From fdf5d10f9d5693e89d85198b54699b82d09c5663 Mon Sep 17 00:00:00 2001
From: Etienne van Delden de la Haije <etienne@vandelden.family>
Date: Sat, 24 Oct 2026 08:56:50 +0200
Subject: [PATCH 01/10] docs: intent and plan for ui-review-bug-fixes

---
 docs/changes/ui-review-bug-fixes/intent.md |  75 ++++++++
 docs/changes/ui-review-bug-fixes/plan.md   | 198 +++++++++++++++++++++
 2 files changed, 273 insertions(+)
 create mode 100644 docs/changes/ui-review-bug-fixes/intent.md
 create mode 100644 docs/changes/ui-review-bug-fixes/plan.md

diff --git a/docs/changes/ui-review-bug-fixes/intent.md b/docs/changes/ui-review-bug-fixes/intent.md
new file mode 100644
index 00000000..9ddf917a
--- /dev/null
+++ b/docs/changes/ui-review-bug-fixes/intent.md
@@ -0,0 +1,75 @@
+# Intent: UI review bug fixes
+
+Author: Etienne van Delden de la Haije. Status: accepted (2026-10-22). Type: bugfix. Delivery: autonomous. Codex review: no.
+
+## Problem
+
+The October 2026 UI review ([artifact](https://claude.ai/artifact/Btg62aW6itkPG4pZJiKFe6), slice 8 "clean-up") found small defects that are still present on main after #386:
+
+- On the user list (`/users`), an administrator cannot change a user between member and administrator: ticking the role box does nothing. The markup asks for a `form` Stimulus controller that exists neither in the app nor in appkit.
+- On your own profile edit page (reached from the menu), "Terug" sends you to the user list, a page the menu does not offer.
+- Labels on the transaction, category and chattel forms show English attribute names (Debitor, Creditor, Category, Note, Booked at, Interest at, Type, Original note, Direction, Parent category, Purchase transaction) for a user whose locale is Dutch or Italian.
+- The page has no `<html lang>`, so browsers and screen readers do not know the page language.
+- The accounts index writes its pager by hand, twice per table, while `shared/_pagination` exists but only knows the `page` parameter.
+
+## Proposed outcome
+
+An administrator changes a role on `/users` with one click. Your own profile edit page has no misleading back link. Form labels speak the user's language. Every page declares its language. The accounts index uses the shared pager.
+
+## Affected users and systems
+
+- Administrators managing roles on `/users`.
+- Every signed-in user on their own profile edit page.
+- Users with locale `nl` or `it` on the transaction, category and chattel forms.
+- Screen readers and browsers (page language).
+- Views: `users/_user`, `users/profiles/edit`, `transactions/_form`, `categories/_form`, `chattels/_form`, `layouts/application` (and `layouts/admin`), `accounts/index`, `shared/_pagination`; locale files `nl.yml` and `it.yml`; a Stimulus controller for the role toggle.
+
+## Constraints
+
+- Binding UI rules: `rails-ui` skill, `references/interaction-design.md`.
+- Every user-facing string comes from i18n; locale files stay normalized (`i18n-tasks normalize`).
+- Each fix is a bug fix: its regression test comes first and fails before the fix. The pager change is a refactor: existing behaviour stays and stays tested.
+- No new gems, npm packages, system tools, destructive migrations or deploy-file changes are expected; any such need is a stop-and-ask.
+- Stay clear of the parallel slices: navigation-hubs (menu, navigation, menu highlighting) and sheets-segmented-control-badges in mvpa.css.
+
+## In scope
+
+- Role toggle on `/users`: changing the box saves the role at once. Keep the existing rules: disabled for your own row and for non-administrators.
+- Remove "Terug" from your own profile edit page. Profile show keeps "Terug" to `/users`, since you reach it from there.
+- Translate in `nl` and `it` every attribute name the transaction, category and chattel forms label, including the admin-only import fields and the chattel purchase transaction field.
+- Set `<html lang>` to the current locale on every layout.
+- Accounts index pager through the shared pagination partial, with the page parameter per table (`own_page`, `external_page`) kept.
+- One pull request, one commit per fix.
+
+## Out of scope
+
+- The red invalid border before typing: the cause is mvpa.css `:invalid`; it goes to a later mvpa.css change.
+- The parent-category field: #386 already replaced the category show form with a `<dl>`.
+- Navigation, the menu and menu highlighting (navigation-hubs slice).
+- Other pages' layout, the admin user edit page, and English labels outside the three forms.
+
+## Acceptance criteria
+
+- An administrator on `/users` ticks the role box of a member; that member is now an administrator, without pressing another button.
+- An administrator on `/users` unticks the role box of another administrator; that user is now a member.
+- On `/users` the role box of your own row stays disabled, and a member sees every role box disabled.
+- On your own profile edit page there is no "Terug" link; Annuleren still leads to your profile.
+- On another user's profile show page, "Terug" still leads to `/users`.
+- A user with locale `nl` opening a transaction's edit page sees Dutch labels for debitor, creditor, category, note, booked at, interest at, type and the original import fields, not the English names.
+- A user with locale `nl` sees Dutch labels for direction and parent category on the category form, and for purchase transaction on the chattel form.
+- A user with locale `it` sees Italian labels for the same fields.
+- A user with locale `nl` gets `<html lang="nl">`; a user with locale `en` gets `<html lang="en">`; a signed-out visitor gets the default locale.
+- The accounts index shows the same previous/next links as today for own and external accounts, each paging its own table, now rendered through the shared pager.
+
+## Decisions
+
+- Include the role toggle, the profile Terug, the Dutch/Italian labels and `<html lang>` — chosen from the review's clean-up list after verifying each on main.
+- Pager refactor in, red border out — the pager is small and in the same area; the border is an mvpa.css fix.
+- One PR, one commit per fix — chosen over one PR per fix.
+- Make the role toggle work, rather than remove it from `/users` — no reason given.
+- Remove Terug on your own profile edit page — the menu and Annuleren are enough.
+- Autonomous delivery, no Codex review — chosen at the delivery question.
+
+## Open questions
+
+None.
diff --git a/docs/changes/ui-review-bug-fixes/plan.md b/docs/changes/ui-review-bug-fixes/plan.md
new file mode 100644
index 00000000..ea8c0505
--- /dev/null
+++ b/docs/changes/ui-review-bug-fixes/plan.md
@@ -0,0 +1,198 @@
+# Plan: UI review bug fixes
+
+From `intent.md` (2026-10-22). Status: accepted.
+
+Base: `origin/main` at 92372d4 (includes #378 eslint/stylelint and #387 category blank parent). The branch `ui-review-bug-fixes` is already rebased onto it. #387 touched only `CategoriesController` params and a data migration, not `categories/_form`, so the scope holds. #378 added eslint (`eslint.config.mjs`, recommended rules, browser globals) over `app/javascript`; the new Stimulus controller must pass it.
