[Medformatik]

Unsaved configuration currently disappears when operators change tabs or navigate away, accepted jobs are hard to find again, and saving service configuration disables the form's Apply action. This first layer of the admin UX stack preserves ordinary drafts and navigation state, exposes exact job destinations, and separates saving from queuing runtime application.

• Tabs and Activity selection/filter state use the URL, with keyboard-accessible job controls and details independent of the current list page.
• Ordinary schema/settings drafts stay in memory across tabs, admin routes and soft map navigation. Server changes require conflict review; Settings PATCH sends only edited keys. Confirmed account/origin/session/role changes clear drafts. Credentials, privileged proofs and confirmation inputs remain local to their views.
• Reauthentication and impersonation offer Stay/Discard before leaving or changing authority. Native downloads bypass only the immediate document-exit warning. Reload clears drafts; /car replaces the phone provider and is outside draft retention.
• The session job tray observes accepted application work across admin routes, deduplicates observers while retaining distinct completion effects, and keeps all unresolved observers while showing eight recent entries. Data Manager jobs have source-qualified links. Save followed by failed application is reported as a partial outcome, and clean saved configuration can be applied without another save request.
• Mobile destination selection closes the drawer without changing the desktop sidebar preference.

Stage A of four. Later stacked PRs introduce canonical workspaces/search (B), compact inventories/details and scoped platform editors (C), and focused Data/Transit/privacy workflows (D). API contracts, authority checks and the database schema remain unchanged.

Service configuration before

After: accepted application has a precise job link and truthful queued feedback

After saving: Apply remains available without another edit

Exact Activity detail, with the originating task available

Mobile navigation: expanded menu and destination after selection

Save & apply continues across ordinary service-tab changes with the existing service/origin/schema fence. Clean Apply has its own receipt, malformed job IDs fall back to Activity, discard confirmations are localized, and explicit discard is distinguished from a protected reauthentication continuation.

Stack-wide local verification at the final Stage D head: 109 focused admin/route/library, href-coverage and inode-fixture files / 887 tests pass, together with workspace TypeScript checks, lint, documentation build and the complete production web build, including its service worker and standalone assets. A subsequent full local verification passed lint, types, policy and OpenAPI, but its portable tests had 33 failures across 16 files, mainly wall-clock timeouts under load (26,784 tests passed). All 16 files plus the Linux-failing transit suite then passed serially: 17 files / 231 tests, with unchanged deadlines and assertions. The complete parallel local suite is not reported as green. Each PR's final-head CI supplies its full Linux and database verification.

Stage A screenshots use the hydrated Next dev server against a synthetic loopback API that never forwards requests. Production-build validation is recorded separately above. No real host, provider, email, data or credential mutation was exercised. Native-device and production acceptance remain unverified.

The stack inherits main's Linux inode-reuse fixture correction. This layer also accepts one precise concurrent stale-record refusal in the phase-binding test; it still requires one winner, identical successful bindings and a fresh rebind to that identity. Runtime authority checks are unchanged.

The CI follow-up also handles a reproduced configuration-helper race: the helper waits at most five seconds, within its original deadline, when journal entry or the initial adoption observation is busy. Only those two pre-publication refusals are retried. Later or partial adoption failures still require recovery; no lock is removed and no authority is renewed. Real-filesystem regressions check unchanged observations/indexes, retained partial evidence and guard identity. Helper tests check the retry budget, original identity/deadline and refusal to retry raw later contention.

The capability fixture now captures its issuance time once, pin-pointer crash tests stop at an acknowledged lock-free process boundary before killing, and held ingestion fixtures finish before shutdown. These retain the existing runtime rejection and cleanup assertions.

Release and upgrade impact

Product impact: security

No package release: the added server-only lease error classification and detached configuration-helper wait are internal deployment behavior. The conservative transitive package classification includes private core code, but extension CLI commands, public extension interfaces, versioned schemas and public package export maps remain unchanged; other adoption callers still fail closed. No operator migration or action is required.

Follow-up verification: all 26 ordered native-helper modes pass against disposable migrated Postgres, including the previously failing job/resource/wrong-configuration cases. The held-ingestion fixture passes all 15 database tests; the broader handoff suites pass 60 tests and the 10 new regressions pass again after review refinements. Affected type checks, the bundled ops-agent production build and docs build pass. The serial recheck described above passes; each PR's checks report full Linux and database verification.

The Docker follow-up explicitly upgrades APT in the Data Manager, Transitous runner and Transitous tools Bookworm runtime layers and enforces version 2.6.2 for both apt and libapt-pkg6.0. Privacy backup enforces Trixie version 3.0.4 after its existing distribution upgrade, preserving the PostgreSQL/PostGIS/libpq holds. These floors invalidate old build-cache layers and fail a stale mirror, fixing CVE-2026-109518 without scanner exceptions. The security release fragment explains affected images and normal update/custom-build guidance.

APT follow-up validation: exact runtime package-install layers from all four Dockerfiles built on their pinned arm64 bases and scanned with a fresh Trivy database; every layer has the fixed APT version and zero High/Critical findings. Docker release/fingerprint/selection contracts pass 509 tests across six files, and supply-chain pins, Docker workspace/context checks and host-authority checks pass. Full amd64 image builds/scans remain the final-head CI gate.

API/privacy now has the same 90-minute CI runner budget as the other native-recovery groups. Six successful main jobs measured 19.0–26.6 minutes against the former 30-minute cap (19-minute run, 26.6-minute run); Stage A exceeded that cap. Test membership, individual test timeouts, runtime execution deadlines, fail-fast behavior and the required aggregate remain unchanged. The workflow contract and related checks pass 37 tests, and the CI documentation now lists all five database groups and their runner budgets.