service_id": "resident-parking-permit",
+    "case_id": "case-parking-2026-0001",
+    "applicant_party_id": "party-ada-example",
+    "representative_party_id": "party-alex-example",
+    "representation_id": "representation-2026-0001",
+    "authority_id": "authority-mobility-berlin",
+    "responsible_function_id": "function-parking-permits",
+    "mandate_id": "mandate-parking-permits-2026",
+    "purpose": "decide the resident parking permit application",
+    "legal_basis": "StVG section 6 and StVO section 45",
+    "retention_policy_ref": "records-policy:parking-permit:v1"
+  },
+  "digital_equivalent": {
+    "record": {
+      "record_id": "record-digital",
+      "record_number": "2026/0002",
+      "class_id": "class-permit",
+      "title": "Permit application Dana Digital"
+    },
+    "institutional_context_overrides": {
+      "case_id": "case-parking-2026-0002",
+      "applicant_party_id": "party-dana-digital",
+      "representative_party_id": "party-dana-digital",
+      "representation_id": "self-representation-2026-0002"
+    },
+    "intake_source": {
+      "id": "digital-submission",
+      "source_module": "forms_runtime",
+      "resource_type": "form_submission_revision",
+      "resource_id": "submission-parking-2026-0002",
+      "source_revision": "revision-2-submitted",
+      "label": "Digital resident parking permit submission",
+      "authority_mode": "native_authoritative",
+      "content_type": "application/json",
+      "size_bytes": 3968,
+      "relationship": "initiates",
+      "purpose": "document the submitted application",
+      "filing_reason": "The authenticated digital submission initiated the administrative procedure.",
+      "launch_url": "/forms-runtime/submissions/submission-parking-2026-0002",
+      "metadata": {
+        "evidence_role": "application",
+        "channel": "digital",
+        "authenticated": true,
+        "form_definition_revision": "resident-parking-permit:v4"
+      }
+    }
+  },
+  "sources": [
+    {
+      "id": "assisted-submission",
+      "source_module": "forms_runtime",
+      "resource_type": "form_submission_revision",
+      "resource_id": "submission-parking-2026-0001",
+      "source_revision": "revision-3-submitted",
+      "label": "Assisted resident parking permit submission",
+      "authority_mode": "native_authoritative",
+      "content_type": "application/json",
+      "size_bytes": 4096,
+      "relationship": "initiates",
+      "purpose": "document the submitted application",
+      "filing_reason": "The assisted, read-back submission initiated the administrative procedure.",
+      "launch_url": "/forms-runtime/submissions/submission-parking-2026-0001",
+      "metadata": {
+        "evidence_role": "application",
+        "channel": "assisted",
+        "read_back_confirmed": true,
+        "form_definition_revision": "resident-parking-permit:v4"
+      }
+    },
+    {
+      "id": "application-attachment",
+      "source_module": "files",
+      "resource_type": "file_version",
+      "resource_id": "file-registration-certificate",
+      "source_revision": "version-2",
+      "label": "Vehicle registration certificate.pdf",
+      "authority_mode": "external_authoritative",
+      "content_type": "application/pdf",
+      "size_bytes": 245760,
+      "relationship": "supports",
+      "purpose": "document application eligibility",
+      "filing_reason": "The submitted certificate supports the applicant's vehicle eligibility.",
+      "launch_url": "/files?fileId=file-registration-certificate",
+      "metadata": {
+        "evidence_role": "application_attachment",
+        "malware_scan": "clean"
+      }
+    },
+    {
+      "id": "case-and-representation",
+      "source_module": "cases",
+      "resource_type": "case_revision",
+      "resource_id": "case-parking-2026-0001",
+      "source_revision": "revision-5-representation-verified",
+      "label": "Resident parking permit case with verified representation",
+      "authority_mode": "native_authoritative",
+      "content_type": "application/json",
+      "size_bytes": 8192,
+      "relationship": "governs",
+      "purpose": "document case ownership and representation",
+      "filing_reason": "The case revision identifies the applicant, representative, authority, and verified representation used for the decision.",
+      "launch_url": "/cases/case-parking-2026-0001",
+      "metadata": {
+        "evidence_role": "case_context",
+        "representation_id": "representation-2026-0001",
+        "representation_status": "verified"
+      }
+    },
+    {
+      "id": "formal-decision",
+      "source_module": "decisions",
+      "resource_type": "decision_revision",
+      "resource_id": "decision-parking-2026-0001",
+      "source_revision": "revision-2-issued",
+      "label": "Resident parking permit decision",
+      "authority_mode": "native_authoritative",
+      "content_type": "application/json",
+      "size_bytes": 6144,
+      "relationship": "decides",
+      "purpose": "document the formal administrative outcome",
+      "filing_reason": "The issued decision records the competent authority, legal basis, outcome, and reasons.",
+      "launch_url": "/decisions/decision-parking-2026-0001",
+      "metadata": {
+        "evidence_role": "formal_decision",
+        "outcome": "approved",
+        "legal_basis": "StVG section 6 and StVO section 45"
+      }
+    },
+    {
+      "id": "delivery-receipt",
+      "source_module": "files",
+      "resource_type": "file_version",
+      "resource_id": "file-postbox-delivery-receipt",
+      "source_revision": "version-1",
+      "label": "Trusted postbox delivery receipt.json",
+      "authority_mode": "external_authoritative",
+      "content_type": "application/json",
+      "size_bytes": 2048,
+      "relationship": "proves_delivery",
+      "purpose": "document delivery of the formal decision",
+      "filing_reason": "The immutable receipt proves delivery of the issued decision to the represented applicant's trusted postbox.",
+      "launch_url": "/files?fileId=file-postbox-delivery-receipt",
+      "metadata": {
+        "evidence_role": "delivery_receipt",
+        "decision_revision": "revision-2-issued",
+        "delivery_channel": "trusted_postbox",
+        "delivery_status": "delivered"
+      }
+    },
+    {
+      "id": "correction-evidence",
+      "source_module": "files",
+      "resource_type": "file_version",
+      "resource_id": "file-decision-correction-evidence",
+      "source_revision": "version-1",
+      "label": "Decision address correction evidence.json",
+      "authority_mode": "external_authoritative",
+      "content_type": "application/json",
+      "size_bytes": 2304,
+      "relationship": "corrects",
+      "purpose": "preserve correction chronology without replacing prior evidence",
+      "filing_reason": "The correction evidence links the corrected delivery address to the original decision and receipt while preserving both.",
+      "launch_url": "/files?fileId=file-decision-correction-evidence",
+      "metadata": {
+        "evidence_role": "correction",
+        "corrects_source_id": "delivery-receipt",
+        "previous_evidence_retained": true
+      }
+    }
+  ],
   "expected": {
+    "equivalent_record_count": 2,
+    "filed_item_count": 6,
     "closed_state": "retention_running",
     "appraised_state": "appraised",
     "approved_state": "transfer_pending",
     "hold_blocks_disposition": true,
     "disposition_status": "approved",
     "transfer_status": "simulated_accepted",
-    "custody_transferred": false
+    "custody_transferred": false,
+    "restored_search_query": "Ada Example"
   }
 }

tests/test_documentation.py

@@ -0,0 +1,14 @@
+from __future__ import annotations
+
+from govoplan_records.backend.manifest import manifest
+
+
+def test_records_german_workflow_and_reference_are_complete() -> None:
+    topics = {topic.id: topic for topic in manifest.documentation}
+    assert len(topics) == 5
+    for topic in topics.values():
+        assert all(topic.translations["de"].get(key) for key in ("title", "summary", "body"))
+    workflow = topics["records.workspace"]
+    assert workflow.metadata["kind"] == "workflow"
+    assert workflow.conditions
+    assert topics["records.filing"].metadata["kind"] == "reference"