+
+## Design
+
+### Domain terms
+
+No new domain terms; `GLOSSARY.md` stays unchanged. No word of the intent is on an `Avoid:` list. UI words used in this plan:
+
+- **Role box**: the role checkbox of one row on `/users`. It carries the `hidden` attribute; its `<label>` is what the user clicks.
+- **Submit on change**: a form that saves as soon as one of its fields changes, with no submit button.
+- **Pager**: the `shared/_pagination` partial. **Page parameter**: the query key one pager writes (`page`, `own_page`, `external_page`).
+- **Page language**: the `lang` attribute of `<html>`, equal to `I18n.locale` while the page renders.
+
+### Diagrams
+
+```mermaid
+sequenceDiagram
+  actor Admin
+  Admin ->> RoleBox: click label (change event)
+  RoleBox ->> SubmitOnChangeController: submit()
+  SubmitOnChangeController ->> UserForm: requestSubmit()
+  UserForm ->> UsersController: PATCH /users/:id {user: {role}}
+  UsersController -->> Admin: redirect users_url (Turbo visit, new role label)
+```
+
+```mermaid
+classDiagram
+  class UserRow["users/_user"] { form data-controller=submit-on-change }
+  class SubmitOnChangeController { +submit() }
+  class Pagination["shared/_pagination"] { locals: page, param = :page }
+  class AccountsIndex["accounts/index"] { 2 tables x 2 pagers }
+  class OtherCallers { 6 templates, 12 render sites, page only }
+  class LoginLayout["layouts/login (host override)"] { html lang }
+  UserRow ..> SubmitOnChangeController : data-action change->submit-on-change#submit
+  AccountsIndex --> Pagination : param own_page / external_page
+  OtherCallers --> Pagination : default param page
+```
+
+Before: `users/_user` names a `form` controller that does not exist, so the change event goes nowhere; `accounts/index` writes its own `nav.pagination` four times; `layouts/application`, `layouts/admin` and appkit's `layouts/login` have no `lang`.
+
+### Signatures
+
+- `app/javascript/controllers/submit_on_change_controller.js` (new): submits the form it is attached to. Eager-loaded as `submit-on-change` by the existing `eagerLoadControllersFrom("controllers", application)`.
+  - `submit() // (): void` — calls `this.element.requestSubmit()`, so Turbo submits the form with its `_method=patch`.
+- `app/views/users/_user.html.erb`: `form_with ... data: { controller: "submit-on-change" }`; the role box gets `data: { action: "change->submit-on-change#submit" }`. `hidden`, `id` and the `disabled` rule stay exactly as they are.
+- `app/views/shared/_pagination.html.erb`: renders previous/next links for one page parameter. Strict locals become `<%# locals: (page:, param: :page) %>`; both `merge(page: ...)` calls become `merge(param => ...)`. The six other templates that render it (twelve render sites: `receipts/index`, `products/index`, `admin/users/index`, `shared/_recent_transactions`, `transactions/_table`, `todos/index`) do not change.
+- `app/views/accounts/index.html.erb`: each of the two hand-written `<nav class="pagination">` blocks becomes `<%= render "shared/pagination", page: table[:page], param: table[:page_param] %>`.
+- `app/views/users/profiles/edit.html.erb`: the `link_to t("common.back"), users_path` line goes; the title-bar block stays and yields nothing, so `shared/_title_bar` renders no `<nav>`.
+- `app/views/layouts/application.html.erb`, `app/views/layouts/admin.html.erb`: `<html lang="<%= I18n.locale %>" ...>`.
+- `app/views/layouts/login.html.erb` (new): host override of appkit's `layouts/login`, copied verbatim from the locked appkit revision (`bundle show appkit`, revision 9b5b30d), plus `lang="<%= I18n.locale %>"` on `<html>`. Host views win the lookup over engine views.
+- `config/locales/{en,nl,it}.yml`, under `activerecord.attributes`:
+  - `transaction`: `booked_at`, `category_id`, `id`, `creditor`, `debitor`, `interest_at`, `note`, `original_balance_after_mutation`, `original_note`, `original_tag`, `type`.
+  - `category`: `direction`, `parent_category`.
+  - `chattel`: `purchase_transaction_id`.
+  - `Debit`, `Credit`, `Transfer` resolve to the `transaction` keys through STI `lookup_ancestors`; the `f.label` calls stay as they are.
+
+Words:
+
+| key | en | nl | it |
+|---|---|---|---|
+| transaction.id | Id | ID | ID |
+| transaction.debitor | Debitor | Debiteur | Debitore |
+| transaction.creditor | Creditor | Crediteur | Creditore |
+| transaction.category_id | Category | Categorie | Categoria |
+| transaction.note | Note | Opmerking | Nota |
+| transaction.booked_at | Booked at | Boekingsdatum | Data registrazione |
+| transaction.interest_at | Interest at | Rentedatum | Data valuta |
+| transaction.type | Type | Type | Tipo |
+| transaction.original_note | Original note | Oorspronkelijke omschrijving | Descrizione originale |
+| transaction.original_balance_after_mutation | Original balance after mutation | Oorspronkelijk saldo na mutatie | Saldo originale dopo il movimento |
+| transaction.original_tag | Original tag | Oorspronkelijk label | Etichetta originale |
+| category.direction | Direction | Richting | Direzione |
+| category.parent_category | Parent category | Hoofdcategorie | Categoria principale |
+| chattel.purchase_transaction_id | Purchase transaction | Aankooptransactie | Transazione d'acquisto |
+
+The nl/it words for debitor, creditor, note, booked_at and interest_at are the ones `transactions.table` already uses. `Hoofdcategorie` matches the existing `must_be_parent` error text. The en values equal today's humanized output, so English pages do not change.
+
+Not checked: journal_administration has no Steepfile, and this change adds no Ruby methods.
+
+### Complexity
+
+- Role box: one PATCH per change through the existing `UsersController#update` (find + update), then one redirect to the index. A disabled box fires no event and sends nothing.
+- Labels, page language and pager add no queries. The pager reuses the page objects the controller already loads.
+
+### Invariants
+
+- A change to an enabled role box saves the opposite role with no other click; enforced by `submit_on_change_controller.js` and its wiring in `users/_user`.
+- Your own role box, and every role box a member sees, stay `disabled`; enforced by the existing `disabled:` expression in `users/_user` (and `ensure_can_administer` on `UsersController#update`).
+- A pager link changes only its own page parameter and keeps every other query parameter; enforced by `request.query_parameters.merge(param => ...)` in `shared/_pagination`.
+- With `param` left out, the pager writes `page`, so the twelve other render sites render the same links as today.
