[Medformatik]

Administration now has nine stable workspaces, with topic navigation for Settings, System, Data and Privacy. Settings opens directly to General; Email and Authentication have one owning editor, and Privacy setup links to Email. System groups host tools without hiding hosted Cache and Configuration transfer.

Stack 2/4, based on merged Stage A (#782), targeting main. Stage C will compact inventories/details and split platform fields between their final owners; Stage D will split the Data workflows page into domain pages.

Before — Settings mixed platform operations with application settings.

After — Settings topics and General's own fields.

Search administration (button or Cmd/Ctrl+K) navigates to setting labels, services, integrations and data tasks. It uses public metadata, preserves ordinary drafts, focuses the owning field and never dispatches an operation. Missing metadata retains page results and offers Retry.

Before / after — the mobile drawer now contains nine workspaces.

Local topics use a selector on small screens; choosing a topic keeps keyboard focus and ordinary drafts.

Privacy setup uses its numbered step titles once, with native in-page anchors that keep repeated selection on the same fragment and preserve the mounted form. Readiness actions name their actual Diagnostics destination in English and German. These comparisons use the production final stack and the same synthetic readiness checks.

Before / after: setup step labels.

Before / after: readiness actions point clearly to Diagnostics.

Legacy Services, Compose, Backups, Data, Transit, Coverage and Cache URLs redirect to their canonical owners while retaining supported public query state. Reauthentication and exact-job returns accept the new routes and validated tabs. Updates and Diagnostics share pending maintenance state, so switching topics cannot bypass active work. A global draft count can discard orphaned ordinary drafts after confirmation.

Explicitly hosted admins no longer see the unsupported Platform form in Settings or host-operation navigation. Unknown deployment status retains troubleshooting topics. Privacy administrators remain limited to casework and cannot open search or fetch its metadata.

reauthentication captures only the validated return tab; maintenance retains its expected digest and blocked update state across Activity visits. Hosted Data exposes only Transit and Coverage, and hosted search omits ops-agent operations.

Local verification: 109 focused admin/route/library and fixture files (887 tests), workspace TypeScript checks, lint, the documentation build and the production web build passed. A later complete serial portable run passed 26,816 tests with 785 skipped; its only failure was an owned Biome formatter stuck on stdin, which was terminated after about 40 minutes. The entire affected six-test Entur file then passed separately. That full run remains recorded as failed; no assertion or timeout was relaxed. Each PR’s current-head CI is the final Linux and database gate.

After captures use the production Next app; before views are hydrated baseline captures. All use a synthetic loopback API that never forwards requests. No real host, provider, email, data or credential mutation was exercised. Native-device and production acceptance remain unverified.

CI follow-up: the coordinator-recovery fixture now captures the exact candidate bytes at its native unlink hook, publishes them atomically, and verifies the captured operation key against the job’s candidate. This removes an exists/read deletion race while retaining the real SIGKILL/restart and no-duplicate-admission/save assertions. Production code and test deadlines are unchanged. Opus accepted the correction subject to the explicit key binding and atomic publication, both applied.