tests/test_dsar_provider.py

@@ -0,0 +1,652 @@
+from __future__ import annotations
+
+import json
+import unittest
+from datetime import UTC, datetime, timedelta
+
+from sqlalchemy import create_engine
+from sqlalchemy.orm import Session
+
+from govoplan_core.core.dsar import (
+    DsarErasureActionRef,
+    DsarProvider,
+    DsarRecordRef,
+    DsarSubjectRef,
+)
+from govoplan_core.db.base import Base
+from govoplan_core.privacy.dsar_workflow import (
+    create_data_subject_request,
+    search_data_subject_request,
+)
+from govoplan_records.backend.db.models import (
+    RecordChronologyEntry,
+    RecordClassRevision,
+    RecordDispositionRevision,
+    RecordFilePlanRevision,
+    RecordHoldRevision,
+    RecordIdentity,
+    RecordItem,
+    RecordRevision,
+    RecordTransferPackageRevision,
+    RecordVolumeRevision,
+)
+from govoplan_records.backend.dsar_provider import (
+    RECORDS_DSAR_CAPABILITY,
+    RecordsDsarProvider,
+)
+from govoplan_records.backend.manifest import manifest
+
+
+NOW = datetime(2026, 8, 21, 15, 0, tzinfo=UTC)
+
+
+class _Registry:
+    def __init__(self, provider: RecordsDsarProvider, *, active: bool = True) -> None:
+        self.provider = provider
+        self.active = active
+
+    def capability_names(self):
+        return (RECORDS_DSAR_CAPABILITY,)
+
+    def capability_owner(self, name):
+        self._assert_capability(name)
+        return "records"
+
+    def tenant_entitlement_resolver(self):
+        active = self.active
+
+        class _Resolver:
+            @staticmethod
+            def resolve(session, tenant_id):
+                del session, tenant_id
+                return type(
+                    "State",
+                    (),
+                    {"effective_modules": ("records",) if active else ()},
+                )()
+
+        return _Resolver()
+
+    def require_tenant_capability(self, name, session, **kwargs):
+        del session, kwargs
+        self._assert_capability(name)
+        return self.provider
+
+    def manifests(self):
+        return (type("Manifest", (), {"id": "records"})(),)
+
+    @staticmethod
+    def _assert_capability(name: str) -> None:
+        if name != RECORDS_DSAR_CAPABILITY:
+            raise KeyError(name)
+
+
+class RecordsDsarProviderTests(unittest.TestCase):
+    def setUp(self) -> None:
+        self.engine = create_engine("sqlite+pysqlite:///:memory:")
+        Base.metadata.create_all(self.engine)
+        self.session = Session(self.engine)
+        self.provider = RecordsDsarProvider()
+        self.assertIsInstance(self.provider, DsarProvider)
+        self._seed_record_package()
+        self._seed_unrelated_records()
+        self._seed_operator_configuration()
+        self.session.commit()
+
+    def tearDown(self) -> None:
+        self.session.close()
+        self.engine.dispose()
+
+    def _seed_record_package(self) -> None:
+        identity = RecordIdentity(
+            id="identity-row-1",
+            tenant_id="tenant-1",
+            record_id="record-1",
+            record_number="2026/0001",
+            created_by="clerk-1",
+        )
+        self.session.add(identity)
+        self.session.flush()
+        self.session.add_all(
+            (
+                RecordRevision(
+                    id="revision-row-1",
+                    tenant_id="tenant-1",
+                    record_id="record-1",
+                    identity_id=identity.id,
+                    revision=1,
+                    class_id="class-permit",
+                    file_plan_node_id="plan-permits",
+                    title="Resident parking permit record",
+                    description="Application by Ada Example",
+                    state="retention_running",
+                    source_authority_mode="native_authoritative",
+                    access_mode="tenant",
+                    purpose="decide resident parking permit",
+                    classification="personal",
+                    responsible_unit_id="unit-1",
+                    responsible_function_id="function-permits",
+                    external_reference={
+                        "case_id": "case-1",
+                        "account_id": "applicant-1",
+                        "secret": "private-external-reference-do-not-export",
+                    },
+                    institutional_context={
+                        "membership_id": "membership-applicant-1",
+                        "secret": "private-context-do-not-export",
+                    },
+                    search_text="private-search-text-do-not-export",
+                    valid_from=NOW,
+                    recorded_at=NOW,
+                    superseded_at=NOW + timedelta(minutes=1),
+                    changed_by="clerk-1",
+                    snapshot={"secret": "private-snapshot-do-not-export"},
+                ),
+                RecordRevision(
+                    id="revision-row-2",
+                    tenant_id="tenant-1",
+                    record_id="record-1",
+                    identity_id=identity.id,
+                    revision=2,
+                    previous_revision_id="revision-row-1",
+                    class_id="class-permit",
+                    file_plan_node_id="plan-permits",
+                    title="Resident parking permit record",
+                    description="Application by Ada Example",
+                    state="retention_running",
+                    source_authority_mode="native_authoritative",
+                    access_mode="tenant",
+                    purpose="decide resident parking permit",
+                    classification="personal",
+                    responsible_unit_id="unit-1",
+                    responsible_function_id="function-permits",
+                    external_reference={
+                        "case_id": "case-1",
+                        "account_id": "applicant-1",
+                        "secret": "private-external-reference-do-not-export",
+                    },
+                    institutional_context={
+                        "membership_id": "membership-applicant-1",
+                        "secret": "private-context-do-not-export",
+                    },
+                    search_text="private-search-text-do-not-export",
+                    valid_from=NOW,
+                    recorded_at=NOW + timedelta(minutes=1),
+                    changed_by="clerk-1",
+                    closed_at=NOW + timedelta(minutes=1),
+                    retention_started_at=NOW + timedelta(minutes=1),
+                    retention_due_at=NOW + timedelta(days=3650),
+                    retention_rule={"secret": "private-rule-do-not-export"},
+                    appraisal_state="appraised",
+                    appraisal={"secret": "private-appraisal-do-not-export"},
+                    snapshot={"secret": "private-snapshot-do-not-export"},
+                ),
+            )
+        )
+        self.session.add(
+            RecordVolumeRevision(
+                id="volume-row-1",
+                tenant_id="tenant-1",
+                volume_id="volume-1",
+                record_id="record-1",
+                revision=1,
+                sequence=1,
+                label="Application",
+                state="closed",
+                valid_from=NOW,
+                recorded_at=NOW,
+                changed_by="clerk-1",
+            )
+        )
+        self.session.add(
+            RecordItem(
+                id="item-row-1",
+                tenant_id="tenant-1",
+                record_id="record-1",
+                volume_id="volume-1",
+                sequence=1,
+                source_module="cases",
+                resource_type="case_revision",
+                resource_id="case-1",
+                source_revision="revision-2",
+                label="Permit case",
+                relationship="decision_basis",
+                filing_reason="The application belongs to this record.",
+                purpose="document the permit decision",
+                authority_mode="native_authoritative",
+                content_sha256="a" * 64,
+                content_type="application/json",
+                size_bytes=2048,
+                source_valid_from=NOW,
+                source_recorded_at=NOW,
+                launch_url="https://secret.example/do-not-export",
+                filed_at=NOW + timedelta(minutes=1),
+                filed_by="clerk-1",
+                actor_assignment_id="private-assignment-do-not-export",
+                actor_delegation_id="private-delegation-do-not-export",
+                institutional_context={"secret": "private-item-context-do-not-export"},
+                source_metadata={"secret": "private-source-data-do-not-export"},
+                filing_metadata={"secret": "private-filing-data-do-not-export"},
+                idempotency_key="private-item-key-do-not-export",
+                request_sha256="b" * 64,
+            )
+        )
+        self.session.add(
+            RecordChronologyEntry(
+                id="chronology-row-1",
+                tenant_id="tenant-1",
+                record_id="record-1",
+                event_id="event-1",
+                event_type="record.item_filed",
+                record_revision=2,
+                summary="private-event-summary-do-not-export",
+                occurred_at=NOW + timedelta(minutes=1),
+                actor_id="clerk-1",
+                actor_assignment_id="private-assignment-do-not-export",
+                actor_delegation_id="private-delegation-do-not-export",
+                purpose="document the permit decision",
+                idempotency_key="private-event-key-do-not-export",
+                request_sha256="c" * 64,
+                institutional_context={"secret": "private-event-context-do-not-export"},
+                payload={"secret": "private-event-payload-do-not-export"},
+            )
+        )
+        self.session.add(
+            RecordHoldRevision(
+                id="hold-row-1",
+                tenant_id="tenant-1",
+                hold_id="hold-1",
+                record_id="record-1",
+                revision=1,
+                status="released",
+                reason="private-hold-reason-do-not-export",
+                authority="private-hold-authority-do-not-export",
+                scope={"secret": "private-hold-scope-do-not-export"},
+                effective_from=NOW + timedelta(minutes=2),
+                released_at=NOW + timedelta(minutes=3),
+                policy_refs=["private-policy-do-not-export"],
+                institutional_context={"secret": "private-hold-context-do-not-export"},
+                recorded_at=NOW + timedelta(minutes=2),
+                changed_by="clerk-1",
+                idempotency_key="private-hold-key-do-not-export",
+                request_sha256="d" * 64,
+            )
+        )
+        self.session.add(
+            RecordDispositionRevision(
+                id="disposition-row-1",
+                tenant_id="tenant-1",
+                disposition_id="disposition-1",
+                record_id="record-1",
+                revision=1,
+                action="transfer",
+                status="approved",
+                reason="private-disposition-reason-do-not-export",
+                subject_revision=2,
+                subject_sha256="e" * 64,
+                consequence_preview={"secret": "private-preview-do-not-export"},
+                policy_refs=["private-policy-do-not-export"],
+                approval_request_id="private-approval-do-not-export",
+                proposed_by="clerk-1",
+                reviewed_by="reviewer-1",
+                reviewed_at=NOW + timedelta(minutes=4),
+                institutional_context={
+                    "secret": "private-disposition-context-do-not-export"
+                },
+                recorded_at=NOW + timedelta(minutes=3),
+                idempotency_key="private-disposition-key-do-not-export",
+                request_sha256="f" * 64,
+            )
+        )
+        self.session.add(
+            RecordTransferPackageRevision(
+                id="transfer-row-1",
+                tenant_id="tenant-1",
+                package_id="package-1",
+                record_id="record-1",
+                disposition_id="disposition-1",
+                revision=1,
+                record_revision=2,
+                provider_id="archive-1",
+                profile="xarchive",
+                status="accepted",
+                authority_mode="external_authoritative",
+                manifest={"secret": "private-manifest-do-not-export"},
+                manifest_sha256="1" * 64,
+                receipt={"secret": "private-receipt-do-not-export"},
+                receipt_sha256="2" * 64,
+                external_reference="private-archive-reference-do-not-export",
+                recovery_operation_id="private-recovery-id-do-not-export",
+                simulated=False,
+                institutional_context={
+                    "secret": "private-transfer-context-do-not-export"
+                },
+                recorded_at=NOW + timedelta(minutes=5),
+                changed_by="clerk-1",
+                idempotency_key="private-transfer-key-do-not-export",
+                request_sha256="3" * 64,
+            )
+        )
+
+    def _seed_unrelated_records(self) -> None:
+        for suffix, tenant_id in (("2", "tenant-1"), ("3", "tenant-2")):
+            identity = RecordIdentity(
+                id=f"identity-row-{suffix}",
+                tenant_id=tenant_id,
+                record_id=f"record-{suffix}",
+                record_number=f"2026/000{suffix}",
+                created_by="other-clerk",
+            )
+            self.session.add(identity)
+            self.session.flush()
+            self.session.add(
+                RecordRevision(
+                    id=f"unrelated-revision-row-{suffix}",
+                    tenant_id=tenant_id,
+                    record_id=f"record-{suffix}",
+                    identity_id=identity.id,
+                    revision=1,
+                    class_id="class-permit",
+                    file_plan_node_id="plan-permits",
+                    title=f"Unrelated record {suffix}",
+                    description="unrelated-private-description",
+                    state="open",
+                    source_authority_mode="native_authoritative",
+                    access_mode="tenant",
+                    purpose="unrelated purpose",
+                    external_reference={},
+                    institutional_context={},
+                    search_text="unrelated-private-search",
+                    recorded_at=NOW,
+                    changed_by="other-clerk",
+                    snapshot={"secret": "unrelated-private-snapshot"},
+                )
+            )
+
+    def _seed_operator_configuration(self) -> None:
+        self.session.add(
+            RecordFilePlanRevision(
+                id="plan-row-1",
+                tenant_id="tenant-1",
+                node_id="plan-permits",
+                revision=1,
+                code="10.20",
+                label="Permits",
+                active=True,
+                recorded_at=NOW,
+                institutional_context={"secret": "private-plan-context-do-not-export"},
+                changed_by="clerk-1",
+                idempotency_key="private-plan-key-do-not-export",
+                request_sha256="4" * 64,
+            )
+        )
+        self.session.add(
+            RecordClassRevision(
+                id="class-row-1",
+                tenant_id="tenant-1",
+                class_id="class-permit",
+                revision=1,
+                file_plan_node_id="plan-permits",
+                key="permit.application",
+                label="Permit application",
+                metadata_requirements=["private-metadata-rule-do-not-export"],
+                allowed_source_types=["cases:case_revision"],
+                retention_period_days=3650,
+                access_mode="tenant",
+                active=True,
+                recorded_at=NOW,
+                institutional_context={"secret": "private-class-context-do-not-export"},
+                changed_by="clerk-1",
+                idempotency_key="private-class-key-do-not-export",
+                request_sha256="5" * 64,
+            )
+        )
+
+    def test_direct_record_exports_minimized_complete_lifecycle(self) -> None:
+        records = self.provider.search_subject(
+            self.session,
+            tenant_id="tenant-1",
+            subject=DsarSubjectRef(
+                account_id="applicant-1",
+                external_references={"records.record": "record-1"},
+            ),
+        )
+
+        resource_types = {record.resource_type for record in records}
+        self.assertTrue(
+            {
+                "record_identity",
+                "record_revision",
+                "record_current_fact",
+                "record_volume_revision",
+                "record_item",
+                "record_chronology_entry",
+                "record_hold_revision",
+                "record_disposition_revision",
+                "record_transfer_package_revision",
+            }.issubset(resource_types)
+        )
+        self.assertNotIn(
+            "record-2", json.dumps([record.to_dict() for record in records])
+        )
+        exported = json.dumps([record.to_dict() for record in records])
+        for secret in (
+            "private-snapshot-do-not-export",
+            "private-search-text-do-not-export",
+            "private-context-do-not-export",
+            "private-event-summary-do-not-export",
+            "private-event-payload-do-not-export",
+            "private-hold-reason-do-not-export",
+            "private-preview-do-not-export",
+            "private-manifest-do-not-export",
+            "private-receipt-do-not-export",
+            "private-archive-reference-do-not-export",
+            "private-item-key-do-not-export",
+        ):
+            self.assertNotIn(secret, exported)
+
+    def test_authoritative_source_reference_correlates_the_record(self) -> None:
+        records = self.provider.search_subject(
+            self.session,
+            tenant_id="tenant-1",
+            subject=DsarSubjectRef(
+                account_id="applicant-1",
+                external_references={"cases.case": "case-1"},
+            ),
+        )
+
+        item = next(
+            record for record in records if record.resource_type == "record_item"
+        )
+        self.assertTrue(item.data["source_reference_matches"])
+        self.assertEqual("record-1", item.data["record_id"])
+
+    def test_operator_search_returns_attribution_without_record_contents(self) -> None:
+        records = self.provider.search_subject(
+            self.session,
+            tenant_id="tenant-1",
+            subject=DsarSubjectRef(account_id="clerk-1"),
+        )
+
+        self.assertTrue(records)
+        self.assertEqual(
+            {"records_operator_attribution"},
+            {record.resource_type for record in records},
+        )
+        exported = json.dumps([record.to_dict() for record in records])
+        self.assertNotIn("Application by Ada Example", exported)
+        self.assertNotIn("private-", exported)
+        self.assertIn("changed_file_plan", exported)
+
+    def test_direct_selectors_fail_closed_on_conflict_or_wrong_tenant(self) -> None:
+        conflict = self.provider.search_subject(
+            self.session,
+            tenant_id="tenant-1",
+            subject=DsarSubjectRef(
+                external_references={
+                    "records.record": "record-2",
+                    "records.item": "item-row-1",
+                }
+            ),
+        )
+        alias_conflict = self.provider.search_subject(
+            self.session,
+            tenant_id="tenant-1",
+            subject=DsarSubjectRef(
+                external_references={
+                    "records.record": "record-1",
+                    "records.record_id": "record-2",
+                }
+            ),
+        )
+        wrong_tenant = self.provider.search_subject(
+            self.session,
+            tenant_id="tenant-2",
+            subject=DsarSubjectRef(external_references={"records.record": "record-1"}),
+        )
+        mismatched_actor = self.provider.search_subject(
+            self.session,
+            tenant_id="tenant-1",
+            subject=DsarSubjectRef(
+                account_id="someone-else",
+                external_references={"records.record": "record-1"},
+            ),
+        )
+
+        self.assertEqual((), conflict)
+        self.assertEqual((), alias_conflict)
+        self.assertEqual((), wrong_tenant)
+        self.assertEqual((), mismatched_actor)
+
+    def test_plan_retains_evidence_and_routes_current_fact_to_review(self) -> None:
+        subject = DsarSubjectRef(external_references={"records.record": "record-1"})
+        records = self.provider.search_subject(
+            self.session,
+            tenant_id="tenant-1",
+            subject=subject,
+        )
+        actions = self.provider.plan_erasure(
+            self.session,
+            tenant_id="tenant-1",
+            subject=subject,
+            records=records,
+        )
+
+        self.assertEqual(1, sum(action.kind == "manual_review" for action in actions))
+        self.assertGreater(sum(action.kind == "retain" for action in actions), 7)
+        self.assertTrue(all(not action.executable for action in actions))
+        results = self.provider.execute_erasure(
+            self.session,
+            tenant_id="tenant-1",
+            subject=subject,
+            actions=actions,
+            request_id="dsar-1",
+        )
+        self.assertTrue(all(result.status == "blocked" for result in results))
+
+    def test_foreign_records_and_actions_are_rejected(self) -> None:
+        subject = DsarSubjectRef(external_references={"records.record": "record-1"})
+        with self.assertRaisesRegex(ValueError, "foreign provider record"):
+            self.provider.plan_erasure(
+                self.session,
+                tenant_id="tenant-1",
+                subject=subject,
+                records=(
+                    DsarRecordRef(
+                        provider_id="cases",
+                        module_id="cases",
+                        resource_type="case",
+                        resource_id="case-1",
+                        category="case",
+                        title="Case",
+                    ),
+                ),
+            )
+        with self.assertRaisesRegex(ValueError, "foreign provider action"):
+            self.provider.execute_erasure(
+                self.session,
+                tenant_id="tenant-1",
+                subject=subject,
+                actions=(
+                    DsarErasureActionRef(
+                        action_id="cases:retain:case:case-1",
+                        provider_id="cases",
+                        module_id="cases",
+                        kind="retain",
+                        resource_type="case",
+                        resource_id="case-1",
+                        title="Retain case",
+                        rationale="Evidence",
+                        executable=False,
+                    ),
+                ),
+                request_id="dsar-1",
+            )
+
+    def test_core_workflow_reports_active_and_inactive_provider(self) -> None:
+        row = create_data_subject_request(
+            self.session,
+            tenant_id="tenant-1",
+            reference="DSAR-RECORDS-1",
+            request_kind="access",
+            subject=DsarSubjectRef(external_references={"records.record": "record-1"}),
+            purpose="Respond to a verified request.",
+            legal_basis="Article 15 GDPR",
+            due_at=None,
+            requested_by_account_id="privacy-officer",
+        )
+        self.session.commit()
+        search_data_subject_request(
+            self.session,
+            registry=_Registry(self.provider),
+            row=row,
+            expected_revision=1,
+        )
+        self.assertEqual(
+            [RECORDS_DSAR_CAPABILITY], row.coverage["provider_capabilities"]
+        )
+        self.assertGreater(row.search_result["record_count"], 8)
+
+        inactive = create_data_subject_request(
+            self.session,
+            tenant_id="tenant-1",
+            reference="DSAR-RECORDS-2",
+            request_kind="access",
+            subject=DsarSubjectRef(external_references={"records.record": "record-1"}),
+            purpose="Respond to a verified request.",
+            legal_basis="Article 15 GDPR",
+            due_at=None,
+            requested_by_account_id="privacy-officer",
+        )
+        self.session.commit()
+        search_data_subject_request(
+            self.session,
+            registry=_Registry(self.provider, active=False),
+            row=inactive,
+            expected_revision=1,
+        )
+        self.assertEqual([], inactive.coverage["provider_capabilities"])
+        self.assertEqual(
+            [RECORDS_DSAR_CAPABILITY],
+            inactive.coverage["inactive_provider_capabilities"],
+        )
+        self.assertEqual(0, inactive.search_result["record_count"])
+
+    def test_manifest_registers_and_documents_the_capability(self) -> None:
+        self.assertIn(RECORDS_DSAR_CAPABILITY, manifest.capability_factories)
+        self.assertIn(RECORDS_DSAR_CAPABILITY, manifest.capability_documentation)
+        self.assertIn(
+            RECORDS_DSAR_CAPABILITY,
+            {item.name for item in manifest.provides_interfaces},
+        )
+        self.assertTrue(
+            any(
+                topic.id == "records.data-subject-requests"
+                and {"admin", "user"}.issubset(topic.documentation_types)
+                for topic in manifest.documentation
+            )
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_records.py