+- `<html lang>` equals `I18n.locale` on the application, admin and login layouts; `ApplicationController#switch_locale` sets the locale (user locale, else `I18n.default_locale`, `en`). Appkit's session, first-run and transfer controllers inherit `::ApplicationController`, so the login layout gets the same locale.
+- en, nl and it hold the same `activerecord.attributes` keys for the three forms; `test/i18n_test.rb` (missing keys, normalized files) enforces it.
+
+### Alternatives
+
+- **A. Generic `form_controller.js`** (smallest): add a `form` controller with `submit()`, so the existing `data-controller="form"` markup starts to work with no view change. Rejected: `form` says nothing about the behaviour, and the markup relies on Stimulus' default `input` event for a checkbox. One line of view change buys an intention-revealing name and an explicit `change` event.
+- **B. Host `submit-on-change` controller** (chosen): as above. One repository, no gem bump, eslint-checked. It can move to appkit later without a markup change beyond the registration.
+- **C. Appkit `submit-on-change` controller, `Appkit::FormsHelper#submit_on_change_form_with`, and `lang` in appkit's login layout**: most reusable, and no layout copy in the host. Rejected for this PR: it needs a separate appkit change and a `bundle update appkit` before the host commits can go green, which the intent's constraints make stop-and-ask, and it adds public appkit API that must then stay stable. Kept as the recommended follow-up for the login layout (see `## Design decisions`).
+
+## Design decisions
+
+- The role box listens to `change`, not Stimulus' default `input` event, so the wiring states the event it relies on.
+- en gets the same keys as nl and it, with today's English text. The intent asks only for nl and it; the en keys make `i18n-tasks missing` (diff against base `en`) flag a future locale that lacks a label, and they change no English output.
+- The signed-out page language needs the login layout, which lives in appkit. This plan overrides it in the host (`app/views/layouts/login.html.erb`), because the intent rules out dependency changes without asking. The copy drifts from appkit until a follow-up moves `lang` into appkit's login layout, bumps appkit and deletes the host copy; that follow-up is a separate change, not part of this PR.
+- Profile edit keeps its title bar; only the Terug link goes. Its controls block becomes empty and `shared/_title_bar` already renders no `<nav>` for an empty block.
+- One commit per fix, five commits, in the order of `## Order of work`.
+- No conflict with `intent.md`'s `## Decisions`.
+
+## Integration points
+
+- Turbo: `requestSubmit()` on a `form_with` form goes through Turbo; the redirect to `users_url` becomes a Turbo visit that re-renders the index with the new role label.
+- Stimulus eager loading via `@hotwired/stimulus-loading` and `pin_all_from "app/javascript/controllers"`; no importmap change.
+- Appkit engine: `layouts/login` lookup (host view wins); `Appkit::SessionsController`, `FirstRunsController`, `Sessions::TransfersController` render it.
+- i18n-tasks (`test/i18n_test.rb`, `bundle exec i18n-tasks normalize`).
+
+## Files that change
+
+- `app/javascript/controllers/submit_on_change_controller.js` — new; submits its form on change.
+- `app/views/users/_user.html.erb` — wire the role box to `submit-on-change`.
+- `app/views/users/profiles/edit.html.erb` — drop the Terug link.
+- `config/locales/en.yml`, `config/locales/nl.yml`, `config/locales/it.yml` — the 14 attribute keys above.
+- `app/views/layouts/application.html.erb`, `app/views/layouts/admin.html.erb` — `lang`.
+- `app/views/layouts/login.html.erb` — new host override with `lang`.
+- `app/views/shared/_pagination.html.erb` — optional `param` local.
+- `app/views/accounts/index.html.erb` — render the shared pager.
+- Tests: `test/system/user_roles_test.rb` (new), `test/integration/users_index_test.rb`, `test/integration/users/profiles_test.rb`, `test/integration/form_labels_test.rb` (new), `test/integration/page_language_test.rb` (new), `test/integration/pagination_navigation_test.rb`.
+
+## Order of work
+
+Setup in the worktree: put the worktree's `bin/` first on `PATH` (`export PATH="$PWD/bin:$PATH"`) and run `npm install` once, or the pre-push hooks boot the main checkout and herb-lint fails.
+
+1. Role toggle (commit `Save a user's role when its role box changes`).
+   1. Write `test/system/user_roles_test.rb`: tick a member's role box, untick another administrator's box. Run `bin/rails test test/system/user_roles_test.rb`, watch both fail (the role stays unchanged).
+   2. Add `submit_on_change_controller.js`, wire `users/_user`. Run the system test green.
+   3. Add the disabled-box tests to `test/integration/users_index_test.rb` (they guard existing behaviour and pass before and after).
+   4. `npx eslint app/javascript`, `npx @herb-tools/linter app/views/`, commit.
+2. Profile Terug (commit `Drop the back link from your own profile edit page`).
+   1. Add the edit-page test to `test/integration/users/profiles_test.rb`, watch it fail; add the show-page Terug test (passes, guards it).
+   2. Remove the link. Run the file green. Commit.
+3. Form labels (commit `Translate the transaction, category and chattel form labels`).
+   1. Write `test/integration/form_labels_test.rb`, run it, watch the nl and it tests fail on the English names.
+   2. Add the keys to en, nl, it; run `bundle exec i18n-tasks normalize`. Run the file and `test/i18n_test.rb` green. Commit.
+4. Page language (commit `Declare the page language on every layout`).
+   1. Write `test/integration/page_language_test.rb`, watch it fail.
+   2. Add `lang` to application and admin; copy appkit's `layouts/login.html.erb` from `$(bundle show appkit)/app/views/layouts/login.html.erb` into `app/views/layouts/` and add `lang`. Run green. Commit.
+5. Pager (commit `Render the accounts pager through the shared partial`).
+   1. Extend `test/integration/pagination_navigation_test.rb` with the external-table and kept-parameter tests; they pass before the refactor (refactor, not bug fix).
+   2. Add `param:` to `shared/_pagination`, replace the four blocks in `accounts/index`. Run `pagination_navigation_test.rb`, `accounts_index_test.rb` and every caller's tests green. Commit.
+6. Full suite: `bin/rails test`, `bin/rails test:system`, `bundle exec rubocop`, `npx @herb-tools/linter app/views/`, `npx eslint app/javascript`, `bundle exec brakeman --no-pager -q`, `bundle exec bundler-audit check`, `bundle exec i18n-tasks normalize` (no diff). Re-read the full diff against `origin/main`.
+
+## Risks
+
+- The role box is `hidden`; a system test must click its `<label>`, not the input. A clicked label of a hidden checkbox still toggles it and fires `change` in Chrome and Edge.
+- The test must wait for the redirect (assert the new role label text) before it reads the database, or it races the PATCH.
+- The new attribute keys also translate the show pages that call `human_attribute_name` for the same attributes (transaction show original fields, category show direction and parent, chattel show purchase transaction). That is wanted; no test asserts the English text there today.
+- The host `layouts/login.html.erb` hides later appkit changes to its login layout. Mitigated by the appkit follow-up named in `## Design decisions`.
+- Rejected: `form_controller.js` (vague name), appkit upstream in this PR (second repository and gem bump), `lang` on `layouts/mailer` (no mailer class inherits `ApplicationMailer`, so it renders nowhere) and on static `public/*.html` pages (not in the intent's view list).
+
+Out of scope: the red invalid border (mvpa.css), the parent-category field on the category show page, navigation and menu highlighting, the admin user edit page, English labels outside the three forms, the untranslated option values of the direction and type selects.
+
+## Proof
+
+- An administrator on `/users` ticks the role box of a member; that member is now an administrator, without pressing another button → `test/system/user_roles_test.rb` `test "an administrator makes a member an administrator by ticking the role box"`
+- An administrator on `/users` unticks the role box of another administrator; that user is now a member → `test/system/user_roles_test.rb` `test "an administrator makes another administrator a member by unticking the role box"`
+- On `/users` the role box of your own row stays disabled, and a member sees every role box disabled → `test/integration/users_index_test.rb` `test "your own role box is disabled"`, `test "a member sees every role box disabled"`
+- On your own profile edit page there is no "Terug" link; Annuleren still leads to your profile → `test/integration/users/profiles_test.rb` `test "your own profile edit page has no back link"`, existing `test "the edit form ends in an action row of Annuleren and Opslaan"`
+- On another user's profile show page, "Terug" still leads to `/users` → `test/integration/users/profiles_test.rb` `test "another user's profile page links back to the users list"`
+- A user with locale `nl` opening a transaction's edit page sees Dutch labels for debitor, creditor, category, note, booked at, interest at, type and the original import fields (and id) → `test/integration/form_labels_test.rb` `test "the transaction form labels its fields in Dutch"`
+- A user with locale `nl` sees Dutch labels for direction and parent category on the category form, and for purchase transaction on the chattel form → `test/integration/form_labels_test.rb` `test "the category form labels direction and parent category in Dutch"`, `test "the chattel form labels the purchase transaction in Dutch"`
+- A user with locale `it` sees Italian labels for the same fields → `test/integration/form_labels_test.rb` `test "the transaction form labels its fields in Italian"`, `test "the category form labels direction and parent category in Italian"`, `test "the chattel form labels the purchase transaction in Italian"`
+- A user with locale `nl` gets `<html lang="nl">`; a user with locale `en` gets `<html lang="en">`; a signed-out visitor gets the default locale → `test/integration/page_language_test.rb` `test "a Dutch user gets lang nl"`, `test "an English user gets lang en"`, `test "the admin layout declares the user's language"`, `test "a signed-out visitor gets the default locale"`
+- The accounts index shows the same previous/next links as today for own and external accounts, each paging its own table, now rendered through the shared pager → existing `test/integration/pagination_navigation_test.rb` `test "accounts pagination shows correct links on first and last page"`, new `test "external accounts pagination writes external_page"`, `test "accounts pagination keeps the other query parameters"`; existing `test/integration/accounts_index_test.rb` `test "own and external pagination params are independent"`
+- Invariant: with `param` left out the pager writes `page`, enforced by the partial's default local → existing `test/integration/pagination_navigation_test.rb` `test "transactions pagination keeps filter params and does not show next on overflow pages"`, `test "todo pagination is clamped and hides next on the last page"`
+- Invariant: en, nl and it hold the same label keys, enforced by i18n-tasks → `test/i18n_test.rb` `test_no_missing_keys`, `test_files_are_normalized`
+
+Per changed file, the unit tests expected:
+
+- `app/javascript/controllers/submit_on_change_controller.js`: no JS unit test runner exists; covered by the role toggle system tests, and `npx eslint app/javascript` passes.
+- `app/views/shared/_pagination.html.erb`: covered by the integration tests above (the `param` local and its `page` default).
+- Views and locale files: covered by the integration tests above.
+
+Test setup: fixtures only. `users(:admin)` is an nl administrator, `users(:member)` an en member. The untick test first runs `users(:member).update!(role: :administrator)`. The Italian tests first run `users(:admin).update!(locale: :it)` before `sign_in_as`. Forms: `transactions(:debit_grocery)`, `categories(:groceries)`, `chattels(:one)`; the admin sees the admin-only original fields. Label assertions use the literal words from the table above, scoped to `form label`. Pager tests create accounts as `create_accounts` does today; the external variant creates external accounts (no household owner). Page language tests: signed-in GET `dashboard_index_path` and `admin_root_path`; signed-out GET `new_session_path`, asserting `html[lang=?]`, `I18n.default_locale.to_s`.
+
+---
+Domain skills applied: rails-ui (interaction-design: immediate feedback, Back/Cancel links), rails-testing, hwc-stimulus-fundamentals, software-design, glossary, diagrams.
+
+## Critique
+
+### Round 1 (codex exec -p terra)
+
+- The appkit login-layout choice is left as an open decision although the accepted intent has no open questions; choose the host override and record appkit as a follow-up → fixed (`## Design decisions` now decides the host override and names the appkit change as a separate follow-up, not part of this PR)
+- "Every layout" omits `layouts/mailer.html.erb`; add `lang` and a mailer assertion → dismissed: no mailer class inherits `ApplicationMailer` (`app/mailers` holds only `application_mailer.rb`), so the layout renders nowhere and cannot be asserted; the intent's view list names only the application and admin layouts
+- The plan excludes the transaction form's `id` label although the intent says every labelled attribute is translated → fixed (added `activerecord.attributes.transaction.id` in en, nl and it, removed it from out of scope, and the Dutch transaction label test covers it)
+- The plan says seven existing pager callers stay unchanged; there are six templates with twelve render sites → fixed (Signatures, diagram and Invariants now name the six templates and twelve render sites)