@@ -2,8 +2,11 @@ from __future__ import annotations
 
 from dataclasses import dataclass
 from datetime import UTC, datetime, timedelta
+import hashlib
 import json
 from pathlib import Path
+import sqlite3
+import tempfile
 import unittest
 
 from sqlalchemy import create_engine
@@ -73,6 +76,48 @@ class SourceProvider:
         )
 
 
+class ReferenceJourneySourceProvider:
+    def __init__(self, provider_id: str, resource_types: tuple[str, ...]) -> None:
+        self.provider_id = provider_id
+        self._resource_types = resource_types
+
+    def resource_types(self):
+        return self._resource_types
+
+    def resolve(self, session, principal, *, locator, purpose):
+        del session, purpose
+        if principal.tenant_id != locator.tenant_id:
+            raise ValueError("Source access denied.")
+        if locator.source_module != self.provider_id:
+            raise ValueError("The source module does not match this provider.")
+        if locator.resource_type not in self._resource_types:
+            raise ValueError("The source type is not supported by this provider.")
+        metadata = dict(locator.metadata)
+        reference = dict(metadata.get("reference") or {})
+        digest_input = ":".join(
+            (
+                locator.source_module,
+                locator.resource_type,
+                locator.resource_id,
+                locator.source_revision,
+            )
+        ).encode("utf-8")
+        return RecordSourceReference(
+            locator=locator,
+            label=str(reference.get("label") or locator.resource_id),
+            authority_mode=str(
+                reference.get("authority_mode") or "linked_reference"
+            ),
+            content_sha256=hashlib.sha256(digest_input).hexdigest(),
+            content_type=str(reference.get("content_type") or "application/json"),
+            size_bytes=int(reference.get("size_bytes") or 0),
+            valid_from=NOW,
+            recorded_at=NOW,
+            launch_url=str(reference.get("launch_url") or "") or None,
+            metadata=metadata,
+        )
+
+
 class UnknownOutcomeArchiveProvider:
     provider_id = "unknown_simulation"
 
@@ -131,6 +176,33 @@ class Registry:
         }.get(name)
 