From 877205477c834146b7ac8d9d4e8642468da8bc0c Mon Sep 17 00:00:00 2001
From: Etienne van Delden de la Haije <etienne@vandelden.family>
Date: Sat, 24 Oct 2026 09:03:04 +0200
Subject: [PATCH 02/10] Save a user's role when its role box changes

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .../submit_on_change_controller.js            |  7 ++++
 app/views/users/_user.html.erb                |  4 +--
 test/integration/users_index_test.rb          | 16 +++++++++
 test/system/user_roles_test.rb                | 36 +++++++++++++++++++
 4 files changed, 61 insertions(+), 2 deletions(-)
 create mode 100644 app/javascript/controllers/submit_on_change_controller.js
 create mode 100644 test/system/user_roles_test.rb

diff --git a/app/javascript/controllers/submit_on_change_controller.js b/app/javascript/controllers/submit_on_change_controller.js
new file mode 100644
index 00000000..b08e471c
--- /dev/null
+++ b/app/javascript/controllers/submit_on_change_controller.js
@@ -0,0 +1,7 @@
+import { Controller } from "@hotwired/stimulus"
+
+export default class extends Controller {
+  submit() {
+    this.element.requestSubmit()
+  }
+}
diff --git a/app/views/users/_user.html.erb b/app/views/users/_user.html.erb
index 88d07021..0af13d67 100644
--- a/app/views/users/_user.html.erb
+++ b/app/views/users/_user.html.erb
@@ -2,10 +2,10 @@
 <div>
   <%= link_to user.name, user.current? ? edit_user_profile_path(user) : user_profile_path(user) %>
 
-  <%= form_with model: user, url: user_path(user), data: { controller: "form" }, method: :patch do |form| %>
+  <%= form_with model: user, url: user_path(user), data: { controller: "submit-on-change" }, method: :patch do |form| %>
     <label for="<%= dom_id(user, :role) %>">
       <%= t('.role_label', name: user.name, role: user.administrator? ? t('.role_administrator') : t('.role_member')) %>
-      <%= form.check_box :role, { data: { action: "form#submit" }, hidden: true, id: dom_id(user, :role),
+      <%= form.check_box :role, { data: { action: "change->submit-on-change#submit" }, hidden: true, id: dom_id(user, :role),
             disabled: ("disabled" if user.current? || !Current.user.can_administer?) },
             "administrator", "member" %>
     </label>
diff --git a/test/integration/users_index_test.rb b/test/integration/users_index_test.rb
index 71e523b2..80496728 100644
--- a/test/integration/users_index_test.rb
+++ b/test/integration/users_index_test.rb
@@ -19,4 +19,20 @@ class UsersIndexTest < ActionDispatch::IntegrationTest
     assert_select "button.button-danger", count: 0
     assert_select "main > header > h1", count: 1
   end
+
+  test "your own role box is disabled" do
+    sign_in_as(users(:admin))
+
+    get users_path
+
+    assert_select "input##{dom_id(users(:admin), :role)}[disabled]"
+    assert_select "input##{dom_id(users(:member), :role)}:not([disabled])"
+  end
+
+  test "a member sees every role box disabled" do
+    get users_path
+
+    assert_select "input[type=checkbox][id^=role_user_]", minimum: 2
+    assert_select "input[type=checkbox][id^=role_user_]:not([disabled])", count: 0
+  end
 end
diff --git a/test/system/user_roles_test.rb b/test/system/user_roles_test.rb
new file mode 100644
index 00000000..5d45ff74
--- /dev/null
+++ b/test/system/user_roles_test.rb
@@ -0,0 +1,36 @@
+require "application_system_test_case"
+
+class UserRolesTest < ApplicationSystemTestCase
+  setup do
+    @admin = users(:admin)
+    @member = users(:member)
+    sign_in_as(@admin)
+  end
+
+  test "an administrator makes a member an administrator by ticking the role box" do
+    visit users_url
+
+    find("label[for='#{dom_id(@member, :role)}']").click
+
+    assert_selector "label[for='#{dom_id(@member, :role)}']",
+      text: I18n.t("users.user.role_administrator", locale: locale)
+    assert_predicate @member.reload, :administrator?
+  end
+
+  test "an administrator makes another administrator a member by unticking the role box" do
+    @member.update!(role: :administrator)
+    visit users_url
+
+    find("label[for='#{dom_id(@member, :role)}']").click
+
+    assert_selector "label[for='#{dom_id(@member, :role)}']",
+      text: I18n.t("users.user.role_member", locale: locale)
+    assert_predicate @member.reload, :member?
+  end
+
+  private
+
+  def dom_id(record, prefix)
+    ActionView::RecordIdentifier.dom_id(record, prefix)
+  end
+end

From 9d0235c6bd10f932a2b9ce08687a16c993272bd0 Mon Sep 17 00:00:00 2001
From: Etienne van Delden de la Haije <etienne@vandelden.family>
Date: Sat, 24 Oct 2026 09:03:27 +0200
Subject: [PATCH 03/10] Drop the back link from your own profile edit page

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 app/views/users/profiles/edit.html.erb  |  1 -
 test/integration/users/profiles_test.rb | 16 ++++++++++++++++
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/app/views/users/profiles/edit.html.erb b/app/views/users/profiles/edit.html.erb
index 90c520e1..1cc7db5c 100644
--- a/app/views/users/profiles/edit.html.erb
+++ b/app/views/users/profiles/edit.html.erb
@@ -1,6 +1,5 @@
 <% content_for(:title) { t(".title") } %>
 <%= render layout: "shared/title_bar", locals: { title: t('.title') } do %>
-  <%= link_to t("common.back"), users_path %>
 <% end %>
 
 <article>
diff --git a/test/integration/users/profiles_test.rb b/test/integration/users/profiles_test.rb
index a21597b4..f116e845 100644
--- a/test/integration/users/profiles_test.rb
+++ b/test/integration/users/profiles_test.rb
@@ -65,4 +65,20 @@ class Users::ProfilesTest < ActionDispatch::IntegrationTest
     assert_select "form > footer a[role=button][href=?]", user_profile_path(@member)
     assert_select "form > footer button.button-danger", count: 0
   end
+
+  test "your own profile edit page has no back link" do
+    sign_in_as(@member)
+
+    get edit_user_profile_path(@member)
+
+    assert_select "a[href=?]", users_path, count: 0
+  end
+
+  test "another user's profile page links back to the users list" do
+    sign_in_as(@member)
+
+    get user_profile_path(@other)
+
+    assert_select "a[href=?]", users_path, text: I18n.t("common.back", locale: @member.locale)
+  end
 end

From 3de9caa25929534d8aa06cbe53c32286e1dc6baf Mon Sep 17 00:00:00 2001
From: Etienne van Delden de la Haije <etienne@vandelden.family>
Date: Sat, 24 Oct 2026 09:04:12 +0200
Subject: [PATCH 04/10] Translate the transaction, category and chattel form
 labels

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 config/locales/en.yml                | 14 +++++++
 config/locales/it.yml                | 14 +++++++
 config/locales/nl.yml                | 14 +++++++
 test/integration/form_labels_test.rb | 58 ++++++++++++++++++++++++++++
 4 files changed, 100 insertions(+)
 create mode 100644 test/integration/form_labels_test.rb

diff --git a/config/locales/en.yml b/config/locales/en.yml
index 1235c87e..8a9e9cae 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -110,8 +110,10 @@ en:
         amount: Amount
         category: Category
       category:
+        direction: Direction
         kind: Kind
         name: Name
+        parent_category: Parent category
       chattel:
         brand: Brand
         kind: Kind
@@ -121,6 +123,7 @@ en:
         notes: Notes
         purchase_price: Purchase price
         purchase_transaction: Transaction
+        purchase_transaction_id: Purchase transaction
         purchased_at: Purchase Date
         serial_number: Serial Number
         warranty_document: Warranty document
@@ -140,10 +143,21 @@ en:
         account: Account
         amount: Amount
         appropriation: Appropriation
+        booked_at: Booked at
         category: Category
+        category_id: Category
+        creditor: Creditor
         date: Date
+        debitor: Debitor
         description: Description
+        id: Id
+        interest_at: Interest at
+        note: Note
+        original_balance_after_mutation: Original balance after mutation
+        original_note: Original note
+        original_tag: Original tag
         proof_of_purchase: Proof of purchase
+        type: Type
       transaction_split:
         appropriation: Appropriation
     errors:
diff --git a/config/locales/it.yml b/config/locales/it.yml
index cda24834..a0469fa6 100644
--- a/config/locales/it.yml
+++ b/config/locales/it.yml
@@ -110,8 +110,10 @@ it:
         amount: Importo
         category: Categoria
       category:
+        direction: Direzione
         kind: Tipo
         name: Nome
+        parent_category: Categoria principale
       chattel:
         brand: Marca
         kind: Tipo
@@ -121,6 +123,7 @@ it:
         notes: Note
         purchase_price: Prezzo d'acquisto
         purchase_transaction: Transazione
+        purchase_transaction_id: Transazione d'acquisto
         purchased_at: Data d'acquisto
         serial_number: Numero seriale
         warranty_document: Documento di garanzia
@@ -140,10 +143,21 @@ it:
         account: Conto
         amount: Importo
         appropriation: Stanziamento
+        booked_at: Data registrazione
         category: Categoria
+        category_id: Categoria
+        creditor: Creditore
         date: Data
+        debitor: Debitore
         description: Descrizione
+        id: ID
+        interest_at: Data valuta
+        note: Nota
+        original_balance_after_mutation: Saldo originale dopo il movimento
+        original_note: Descrizione originale
+        original_tag: Etichetta originale
         proof_of_purchase: Prova d'acquisto
+        type: Tipo
       transaction_split:
         appropriation: Stanziamento
     errors:
diff --git a/config/locales/nl.yml b/config/locales/nl.yml
index 1f619068..56efe3e9 100644
--- a/config/locales/nl.yml
+++ b/config/locales/nl.yml
@@ -110,8 +110,10 @@ nl:
         amount: Bedrag
         category: Categorie
       category:
+        direction: Richting
         kind: Type
         name: Naam
+        parent_category: Hoofdcategorie
       chattel:
         brand: Merk
         kind: Type
@@ -121,6 +123,7 @@ nl:
         notes: Notities
         purchase_price: Aankoopprijs
         purchase_transaction: Transactie
+        purchase_transaction_id: Aankooptransactie
         purchased_at: Aankoopdatum
         serial_number: Serienummer
         warranty_document: Garantiedocument
@@ -140,10 +143,21 @@ nl:
         account: Rekening
         amount: Bedrag
         appropriation: Begrotingspost
+        booked_at: Boekingsdatum
         category: Categorie
+        category_id: Categorie
+        creditor: Crediteur
         date: Datum
+        debitor: Debiteur
         description: Omschrijving
+        id: ID
+        interest_at: Rentedatum
+        note: Opmerking
+        original_balance_after_mutation: Oorspronkelijk saldo na mutatie
+        original_note: Oorspronkelijke omschrijving
+        original_tag: Oorspronkelijk label
         proof_of_purchase: Aankoopbewijs
+        type: Type
       transaction_split:
         appropriation: Begrotingspost
     errors:
diff --git a/test/integration/form_labels_test.rb b/test/integration/form_labels_test.rb
new file mode 100644
index 00000000..66fda278
--- /dev/null
+++ b/test/integration/form_labels_test.rb
@@ -0,0 +1,58 @@
+require "test_helper"
+
+class FormLabelsTest < ActionDispatch::IntegrationTest
+  LABELS = {
+    nl: {
+      transaction: [ "ID", "Debiteur", "Crediteur", "Categorie", "Opmerking", "Boekingsdatum", "Rentedatum", "Type",
+                     "Oorspronkelijke omschrijving", "Oorspronkelijk saldo na mutatie", "Oorspronkelijk label" ],
+      category: [ "Richting", "Hoofdcategorie" ],
+      chattel: [ "Aankooptransactie" ]
+    },
+    it: {
+      transaction: [ "ID", "Debitore", "Creditore", "Categoria", "Nota", "Data registrazione", "Data valuta", "Tipo",
+                     "Descrizione originale", "Saldo originale dopo il movimento", "Etichetta originale" ],
+      category: [ "Direzione", "Categoria principale" ],
+      chattel: [ "Transazione d'acquisto" ]
+    }
+  }.freeze
+
+  PAGES = {
+    transaction: -> { edit_transaction_path(transactions(:debit_grocery)) },
+    category: -> { edit_category_path(categories(:groceries)) },
+    chattel: -> { edit_chattel_path(chattels(:one)) }
+  }.freeze
+
+  setup do
+    @user = users(:admin)
+  end
+
+  LABELS.each_key do |locale|
+    names = { nl: "Dutch", it: "Italian" }.fetch(locale)
+
+    test "the transaction form labels its fields in #{names}" do
+      assert_labels locale, :transaction
+    end
+
+    test "the category form labels direction and parent category in #{names}" do
+      assert_labels locale, :category
+    end
+
+    test "the chattel form labels the purchase transaction in #{names}" do
+      assert_labels locale, :chattel
+    end
+  end
+
+  private
+
+  def assert_labels(locale, form)
+    @user.update!(locale: locale)
+    sign_in_as(@user)
+
+    get instance_exec(&PAGES.fetch(form))
+
+    assert_response :success
+    LABELS.dig(locale, form).each do |text|
+      assert_select "form label", text: text
+    end
+  end
+end