 
+class ReferenceJourneyRegistry(Registry):
+    def __init__(self) -> None:
+        super().__init__()
+        self.source_providers_by_module = {
+            "files": ReferenceJourneySourceProvider("files", ("file_version",)),
+            "forms_runtime": ReferenceJourneySourceProvider(
+                "forms_runtime", ("form_submission_revision",)
+            ),
+            "cases": ReferenceJourneySourceProvider("cases", ("case_revision",)),
+            "decisions": ReferenceJourneySourceProvider(
+                "decisions", ("decision_revision",)
+            ),
+        }
+
+    def capability_names(self):
+        return (
+            *(f"records.source.{name}" for name in self.source_providers_by_module),
+            "records.archive.simulation",
+            "records.archive.unknown_simulation",
+        )
+
+    def tenant_capability(self, name, session, *, tenant_id):
+        if name.startswith("records.source.") and tenant_id == "tenant-1":
+            return self.source_providers_by_module.get(name.removeprefix("records.source."))
+        return super().tenant_capability(name, session, tenant_id=tenant_id)
+
+
 class ApprovalProvider:
     def __init__(self) -> None:
         self.approved = False
@@ -231,7 +303,12 @@ class RecordsTests(unittest.TestCase):
                 "file_plan_node_id": "plan-permits",
                 "key": "permit.application",
                 "label": "Permit application",
-                "allowed_source_types": ["files:file_version"],
+                "allowed_source_types": [
+                    "files:file_version",
+                    "forms_runtime:form_submission_revision",
+                    "cases:case_revision",
+                    "decisions:decision_revision",
+                ],
                 "retention_period_days": 3650,
                 "access_mode": "tenant",
                 "recorded_at": NOW,
@@ -515,7 +592,10 @@ class RecordsTests(unittest.TestCase):
             ).read_text(encoding="utf-8")
         )
         expected = fixture["expected"]
-        self._create_record()
+        record = self._create_record()
+        self.assertEqual(fixture["record"]["record_id"], record["record_id"])
+        self.assertEqual(fixture["record"]["record_number"], record["record_number"])
+        self.assertEqual(fixture["record"]["class_id"], record["class_id"])
         closed = self.records.close_record(
             self.session,
             self.principal,
@@ -724,6 +804,431 @@ class RecordsTests(unittest.TestCase):
         self.assertTrue(recovery["healthy"])
         self.assertTrue(recovery["package_checks"][0]["manifest_verified"])
 
+    def test_assisted_service_reference_journey_survives_backup_and_restore(
+        self,
+    ) -> None:
+        fixture = json.loads(
+            (
+                Path(__file__).parent / "fixtures/service_to_decision_journey.json"
+            ).read_text(encoding="utf-8")
+        )
+        expected = fixture["expected"]
+        context = fixture["institutional_context"]
+        self.records = SqlRecordRegistry(ReferenceJourneyRegistry())
+
+        def create_journey_record(
+            record_data: dict[str, object],
+            record_context: dict[str, object],
+            *,
+            idempotency_suffix: str,
+            channel: str,
+        ) -> dict[str, object]:
+            return self.records.create_record(
+                self.session,
+                self.principal,
+                payload={
+                    **record_data,
+                    "file_plan_node_id": "plan-permits",
+                    "description": fixture["description"],
+                    "state": "open",
+                    "source_authority_mode": "native_authoritative",
+                    "access_mode": "tenant",
+                    "purpose": record_context["purpose"],
+                    "responsible_unit_id": "unit-mobility-services",
+                    "responsible_function_id": record_context[
+                        "responsible_function_id"
+                    ],
+                    "institutional_context": {**record_context, "channel": channel},
+                    "recorded_at": NOW + timedelta(minutes=1),
+                    "valid_from": NOW,
+                    "change_reason": f"The {channel} application was accepted for processing.",
+                    "idempotency_key": f"reference-record-create-{idempotency_suffix}",
+                },
+            )
+
+        def filing_request(
+            record_id: str,
+            source: dict[str, object],
+            record_context: dict[str, object],
+            *,
+            idempotency_suffix: str = "",
+        ) -> RecordFilingRequest:
+            metadata = dict(source["metadata"])
+            return RecordFilingRequest(
+                tenant_id="tenant-1",
+                record_id=record_id,
+                source=RecordSourceLocator(
+                    tenant_id="tenant-1",
+                    source_module=str(source["source_module"]),
+                    resource_type=str(source["resource_type"]),
+                    resource_id=str(source["resource_id"]),
+                    source_revision=str(source["source_revision"]),
+                    metadata={
+                        "reference": {
+                            "label": source["label"],
+                            "authority_mode": source["authority_mode"],
+                            "content_type": source["content_type"],
+                            "size_bytes": source["size_bytes"],
+                            "launch_url": source["launch_url"],
+                        },
+                        **metadata,
+                    },
+                ),
+                purpose=str(source["purpose"]),
+                filing_reason=str(source["filing_reason"]),
+                relationship=str(source["relationship"]),
+                institutional_context={
+                    **record_context,
+                    "evidence_role": metadata["evidence_role"],
+                },
+                metadata={"fixture_source_id": source["id"]},
+                idempotency_key=(
+                    f"reference-file-{source['id']}{idempotency_suffix}"
+                ),
+            )
+
+        record = create_journey_record(
+            fixture["record"], context, idempotency_suffix="assisted", channel="assisted"
+        )
+        self.assertEqual(fixture["record"]["title"], record["title"])
+
+        filed_results = []
+        for source in fixture["sources"]:
+            filed_results.append(
+                self.records.file(
+                    self.session,
+                    self.principal,
+                    request=filing_request(str(record["record_id"]), source, context),
+                )
+            )
+        replay = self.records.file(
+            self.session,
+            self.principal,
+            request=filing_request(
+                str(record["record_id"]), fixture["sources"][0], context
+            ),
+        )
+        self.assertTrue(replay.replayed)
+        self.assertEqual(filed_results[0].item_id, replay.item_id)
+
+        detail = self.records.get_record(
+            self.session, self.principal, record_id=str(record["record_id"])
+        )
+        self.assertEqual(expected["filed_item_count"], len(detail["items"]))
+        self.assertEqual(
+            [source["source_revision"] for source in fixture["sources"]],
+            [item["source"]["source_revision"] for item in detail["items"]],
+        )
+        self.assertEqual(
+            [source["relationship"] for source in fixture["sources"]],
+            [item["relationship"] for item in detail["items"]],
+        )
+        self.assertEqual(
+            {
+                "application",
+                "application_attachment",
+                "case_context",
+                "formal_decision",
+                "delivery_receipt",
+                "correction",
+            },
+            {item["source_metadata"]["evidence_role"] for item in detail["items"]},
+        )
+
+        digital_fixture = fixture["digital_equivalent"]
+        digital_context = {
+            **context,
+            **digital_fixture["institutional_context_overrides"],
+        }
+        digital_record = create_journey_record(
+            digital_fixture["record"],
+            digital_context,
+            idempotency_suffix="digital",
+            channel="digital",
+        )
+        digital_sources = [digital_fixture["intake_source"]]
+        for source in fixture["sources"][1:]:
+            digital_sources.append(
+                {
+                    **source,
+                    "id": f"digital-{source['id']}",
+                    "resource_id": f"{source['resource_id']}-digital",
+                    "label": f"Digital equivalent · {source['label']}",
+                }
+            )
+        for source in digital_sources:
+            self.records.file(
+                self.session,
+                self.principal,
+                request=filing_request(
+                    str(digital_record["record_id"]),
+                    source,
+                    digital_context,
+                    idempotency_suffix="-digital",
+                ),
+            )
+        digital_detail = self.records.get_record(
+            self.session,
+            self.principal,
+            record_id=str(digital_record["record_id"]),
+        )
+        def equivalence_fields(item):
+            return (
+                item["source"]["source_module"],
+                item["source"]["resource_type"],
+                item["relationship"],
+                item["source_metadata"]["evidence_role"],
+            )
+        self.assertEqual(
+            [equivalence_fields(item) for item in detail["items"]],
+            [equivalence_fields(item) for item in digital_detail["items"]],
+        )
+        all_records, total_records = self.records.list_records(
+            self.session, self.principal
+        )
+        self.assertEqual(expected["equivalent_record_count"], total_records)
+        self.assertEqual(
+            {fixture["record"]["record_id"], digital_fixture["record"]["record_id"]},
+            {item["record_id"] for item in all_records},
+        )
+
+        lifecycle_start = datetime.now(UTC).replace(microsecond=0) + timedelta(
+            minutes=10
+        )
+        closed = self.records.close_record(
+            self.session,
+            self.principal,
+            record_id=str(record["record_id"]),
+            payload={
+                "expected_revision": 1,
+                "purpose": "close completed resident parking permit record",
+                "reason": "Decision, delivery, and correction evidence are complete.",
+                "recorded_at": lifecycle_start,
+                "idempotency_key": "reference-close",
+            },
+        )
+        self.assertEqual(expected["closed_state"], closed["state"])
+        appraised = self.records.appraise_record(
+            self.session,
+            self.principal,
+            record_id=str(record["record_id"]),
+            payload={
+                "expected_revision": 2,
+                "outcome": "transfer",
+                "purpose": "appraise completed resident parking permit record",
+                "reason": "Offer the complete record after governed review.",
+                "policy_refs": [context["retention_policy_ref"]],
+                "override_retention_not_due": True,
+                "recorded_at": lifecycle_start + timedelta(minutes=1),
+                "idempotency_key": "reference-appraise",
+            },
+        )
+        self.assertEqual(expected["appraised_state"], appraised["state"])
+        hold = self.records.apply_hold(
+            self.session,
+            self.principal,
+            record_id=str(record["record_id"]),
+            payload={
+                "expected_record_revision": 3,
+                "reason": "Preserve the record while a correction is reviewed.",
+                "authority": "Mobility authority review 2026-17",
+                "purpose": "preserve correction evidence",
+                "policy_refs": [context["retention_policy_ref"]],
+                "institutional_context": context,
+                "recorded_at": lifecycle_start + timedelta(minutes=2),
+                "idempotency_key": "reference-hold",
+            },
+        )
+        with self.assertRaisesRegex(RecordConflictError, "active record hold"):
+            self.records.propose_disposition(
+                self.session,
+                self.principal,
+                record_id=str(record["record_id"]),
+                payload={
+                    "expected_record_revision": 3,
+                    "action": "transfer",
+                    "reason": "Attempt transfer while evidence is held.",
+                    "purpose": "prove hold enforcement",
+                    "recorded_at": lifecycle_start + timedelta(minutes=3),
+                    "idempotency_key": "reference-disposition-blocked",
+                },
+            )
+        self.records.release_hold(
+            self.session,
+            self.principal,
+            record_id=str(record["record_id"]),
+            hold_id=str(hold["hold_id"]),
+            payload={
+                "expected_hold_revision": 1,
+                "reason": "Correction review completed with prior evidence preserved.",
+                "purpose": "resume governed disposition",
+                "recorded_at": lifecycle_start + timedelta(minutes=4),
+                "idempotency_key": "reference-hold-release",
+            },
+        )
+        disposition = self.records.propose_disposition(
+            self.session,
+            self.principal,
+            record_id=str(record["record_id"]),
+            payload={
+                "disposition_id": "reference-disposition",
+                "expected_record_revision": 3,
+                "action": "transfer",
+                "reason": "The complete record is ready for an independently reviewed offer.",
+                "purpose": "prepare governed archive offer",
+                "policy_refs": [context["retention_policy_ref"]],
+                "institutional_context": context,
+                "recorded_at": lifecycle_start + timedelta(minutes=5),
+                "idempotency_key": "reference-disposition",
+            },
+        )
+        self.records.registry.approvals.approved = True
+        finalized = self.records.finalize_disposition(
+            self.session,
+            self.principal,
+            record_id=str(record["record_id"]),
+            disposition_id=str(disposition["disposition_id"]),
+            payload={
+                "expected_disposition_revision": 1,
+                "purpose": "record independent disposition approval",
+                "recorded_at": lifecycle_start + timedelta(minutes=6),
+                "idempotency_key": "reference-disposition-finalize",
+            },
+        )
+        self.assertEqual(expected["approved_state"], finalized["record"]["state"])
+        package = self.records.prepare_transfer_package(
+            self.session,
+            self.principal,
+            record_id=str(record["record_id"]),
+            payload={
+                "package_id": "reference-transfer-package",
+                "disposition_id": str(disposition["disposition_id"]),
+                "expected_record_revision": 4,
+                "provider_id": "simulation",
+                "profile": "govoplan-simulation-v1",
+                "purpose": "validate archive transfer boundary",
+                "recorded_at": lifecycle_start + timedelta(minutes=7),
+                "idempotency_key": "reference-transfer-prepare",
+            },
+        )
+        receipt = self.records.dispatch_transfer_package(
+            self.session,
+            self.principal,
+            record_id=str(record["record_id"]),
+            package_id=str(package["package_id"]),
+            payload={
+                "expected_package_revision": 1,
+                "purpose": "validate archive receipt handling",
+                "recorded_at": lifecycle_start + timedelta(minutes=8),
+                "idempotency_key": "reference-transfer-dispatch",
+            },
+        )
+        self.assertEqual(expected["transfer_status"], receipt["status"])
+        self.assertEqual(
+            expected["custody_transferred"],
+            receipt["receipt"]["metadata"]["custody_transferred"],
+        )
+        self.session.commit()
+
+        with tempfile.TemporaryDirectory(prefix="govoplan-records-restore-") as temp_dir:
+            backup_path = Path(temp_dir) / "restored-records.sqlite3"
+            source_connection = self.engine.raw_connection()
+            try:
+                with sqlite3.connect(backup_path) as backup_connection:
+                    source_connection.driver_connection.backup(backup_connection)
+            finally:
+                source_connection.close()
+
+            restored_engine = create_engine(f"sqlite+pysqlite:///{backup_path}")
+            restored_session = Session(restored_engine)
+            try:
+                restored_records = SqlRecordRegistry(ReferenceJourneyRegistry())
+                matches, total = restored_records.list_records(
+                    restored_session,
+                    self.principal,
+                    query=expected["restored_search_query"],
+                )
+                self.assertEqual(1, total)
+                self.assertEqual(record["record_id"], matches[0]["record_id"])
+
+                restored = restored_records.get_record(
+                    restored_session,
+                    self.principal,
+                    record_id=str(record["record_id"]),
+                )
+                self.assertEqual(expected["filed_item_count"], len(restored["items"]))
+                self.assertEqual(
+                    {**context, "channel": "assisted"},
+                    restored["record"]["institutional_context"],
+                )
+                self.assertEqual("released", restored["holds"][0]["status"])
+                self.assertEqual(
+                    expected["disposition_status"],
+                    restored["dispositions"][0]["status"],
+                )
+                self.assertEqual(
+                    [context["retention_policy_ref"]],
+                    restored["dispositions"][0]["policy_refs"],
+                )
+                self.assertEqual(
+                    expected["transfer_status"],
+                    restored["transfer_packages"][0]["status"],
+                )
+                self.assertTrue(restored["transfer_packages"][0]["simulated"])
+                self.assertEqual(
+                    expected["filed_item_count"],
+                    sum(
+                        entry["event_type"] == "record.item_filed"
+                        for entry in restored["chronology"]
+                    ),
+                )
+
+                recovery = restored_records.recovery_status(
+                    restored_session,
+                    self.principal,
+                    record_id=str(record["record_id"]),
+                )
+                self.assertTrue(recovery["healthy"])
+                self.assertEqual(
+                    expected["filed_item_count"], len(recovery["source_checks"])
+                )
+                self.assertTrue(
+                    all(
+                        check["status"] == "verified"
+                        for check in recovery["source_checks"]
+                    )
+                )
+                self.assertTrue(
+                    all(
+                        check["manifest_verified"]
+                        for check in recovery["package_checks"]
+                    )
+                )
+
+                token = bind_temporal_data_context(
+                    TemporalDataContext(
+                        validity_mode="at",
+                        valid_at=lifecycle_start - timedelta(minutes=1),
+                        recorded_at=lifecycle_start - timedelta(minutes=1),
+                    )
+                )
+                try:
+                    historical = restored_records.get_record(
+                        restored_session,
+                        self.principal,
+                        record_id=str(record["record_id"]),
+                    )
+                    self.assertEqual("open", historical["record"]["state"])
+                    self.assertEqual(
+                        expected["filed_item_count"], len(historical["items"])
+                    )
+                    self.assertEqual([], historical["transfer_packages"])
+                finally:
+                    reset_temporal_data_context(token)
+            finally:
+                restored_session.close()
+                restored_engine.dispose()
+
     def test_disposition_waits_for_optional_approvals_and_can_be_withdrawn(
         self,
     ) -> None:

tests/test_reference_journey_ui.py

@@ -0,0 +1,71 @@
+from __future__ import annotations
+
+from pathlib import Path
+import unittest
+
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+class ReferenceJourneyUiTests(unittest.TestCase):
+    def test_actor_can_resume_and_reconstruct_the_record_journey(self) -> None:
+        page = (ROOT / "webui/src/features/records/RecordsPage.tsx").read_text(
+            encoding="utf-8"
+        )
+        lifecycle = (
+            ROOT / "webui/src/features/records/RecordLifecyclePanel.tsx"
+        ).read_text(encoding="utf-8")
+        api = (ROOT / "webui/src/api/records.ts").read_text(encoding="utf-8")
+
+        for marker in (
+            'searchParams.get("recordId")',
+            'next.set("recordId", selectedRecordId)',
+            "filingPresetFrom(searchParams)",
+            'searchParams.get("sourceRevision")',
+            '<WorkspaceActionBar',
+            "refreshable",
+            'reloadAction={{ onReload: reload',
+            'data-help-context-id="records.governance-context"',
+            'data-help-context-id="records.record-items"',
+            'data-help-context-id="records.chronology"',
+            "item.source.source_revision",
+            "item.authority_mode",
+            "item.relationship",
+            "item.purpose",
+            "item.source_metadata.evidence_role",
+            "detail.access_explanation.current_authorization",
+        ):
+            self.assertIn(marker, page)
+
+        for action in (
+            'openAction("close")',
+            'openAction("reopen")',
+            'openAction("appraise")',
+            'openAction("hold")',
+            'openAction("release-hold", holdId)',
+            'openAction("disposition")',
+            'openAction("finalize")',
+            'openAction("prepare-transfer")',
+            'openAction("dispatch-transfer")',
+            "openRecovery",
+            "Release all active holds first.",
+            "Simulation only",
+            "custody",
+            "item.policy_refs",
+        ):
+            self.assertIn(action, lifecycle)
+
+        for endpoint in (
+            '"close"',
+            '"reopen"',
+            '"appraise"',
+            '"holds"',
+            '"dispositions"',
+            '"transfer-packages"',
+            "/recovery`",
+        ):
+            self.assertIn(endpoint, api)
+
+
+if __name__ == "__main__":
+    unittest.main()

webui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@govoplan/records-webui",
-  "version": "0.1.19",
+  "version": "0.1.22",
   "private": true,
   "type": "module",
   "main": "src/index.ts",

webui/src/api/records.ts

@@ -89,9 +89,15 @@ export type RecordItem = {
   content_sha256?: string | null;
   content_type?: string | null;
   size_bytes?: number | null;
+  source_valid_from?: string | null;
+  source_valid_to?: string | null;
+  source_recorded_at?: string | null;
   launch_url?: string | null;
   filed_at: string;
   filed_by?: string | null;
+  institutional_context: Record<string, unknown>;
+  source_metadata: Record<string, unknown>;
+  filing_metadata: Record<string, unknown>;
 };
 
 export type RecordChronology = {
@@ -147,10 +153,15 @@ export type RecordTransferPackage = {
   provider_id: string;
   profile: string;
   status: string;
+  authority_mode: string;
+  manifest: Record<string, unknown>;
   manifest_sha256: string;
+  receipt: Record<string, unknown>;
   receipt_sha256?: string | null;
   external_reference?: string | null;
+  recovery_operation_id?: string | null;
   simulated: boolean;
+  institutional_context: Record<string, unknown>;
   recorded_at: string;
 };
 

webui/src/features/records/RecordCatalogDialog.tsx

@@ -1,5 +1,5 @@
 import { useEffect, useState, type FormEvent } from "react";
-import {
+import { DialogForm,
   Button,
   Dialog,
   DismissibleAlert,
@@ -146,7 +146,7 @@ export function RecordCatalogDialog({
       footer={<><Button type="button" variant="ghost" onClick={onClose} disabled={saving}>Cancel</Button><Button type="submit" form="records-catalog-form" variant="primary" disabledReason={saving ? "The catalog revision is being saved." : !isValid ? "Complete all required catalog fields." : undefined}>{saving ? "Saving" : "Save revision"}</Button></>}
     >
       {error && <DismissibleAlert tone="danger" resetKey={error}>{error}</DismissibleAlert>}
-      <form id="records-catalog-form" className="records-dialog-form" onSubmit={submit}>
+      <DialogForm id="records-catalog-form" className="records-dialog-form" onSubmit={submit}>
         <FormField label="Catalog object">
           <select value={kind} onChange={(event) => { setKind(event.target.value as typeof kind); setSelectedId(""); }}>
             <option value="file-plan">File-plan node</option>
@@ -162,9 +162,9 @@ export function RecordCatalogDialog({
         <FormField label={kind === "file-plan" ? "Node ID" : "Class ID"}><input value={identifier} onChange={(event) => setIdentifier(event.target.value)} disabled={Boolean(selectedId)} required /></FormField>
         <FormField label={kind === "file-plan" ? "Code" : "Key"}><input value={code} onChange={(event) => setCode(event.target.value)} required /></FormField>
         <FormField label="Label"><input value={label} onChange={(event) => setLabel(event.target.value)} required /></FormField>
-        {kind === "file-plan" ? <FormField label="Parent node"><select value={parentId} onChange={(event) => setParentId(event.target.value)}><option value="">Top level</option>{catalog.file_plan.filter((item) => item.node_id !== identifier).map((item) => <option key={item.node_id} value={item.node_id}>{item.code} · {item.label}</option>)}</select></FormField> : <><FormField label="File-plan node"><select value={filePlanNodeId} onChange={(event) => setFilePlanNodeId(event.target.value)} required>{catalog.file_plan.map((item) => <option key={item.node_id} value={item.node_id}>{item.code} · {item.label}</option>)}</select></FormField><FormField label="Retention period (days)"><input type="number" min="0" value={retentionDays} onChange={(event) => setRetentionDays(event.target.value)} /></FormField><FormField label="Retention trigger"><select value={closureTrigger} onChange={(event) => setClosureTrigger(event.target.value)}><option value="record_closed">Record closure</option><option value="calendar_month_end">End of closure month</option><option value="calendar_year_end">End of closure year</option><option value="explicit">Explicit date at closure</option></select></FormField></>}
+        {kind === "file-plan" ? <FormField label="Parent node"><select value={parentId} onChange={(event) => setParentId(event.target.value)}><option value="">Top level</option>{catalog.file_plan.filter((item) => item.node_id !== identifier).map((item) => <option key={item.node_id} value={item.node_id}>{item.code} · {item.label}</option>)}</select></FormField> : <><FormField label="File-plan node"><select value={filePlanNodeId} onChange={(event) => setFilePlanNodeId(event.target.value)} required>{catalog.file_plan.map((item) => <option key={item.node_id} value={item.node_id}>{item.code} · {item.label}</option>)}</select></FormField><FormField label="Retention period (days)" helpContextId="records.field.retention-trigger" helpModuleId="records"><input type="number" min="0" value={retentionDays} onChange={(event) => setRetentionDays(event.target.value)} /></FormField><FormField label="Retention trigger" helpContextId="records.field.retention-trigger" helpModuleId="records"><select value={closureTrigger} onChange={(event) => setClosureTrigger(event.target.value)}><option value="record_closed">Record closure</option><option value="calendar_month_end">End of closure month</option><option value="calendar_year_end">End of closure year</option><option value="explicit">Explicit date at closure</option></select></FormField></>}
         <FormField label="Description"><textarea rows={4} value={description} onChange={(event) => setDescription(event.target.value)} /></FormField>
-      </form>
+      </DialogForm>
     </Dialog>
   );
 }

webui/src/features/records/RecordLifecyclePanel.tsx

@@ -10,7 +10,7 @@ import {
   RotateCcw
 } from "lucide-react";
 import { useEffect, useMemo, useState, type FormEvent } from "react";
-import {
+import { DialogForm,
   Button,
   Dialog,
   DismissibleAlert,
@@ -258,10 +258,10 @@ export function RecordLifecyclePanel({
           {availableActions.canReopen && <Button type="button" variant="ghost" onClick={() => openAction("reopen")}><RotateCcw size={16} aria-hidden="true" /> Reopen</Button>}
           {availableActions.canAppraise && <Button type="button" variant="ghost" onClick={() => openAction("appraise")}><CheckCheck size={16} aria-hidden="true" /> Appraise</Button>}
           <Button type="button" variant="ghost" onClick={() => openAction("hold")} disabledReason={!canWrite ? "Your account may not apply a hold." : undefined}><LockKeyhole size={16} aria-hidden="true" /> Apply hold</Button>
-          {availableActions.canPropose && <Button type="button" variant="primary" onClick={() => openAction("disposition")} disabledReason={activeHolds.length ? "Release all active holds first." : undefined}><ArchiveRestore size={16} aria-hidden="true" /> Propose disposition</Button>}
+          {availableActions.canPropose && <Button type="button" variant="primary" helpContextId="records.lifecycle.disposition" helpModuleId="records" onClick={() => openAction("disposition")} disabledReason={activeHolds.length ? "Release all active holds first." : undefined}><ArchiveRestore size={16} aria-hidden="true" /> Propose disposition</Button>}
-          {availableActions.canFinalize && <Button type="button" variant="primary" onClick={() => openAction("finalize")} disabledReason={activeHolds.length ? "Release all active holds first." : undefined}><CheckCheck size={16} aria-hidden="true" /> Finalize approved disposition</Button>}
+          {availableActions.canFinalize && <Button type="button" variant="primary" helpContextId="records.lifecycle.finalize" helpModuleId="records" onClick={() => openAction("finalize")} disabledReason={activeHolds.length ? "Release all active holds first." : undefined}><CheckCheck size={16} aria-hidden="true" /> Finalize approved disposition</Button>}
-          {currentDisposition && ["review_pending", "review_unavailable"].includes(currentDisposition.status) && <Button type="button" variant="ghost" onClick={() => openAction("withdraw")}><Ban size={16} aria-hidden="true" /> Withdraw proposal</Button>}
+          {currentDisposition && ["review_pending", "review_unavailable"].includes(currentDisposition.status) && <Button type="button" variant="ghost" helpContextId="records.lifecycle.disposition" helpModuleId="records" onClick={() => openAction("withdraw")}><Ban size={16} aria-hidden="true" /> Withdraw proposal</Button>}
-          {availableActions.canPrepare && <Button type="button" variant="primary" onClick={() => openAction("prepare-transfer")} disabledReason={healthyProviders.length === 0 ? "No healthy archive profile is available." : activeHolds.length ? "Release all active holds first." : undefined}><Box size={16} aria-hidden="true" /> Prepare transfer</Button>}
+          {availableActions.canPrepare && <Button type="button" variant="primary" helpContextId="records.lifecycle.prepare-transfer" helpModuleId="records" onClick={() => openAction("prepare-transfer")} disabledReason={healthyProviders.length === 0 ? "No healthy archive profile is available." : activeHolds.length ? "Release all active holds first." : undefined}><Box size={16} aria-hidden="true" /> Prepare transfer</Button>}
           {availableActions.canDispatch && <Button type="button" variant="primary" onClick={() => openAction("dispatch-transfer")} disabledReason={!currentPackage?.simulated ? "Real archive dispatch needs a target-specific recovery profile." : activeHolds.length ? "Release all active holds first." : undefined}><Play size={16} aria-hidden="true" /> Run simulation</Button>}
           {canAdmin && <Button type="button" variant="ghost" onClick={openRecovery}><ArchiveRestore size={16} aria-hidden="true" /> Recovery evidence</Button>}
         </div>
@@ -286,7 +286,7 @@ export function RecordLifecyclePanel({
       >
         {error && <DismissibleAlert tone="danger" resetKey={error}>{error}</DismissibleAlert>}
         {action === "recovery" ? <RecoveryResult value={recovery} loading={saving} /> : (
-          <form id="records-lifecycle-form" className="records-dialog-form" onSubmit={submit}>
+          <DialogForm id="records-lifecycle-form" className="records-dialog-form" onSubmit={submit}>
             {action === "volume" && <FormField label="Volume label" helpContextId="records.field.volume-label"><input value={label} onChange={(event) => setLabel(event.target.value)} required /></FormField>}
             {["appraise", "disposition"].includes(action ?? "") && <FormField label="Disposition" helpContextId="records.field.disposition"><select value={outcome} onChange={(event) => setOutcome(event.target.value as typeof outcome)}><option value="retain">Retain</option><option value="transfer">Transfer</option><option value="destroy">Destroy</option><option value="reclassify">Reclassify</option></select></FormField>}
             {action === "hold" && <FormField label="Authority" helpContextId="records.field.hold-authority"><input value={authority} onChange={(event) => setAuthority(event.target.value)} required /></FormField>}
@@ -296,7 +296,7 @@ export function RecordLifecyclePanel({
             {action === "finalize" && currentDisposition?.approval_request_id && <DismissibleAlert tone="info" dismissible={false} compact>Approval request <a href="/approvals">{currentDisposition.approval_request_id}</a> must be approved by another account.</DismissibleAlert>}
             {requiresReason(action) && <FormField label="Reason" helpContextId="records.field.lifecycle-reason"><textarea value={reason} onChange={(event) => setReason(event.target.value)} rows={4} required /></FormField>}
             <FormField label="Purpose"><input value={purpose} onChange={(event) => setPurpose(event.target.value)} required /></FormField>
-          </form>
+          </DialogForm>
         )}
       </Dialog>
     </>
@@ -314,7 +314,7 @@ function LifecycleEvidence({ detail, onRelease, canWrite }: { detail: RecordDeta
         <div><dt>Appraisal</dt><dd>{record.appraisal_state ? humanize(record.appraisal_state) : "Not appraised"}</dd></div>
       </dl>
       {detail.volumes.length > 0 && <div className="records-evidence-list"><strong>Volumes</strong>{detail.volumes.map((volume) => <div key={volume.volume_id}><span>{volume.sequence}. {volume.label}</span><StatusBadge status={volume.state === "open" ? "active" : "neutral"} label={humanize(volume.state)} /></div>)}</div>}
-      {detail.holds.length > 0 && <div className="records-evidence-list"><strong>Holds</strong>{detail.holds.map((hold) => <div key={hold.hold_id}><span><b>{hold.authority}</b> · {hold.reason}</span><span className="records-evidence-actions"><StatusBadge status={hold.status === "active" ? "danger" : "neutral"} label={humanize(hold.status)} />{hold.status === "active" && <Button type="button" variant="ghost" iconOnly aria-label="Release hold" title="Release hold" onClick={() => onRelease(hold.hold_id)} disabledReason={!canWrite ? "Your account may not release holds." : undefined}><Ban size={15} aria-hidden="true" /></Button>}</span></div>)}</div>}
+      {detail.holds.length > 0 && <div className="records-evidence-list"><strong>Holds</strong>{detail.holds.map((hold) => <div key={hold.hold_id}><span><b>{hold.authority}</b> · {hold.reason}{hold.policy_refs.length > 0 ? ` · policy ${hold.policy_refs.join(", ")}` : ""}</span><span className="records-evidence-actions"><StatusBadge status={hold.status === "active" ? "danger" : "neutral"} label={humanize(hold.status)} />{hold.status === "active" && <Button type="button" variant="ghost" iconOnly aria-label="Release hold" title="Release hold" onClick={() => onRelease(hold.hold_id)} disabledReason={!canWrite ? "Your account may not release holds." : undefined}><Ban size={15} aria-hidden="true" /></Button>}</span></div>)}</div>}
       {detail.dispositions.map((item) => <DispositionEvidence key={item.disposition_id} item={item} />)}
       {detail.transfer_packages.map((item) => <TransferEvidence key={item.package_id} item={item} />)}
     </div>
@@ -322,11 +322,20 @@ function LifecycleEvidence({ detail, onRelease, canWrite }: { detail: RecordDeta
 }
 