From 3b97a23a943cc9508dac68a77b5bdceaf34b3a15 Mon Sep 17 00:00:00 2001
From: Etienne van Delden de la Haije <etienne@vandelden.family>
Date: Sat, 24 Oct 2026 09:04:54 +0200
Subject: [PATCH 05/10] Declare the page language on every layout

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 app/views/layouts/admin.html.erb       |  1 +
 app/views/layouts/application.html.erb |  1 +
 app/views/layouts/login.html.erb       | 27 +++++++++++++++++++++
 test/integration/page_language_test.rb | 33 ++++++++++++++++++++++++++
 4 files changed, 62 insertions(+)
 create mode 100644 app/views/layouts/login.html.erb
 create mode 100644 test/integration/page_language_test.rb

diff --git a/app/views/layouts/admin.html.erb b/app/views/layouts/admin.html.erb
index 95ab9c9d..2d9db756 100644
--- a/app/views/layouts/admin.html.erb
+++ b/app/views/layouts/admin.html.erb
@@ -1,5 +1,6 @@
 <!DOCTYPE html>
 <html
+  lang="<%= I18n.locale %>"
   data-controller="theme"
   data-color-scheme="<%= theme_attributes[:"data-color-scheme"] %>"
   data-light-theme="<%= theme_attributes[:"data-light-theme"] %>"
diff --git a/app/views/layouts/application.html.erb b/app/views/layouts/application.html.erb
index e8064e75..cf8c3991 100644
--- a/app/views/layouts/application.html.erb
+++ b/app/views/layouts/application.html.erb
@@ -1,5 +1,6 @@
 <!DOCTYPE html>
 <html
+  lang="<%= I18n.locale %>"
   data-controller="theme"
   data-color-scheme="<%= theme_attributes[:"data-color-scheme"] %>"
   data-light-theme="<%= theme_attributes[:"data-light-theme"] %>"
diff --git a/app/views/layouts/login.html.erb b/app/views/layouts/login.html.erb
new file mode 100644
index 00000000..4c82ff34
--- /dev/null
+++ b/app/views/layouts/login.html.erb
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html
+  lang="<%= I18n.locale %>"
+  data-controller="theme"
+  data-color-scheme="<%= theme_attributes[:"data-color-scheme"] %>"
+  data-light-theme="<%= theme_attributes[:"data-light-theme"] %>"
+  data-dark-theme="<%= theme_attributes[:"data-dark-theme"] %>"
+  data-theme="<%= theme_attributes[:"data-theme"] %>">
+  <head>
+    <title><%= Appkit.config.app_display_name %></title>
+    <meta name="viewport" content="width=device-width,initial-scale=1">
+    <meta name="color-scheme" content="light dark">
+    <meta name="view-transition" content="same-origin">
+    <%= csrf_meta_tags %>
+    <%= csp_meta_tag %>
+    <%= render "appkit/shared/pwa_meta" %>
+
+    <%= stylesheet_link_tag "application", media: "all", "data-turbo-track": "reload" %>
+    <%= javascript_importmap_tags %>
+  </head>
+  <body data-appkit-login>
+    <main>
+      <%= render "appkit/shared/flashes" %>
+      <%= yield %>
+    </main>
+  </body>
+</html>
diff --git a/test/integration/page_language_test.rb b/test/integration/page_language_test.rb
new file mode 100644
index 00000000..7429f9fa
--- /dev/null
+++ b/test/integration/page_language_test.rb
@@ -0,0 +1,33 @@
+require "test_helper"
+
+class PageLanguageTest < ActionDispatch::IntegrationTest
+  test "a Dutch user gets lang nl" do
+    sign_in_as(users(:admin))
+
+    get dashboard_index_path
+
+    assert_select "html[lang=?]", "nl"
+  end
+
+  test "an English user gets lang en" do
+    sign_in_as(users(:member))
+
+    get dashboard_index_path
+
+    assert_select "html[lang=?]", "en"
+  end
+
+  test "the admin layout declares the user's language" do
+    sign_in_as(users(:admin))
+
+    get admin_root_path
+
+    assert_select "html[lang=?]", "nl"
+  end
+
+  test "a signed-out visitor gets the default locale" do
+    get new_session_path
+
+    assert_select "html[lang=?]", I18n.default_locale.to_s
+  end
+end

From dd6a3fcc996be6dfc57c2097624e90ddcb4021b3 Mon Sep 17 00:00:00 2001
From: Etienne van Delden de la Haije <etienne@vandelden.family>
Date: Sat, 24 Oct 2026 09:05:30 +0200
Subject: [PATCH 06/10] Render the accounts pager through the shared partial