 function DispositionEvidence({ item }: { item: RecordDisposition }) {
-  return <div className="records-evidence-list"><strong>Disposition</strong><div><span><b>{humanize(item.action)}</b> · {item.reason}</span><StatusBadge status={item.status === "approved" ? "active" : item.status === "review_unavailable" ? "danger" : "warning"} label={humanize(item.status)} /></div>{item.approval_request_id && <small>Approval: {item.approval_request_id}</small>}</div>;
+  return <div className="records-evidence-list"><strong>Disposition</strong><div><span><b>{humanize(item.action)}</b> · {item.reason}</span><StatusBadge status={item.status === "approved" ? "active" : item.status === "review_unavailable" ? "danger" : "warning"} label={humanize(item.status)} /></div>{item.policy_refs.length > 0 && <small>Policy: {item.policy_refs.join(", ")}</small>}{item.approval_request_id && <small>Approval: {item.approval_request_id}</small>}</div>;
 }
 
 function TransferEvidence({ item }: { item: RecordTransferPackage }) {
-  return <div className="records-evidence-list"><strong>Transfer package</strong><div><span><b>{item.profile}</b> · {item.manifest_sha256.slice(0, 12)}</span><StatusBadge status={item.status === "simulated_accepted" ? "warning" : item.status === "accepted" ? "active" : "neutral"} label={humanize(item.status)} /></div>{item.simulated && <small>Simulation only; no archival custody.</small>}</div>;
+  const receiptMetadata = typeof item.receipt.metadata === "object" && item.receipt.metadata != null
+    ? item.receipt.metadata as Record<string, unknown>
+    : {};
+  const custodyTransferred = receiptMetadata.custody_transferred === true;
+  const custodySummary = item.simulated
+    ? "Simulation only; no archival custody."
+    : custodyTransferred
+      ? "Archive custody was transferred."
+      : "Archive custody was not transferred.";
+  return <div className="records-evidence-list"><strong>Transfer package</strong><div><span><b>{item.profile}</b> · {item.manifest_sha256.slice(0, 12)}</span><StatusBadge status={item.status === "simulated_accepted" ? "warning" : item.status === "accepted" ? "active" : "neutral"} label={humanize(item.status)} /></div><small>{custodySummary} Authority: {humanize(item.authority_mode)}.</small></div>;
 }
 
 function RecoveryResult({ value, loading }: { value: Record<string, unknown> | null; loading: boolean }) {

webui/src/features/records/RecordsPage.tsx

@@ -3,7 +3,6 @@ import {
   FilePlus2,
   Pencil,
   Plus,
-  RefreshCw,
   Search,
   Settings2
 } from "lucide-react";
@@ -15,18 +14,22 @@ import {
   type FormEvent
 } from "react";
 import { useSearchParams } from "react-router";
-import {
+import { DialogForm,
   Button,
   DataGrid,
   Dialog,
   DismissibleAlert,
   DocumentationHelpLink,
+  FilterBar,
   FormField,
   i18nMessage,
   LoadingIndicator,
   PageScrollViewport,
+  StatePanel,
   StatusBadge,
   useTemporalDataContext,
+  WorkspaceActionBar,
+  WorkspaceFrame,
   type DataGridColumn,
   type PlatformRouteContext
 } from "@govoplan/core-webui";
@@ -232,9 +235,14 @@ export default function RecordsPage({ settings, auth }: PlatformRouteContext) {
 
   return (
     <main className="records-page" data-help-context-id="records.workspace">
-      <div className="records-shell">
+      <WorkspaceFrame className="records-shell" label="Records workspace" interfaceId="records.workspace" helpContextId="records.workspace" helpModuleId="records">
-        <div className="records-toolbar">
+        <WorkspaceActionBar
-          <Button
+          scope="workspace"
+          variant="collection"
+          refreshable
+          reloadAction={{ onReload: reload, loading, label: "Reload records" }}
+          className="records-toolbar"
+          createAction={<Button
             type="button"
             variant="primary"
             onClick={() => setCreateOpen(true)}
@@ -243,18 +251,15 @@ export default function RecordsPage({ settings, auth }: PlatformRouteContext) {
           >
             <Plus size={16} aria-hidden="true" />
             New record
-          </Button>
+          </Button>}
-          <Button type="button" variant="ghost" onClick={reload} disabledReason={loading ? "Records are already loading." : undefined}>
+          contextActions={<>
-            <RefreshCw size={16} aria-hidden="true" />
-            Refresh
-          </Button>
             {canAdmin && (
             <Button type="button" variant="ghost" onClick={() => setCatalogOpen(true)} helpContextId="records.catalog.admin">
               <Settings2 size={16} aria-hidden="true" />
               Catalog
             </Button>
             )}
-          <form className="records-search" onSubmit={submitSearch}>
+            <FilterBar as="form" surface="control" wrap="never" width="compact" className="records-search" onSubmit={submitSearch}>
             <Search size={17} aria-hidden="true" />
             <input
               value={query}
@@ -262,7 +267,7 @@ export default function RecordsPage({ settings, auth }: PlatformRouteContext) {
               aria-label="Search records"
               placeholder="Search records"
             />
-          </form>
+            </FilterBar>
             <span className="records-result-count">
             {i18nMessage("i18n:govoplan-records.record_count", { value0: total })}
             </span>
@@ -272,8 +277,9 @@ export default function RecordsPage({ settings, auth }: PlatformRouteContext) {
               label={selection.validityMode === "all" ? "All valid-time data" : "Historical data"}
             />
             )}
-          <DocumentationHelpLink reference={RECORDS_DOCUMENTATION} />
+          </>}
-        </div>
+          helpAction={<DocumentationHelpLink reference={RECORDS_DOCUMENTATION} />}
+        />
 
         {error && <DismissibleAlert tone="danger" resetKey={error}>{error}</DismissibleAlert>}
         {filingPreset &&
@@ -319,7 +325,7 @@ export default function RecordsPage({ settings, auth }: PlatformRouteContext) {
                 </button>
               ))}
               {!loading && catalog.file_plan.length === 0 && (
-                <p className="records-empty-note">No file-plan nodes are configured.</p>
+                <StatePanel size="inline" description="No file-plan nodes are configured." />
               )}
             </PageScrollViewport>
           </aside>
@@ -360,10 +366,7 @@ export default function RecordsPage({ settings, auth }: PlatformRouteContext) {
             {detailLoading && <LoadingIndicator label="Loading record" />}
             {detailError && <DismissibleAlert tone="danger" resetKey={detailError}>{detailError}</DismissibleAlert>}
             {!detailLoading && !detailError && !detail && (
-              <div className="records-detail-empty">
+              <StatePanel size="fill" icon={<Archive size={28} />} title="Records" description="Select a record to inspect its contents and chronology." />
-                <Archive size={28} aria-hidden="true" />
-                <p>Select a record to inspect its contents and chronology.</p>
-              </div>
             )}
             {!detailLoading && detail && (
               <RecordDetailPanel
@@ -381,7 +384,7 @@ export default function RecordsPage({ settings, auth }: PlatformRouteContext) {
             )}
           </section>
         </div>
-      </div>
+      </WorkspaceFrame>
 
       <RecordDialog
         open={createOpen}
@@ -461,6 +464,7 @@ function RecordDetailPanel({
   onChanged: () => void;
 }) {
   const record = detail.record;
+  const governanceContext = recordContextFacts(record.institutional_context);
   return (
     <PageScrollViewport className="records-detail-scroll">
       <div className="records-detail-header">
@@ -493,6 +497,17 @@ function RecordDetailPanel({
 
       {record.description && <p className="records-description">{record.description}</p>}
 
+      {governanceContext.length > 0 && (
+        <section className="records-detail-section" data-help-context-id="records.governance-context">
+          <div className="records-section-heading"><h2>Governance context</h2></div>
+          <dl className="records-context-facts">
+            {governanceContext.map(([label, value]) => (
+              <div key={label}><dt>{label}</dt><dd>{value}</dd></div>
+            ))}
+          </dl>
+        </section>
+      )}
+
       <RecordLifecyclePanel
         detail={detail}
         archiveProviders={archiveProviders}
@@ -508,7 +523,7 @@ function RecordDetailPanel({
           <span>{detail.items.length}</span>
         </div>
         {detail.items.length === 0 ? (
-          <p className="records-empty-note">No items have been filed in this temporal view.</p>
+          <StatePanel size="inline" description="No items have been filed in this temporal view." />
         ) : (
           <div className="records-item-list">
             {detail.items.map((item) => (
@@ -522,6 +537,15 @@ function RecordDetailPanel({
                   <time>{formatDateTime(item.filed_at)}</time>
                 </div>
                 <p>{item.filing_reason}</p>
+                <dl className="records-item-evidence">
+                  <div><dt>Authority</dt><dd>{humanize(item.authority_mode)}</dd></div>
+                  <div><dt>Relationship</dt><dd>{humanize(item.relationship)}</dd></div>
+                  <div><dt>Purpose</dt><dd>{item.purpose}</dd></div>
+                  <div><dt>Source recorded</dt><dd>{formatDateTime(item.source_recorded_at)}</dd></div>
+                  {typeof item.source_metadata.evidence_role === "string" && (
+                    <div><dt>Evidence role</dt><dd>{humanize(item.source_metadata.evidence_role)}</dd></div>
+                  )}
+                </dl>
               </div>
             ))}
           </div>
@@ -664,7 +688,7 @@ function RecordDialog({
       }
     >
       {error && <DismissibleAlert tone="danger" resetKey={error}>{error}</DismissibleAlert>}
-      <form id="records-record-form" className="records-dialog-form" onSubmit={submit}>
+      <DialogForm id="records-record-form" className="records-dialog-form" onSubmit={submit}>
         <FormField label="Record number" helpContextId="records.field.record-number">
           <input value={recordNumber} onChange={(event) => setRecordNumber(event.target.value)} disabled={mode === "edit"} required />
         </FormField>
@@ -698,7 +722,7 @@ function RecordDialog({
         <FormField label="Change reason" helpContextId="records.field.change-reason">
           <textarea value={changeReason} onChange={(event) => setChangeReason(event.target.value)} rows={3} required />
         </FormField>
-      </form>
+      </DialogForm>
     </Dialog>
   );
 }
@@ -810,7 +834,7 @@ function FilingDialog({
       <DismissibleAlert tone="info" dismissible={false} compact>
         The source module verifies your current access and resolves this exact revision before Records stores the reference.
       </DismissibleAlert>
-      <form id="records-filing-form" className="records-dialog-form" onSubmit={submit}>
+      <DialogForm id="records-filing-form" className="records-dialog-form" onSubmit={submit}>
         <FormField label="Source module" helpContextId="records.field.source-module">
           <select value={sourceModule} onChange={(event) => setSourceModule(event.target.value)} required>
             {providers.map((item) => <option key={item.source_module} value={item.source_module}>{humanize(item.source_module)}</option>)}
@@ -839,7 +863,7 @@ function FilingDialog({
         <FormField label="Filing reason" documentation={RECORDS_FIELD_DOCUMENTATION.filingReason}>
           <textarea value={filingReason} onChange={(event) => setFilingReason(event.target.value)} rows={4} required />
         </FormField>
-      </form>
+      </DialogForm>
     </Dialog>
   );
 }
@@ -879,6 +903,27 @@ function formatBytes(value?: number | null): string {
   return `${(value / 1024 / 1024).toFixed(1)} MiB`;
 }
 
+function recordContextFacts(context: Record<string, unknown>): Array<[string, string]> {
+  const fields: Array<[string, string]> = [
+    ["Service", "service_id"],
+    ["Case", "case_id"],
+    ["Applicant", "applicant_party_id"],
+    ["Representative", "representative_party_id"],
+    ["Representation", "representation_id"],
+    ["Authority", "authority_id"],
+    ["Responsible function", "responsible_function_id"],
+    ["Mandate", "mandate_id"],
+    ["Legal basis", "legal_basis"],
+    ["Retention policy", "retention_policy_ref"]
+  ];
+  return fields.flatMap(([label, key]) => {
+    const value = context[key];
+    if (typeof value === "string" && value.trim()) return [[label, value]];
+    if (Array.isArray(value) && value.length > 0) return [[label, value.map(String).join(", ")]];
+    return [];
+  });
+}
+
 function humanize(value: string): string {
   return value.replace(/[_:.\-]+/g, " ").replace(/\b\w/g, (letter) => letter.toUpperCase());
 }

webui/src/i18n/generatedTranslations.ts

@@ -41,6 +41,16 @@ const en = {
   "Retention input": "Retention input",
   "Not classified": "Not classified",
   "Not configured": "Not configured",
+  "Governance context": "Governance context",
+  "Service": "Service",
+  "Case": "Case",
+  "Applicant": "Applicant",
+  "Representative": "Representative",
+  "Representation": "Representation",
+  "Responsible function": "Responsible function",
+  "Mandate": "Mandate",
+  "Legal basis": "Legal basis",
+  "Retention policy": "Retention policy",
   "Contents": "Contents",
   "No items have been filed in this temporal view.": "No items have been filed in this temporal view.",
   "Chronology": "Chronology",
@@ -66,6 +76,9 @@ const en = {
   "Source object ID": "Source object ID",
   "Exact source revision": "Exact source revision",
   "Filing reason": "Filing reason",
+  "Relationship": "Relationship",
+  "Source recorded": "Source recorded",
+  "Evidence role": "Evidence role",
   "Not set": "Not set",
   "Size unavailable": "Size unavailable",
   "Your account may view records but may not create them.": "Your account may view records but may not create them.",
@@ -121,6 +134,8 @@ const en = {
   "Disposition": "Disposition",
   "Transfer package": "Transfer package",
   "Simulation only; no archival custody.": "Simulation only; no archival custody.",
+  "Archive custody was transferred.": "Archive custody was transferred.",
+  "Archive custody was not transferred.": "Archive custody was not transferred.",
   "Volume label": "Volume label",
   "Authority": "Authority",
   "Explicit retention trigger": "Explicit retention trigger",
@@ -194,6 +209,16 @@ const de: Record<keyof typeof en, string> = {
   "Retention input": "Aufbewahrungsvorgabe",
   "Not classified": "Nicht klassifiziert",
   "Not configured": "Nicht konfiguriert",
+  "Governance context": "Governance-Kontext",
+  "Service": "Leistung",
+  "Case": "Vorgang",
+  "Applicant": "Antragstellende Person",
+  "Representative": "Vertretende Person",
+  "Representation": "Vertretung",
+  "Responsible function": "Zuständige Funktion",
+  "Mandate": "Mandat",
+  "Legal basis": "Rechtsgrundlage",
+  "Retention policy": "Aufbewahrungsrichtlinie",
   "Contents": "Inhalt",
   "No items have been filed in this temporal view.": "In dieser temporalen Ansicht sind keine Objekte veraktet.",
   "Chronology": "Chronologie",
@@ -219,6 +244,9 @@ const de: Record<keyof typeof en, string> = {
   "Source object ID": "ID des Quellobjekts",
   "Exact source revision": "Exakte Quellrevision",
   "Filing reason": "Veraktungsbegründung",
+  "Relationship": "Beziehung",
+  "Source recorded": "Quelle erfasst am",
+  "Evidence role": "Nachweisrolle",
   "Not set": "Nicht gesetzt",
   "Size unavailable": "Größe nicht verfügbar",
   "Your account may view records but may not create them.": "Ihr Konto darf Akten einsehen, aber nicht anlegen.",
@@ -274,6 +302,8 @@ const de: Record<keyof typeof en, string> = {
   "Disposition": "Aussonderung",
   "Transfer package": "Übergabepaket",
   "Simulation only; no archival custody.": "Nur Simulation; keine Archivverwahrung.",
+  "Archive custody was transferred.": "Die Archivverwahrung wurde übertragen.",
+  "Archive custody was not transferred.": "Die Archivverwahrung wurde nicht übertragen.",
   "Volume label": "Bandbezeichnung",
   "Authority": "Anordnende Stelle",
   "Explicit retention trigger": "Expliziter Aufbewahrungsbeginn",

webui/src/styles/records.css

@@ -1,40 +1,14 @@
-.records-page,
+.records-page {
-.records-shell {
   height: 100%;
   min-height: 0;
   overflow: hidden;
 }
 
-.records-shell {
-  display: flex;
-  flex-direction: column;
-  background: var(--panel);
-}
-
-.records-toolbar {
-  display: flex;
-  align-items: center;
-  gap: 10px;
-  min-height: 58px;
-  padding: 9px 14px;
-  border-bottom: var(--border-line-dark);
-  background: var(--panel-header);
-}
-
 .records-search {
-  display: flex;
+  flex: 1 1 420px;
-  align-items: center;
-  gap: 8px;
-  width: min(420px, 100%);
   margin-left: 8px;
 }
 
-.records-search input {
-  min-width: 130px;
-  height: 36px;
-  flex: 1;
-}
-
 .records-result-count {
   margin-left: auto;
   color: var(--muted);
@@ -205,17 +179,6 @@
   padding: 18px 20px 32px;
 }
 
-.records-detail-empty {
-  display: grid;
-  place-items: center;
-  align-content: center;
-  gap: 10px;
-  height: 100%;
-  color: var(--muted);
-  padding: 30px;
-  text-align: center;
-}
-
 .records-detail-header,
 .records-detail-actions,
 .records-section-heading {
@@ -290,6 +253,42 @@
   line-height: 1.55;
 }
 
+.records-context-facts,
+.records-item-evidence {
+  display: grid;
+  margin: 0;
+}
+
+.records-context-facts {
+  grid-template-columns: repeat(2, minmax(0, 1fr));
+  gap: 1px;
+  overflow: hidden;
+  border: var(--border-line);
+  border-radius: var(--radius-sm);
+  background: var(--line);
+}
+
+.records-context-facts > div {
+  min-width: 0;
+  padding: 9px 10px;
+  background: var(--surface);
+}
+
+.records-context-facts dt,
+.records-item-evidence dt {
+  color: var(--muted);
+  font-size: 12px;
+}
+
+.records-context-facts dd,
+.records-item-evidence dd {
+  overflow-wrap: anywhere;
+  margin: 3px 0 0;
+  color: var(--text-strong);
+  font-size: var(--font-size-sm);
+  font-weight: 600;
+}
+
 .records-lifecycle-actions {
   display: flex;
   flex-wrap: wrap;
@@ -412,7 +411,7 @@
   min-width: 24px;
   height: 24px;
   place-items: center;
-  border-radius: 50%;
+  border-radius: var(--radius-round);
   background: var(--surface-strong);
   color: var(--muted);
   font-size: 12px;
@@ -461,6 +460,17 @@
   font-size: var(--font-size-sm);
 }
 
+.records-item-evidence {
+  grid-column: 1 / -1;
+  grid-template-columns: repeat(5, minmax(0, 1fr));
+  gap: 8px;
+  padding-top: 4px;
+}
+
+.records-item-evidence > div {
+  min-width: 0;
+}
+
 .records-chronology > div {
   position: relative;
   display: grid;
@@ -487,7 +497,7 @@
   align-self: start;
   margin: 5px 0 0 3px;
   border: 2px solid var(--accent);
-  border-radius: 50%;
+  border-radius: var(--radius-round);
   background: var(--panel-soft);
 }
 
@@ -529,12 +539,6 @@
   font-weight: 700;
 }
 
-.records-empty-note {
-  margin: 12px;
-  color: var(--muted);
-  font-size: var(--font-size-sm);
-}
-
 .records-dialog {
   width: min(760px, calc(100vw - 32px));
 }
@@ -549,7 +553,7 @@
   grid-column: 1 / -1;
 }
 
-@media (max-width: 1260px) {
+@media (max-width: 1280px) {
   .records-workspace {
     grid-template-columns: minmax(190px, 220px) minmax(330px, 0.85fr) minmax(390px, 1fr);
   }
@@ -585,7 +589,7 @@
   }
 }
 
-@media (max-width: 640px) {
+@media (max-width: 680px) {
   .records-workspace {
     display: flex;
     overflow-y: auto;
@@ -607,6 +611,8 @@
   }
 
   .records-facts,
+  .records-context-facts,
+  .records-item-evidence,
   .records-lifecycle-evidence > dl,
   .records-recovery-result dl,
   .records-access-explanation dl,