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 app/views/accounts/index.html.erb             | 22 ++-----------
 app/views/shared/_pagination.html.erb         |  6 ++--
 .../integration/pagination_navigation_test.rb | 32 +++++++++++++++++++
 3 files changed, 37 insertions(+), 23 deletions(-)

diff --git a/app/views/accounts/index.html.erb b/app/views/accounts/index.html.erb
index fd5a00a8..6edd18c3 100644
--- a/app/views/accounts/index.html.erb
+++ b/app/views/accounts/index.html.erb
@@ -20,16 +20,7 @@
   <article id="<%= kind %>-accounts">
     <h2 id="<%= kind %>-accounts-heading"><%= table[:heading] %></h2>
 
-    <% if table[:page].number > 1 || table[:page].before_last? %>
-      <nav class="pagination">
-        <% if table[:page].number > 1 %>
-          <%= link_to t("pagination.previous"), url_for(request.query_parameters.merge(table[:page_param] => table[:page].number - 1)), rel: "prev" %>
-        <% end %>
-        <% if table[:page].before_last? %>
-          <%= link_to t("pagination.next"), url_for(request.query_parameters.merge(table[:page_param] => table[:page].next_param)), rel: "next" %>
-        <% end %>
-      </nav>
-    <% end %>
+    <%= render "shared/pagination", page: table[:page], param: table[:page_param] %>
 
     <table class="accounts" id="<%= kind %>-accounts-table" data-stack="medium" role="table"
            aria-labelledby="<%= kind %>-accounts-heading">
@@ -55,15 +46,6 @@
       </tbody>
     </table>
 
-    <% if table[:page].number > 1 || table[:page].before_last? %>
-      <nav class="pagination">
-        <% if table[:page].number > 1 %>
-          <%= link_to t("pagination.previous"), url_for(request.query_parameters.merge(table[:page_param] => table[:page].number - 1)), rel: "prev" %>
-        <% end %>
-        <% if table[:page].before_last? %>
-          <%= link_to t("pagination.next"), url_for(request.query_parameters.merge(table[:page_param] => table[:page].next_param)), rel: "next" %>
-        <% end %>
-      </nav>
-    <% end %>
+    <%= render "shared/pagination", page: table[:page], param: table[:page_param] %>
   </article>
 <% end %>
diff --git a/app/views/shared/_pagination.html.erb b/app/views/shared/_pagination.html.erb
index 4d193bd1..97906ddc 100644
--- a/app/views/shared/_pagination.html.erb
+++ b/app/views/shared/_pagination.html.erb
@@ -1,14 +1,14 @@
-<%# locals: (page:) %>
+<%# locals: (page:, param: :page) %>
 <% show_previous = page.number > 1 %>
 <% show_next = page.before_last? %>
 
 <% if show_previous || show_next %>
   <nav class="pagination">
     <% if show_previous %>
-      <%= link_to t("pagination.previous"), url_for(request.query_parameters.merge(page: page.number - 1)), rel: "prev" %>
+      <%= link_to t("pagination.previous"), url_for(request.query_parameters.merge(param => page.number - 1)), rel: "prev" %>
     <% end %>
     <% if show_next %>
-      <%= link_to t("pagination.next"), url_for(request.query_parameters.merge(page: page.next_param)), rel: "next" %>
+      <%= link_to t("pagination.next"), url_for(request.query_parameters.merge(param => page.next_param)), rel: "next" %>
     <% end %>
   </nav>
 <% end %>
diff --git a/test/integration/pagination_navigation_test.rb b/test/integration/pagination_navigation_test.rb
index c4532932..4f7e58cc 100644
--- a/test/integration/pagination_navigation_test.rb
+++ b/test/integration/pagination_navigation_test.rb
@@ -21,6 +21,29 @@ class PaginationNavigationTest < ActionDispatch::IntegrationTest
     assert_select "nav.pagination a[rel='next']", 0
   end
 
+  test "external accounts pagination writes external_page" do
+    create_external_accounts(51)
+
+    get accounts_path
+
+    assert_response :success
+    assert_select "nav.pagination a[rel='next'][href*='external_page=2']", 2
+    assert_select "nav.pagination a[rel='next'][href*='own_page']", 0
+
+    get accounts_path, params: { external_page: 2 }
+
+    assert_select "nav.pagination a[rel='prev'][href*='external_page=1']", 2
+    assert_select "nav.pagination a[rel='next']", 0
+  end
+
+  test "accounts pagination keeps the other query parameters" do
+    create_accounts(51)
+
+    get accounts_path, params: { external_page: 1, q: "kept" }
+
+    assert_select "nav.pagination a[rel='next'][href*='own_page=2'][href*='external_page=1'][href*='q=kept']", 2
+  end
+
   test "transactions pagination keeps filter params and does not show next on overflow pages" do
     create_uncategorized_transactions(21)
 
@@ -64,6 +87,15 @@ def create_accounts(count)
       end
     end
 
+    def create_external_accounts(count)
+      count.times do |index|
+        Account.create!(
+          account_numbers: [ AccountNumber.new(number: format("NL98SHOP%010d", index)) ],
+          name: "External Pagination Account #{index}"
+        )
+      end
+    end
+
     def create_uncategorized_transactions(count)
       debitor = accounts(:checking)
       creditor = accounts(:unknown)

From 200850c358719f6eafffec428f0cbc14e49352ec Mon Sep 17 00:00:00 2001
From: Etienne van Delden de la Haije <etienne@vandelden.family>
Date: Sat, 24 Oct 2026 09:17:33 +0200
Subject: [PATCH 07/10] Leave out empty theme attributes on the signed-out
 login page

The host copy of appkit's login layout wrote four data-* theme
attributes even when theme_attributes is empty, so a signed-out page
carried data-theme="" and mvpa.css's :root:not([data-theme]) dark-mode
rules stopped matching. tag.html writes only the attributes that exist.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 app/views/layouts/login.html.erb      | 10 ++--------
 test/integration/login_layout_test.rb | 11 +++++++++++
 2 files changed, 13 insertions(+), 8 deletions(-)
 create mode 100644 test/integration/login_layout_test.rb

diff --git a/app/views/layouts/login.html.erb b/app/views/layouts/login.html.erb
index 4c82ff34..6af44b79 100644
--- a/app/views/layouts/login.html.erb
+++ b/app/views/layouts/login.html.erb
@@ -1,11 +1,5 @@
 <!DOCTYPE html>
-<html
-  lang="<%= I18n.locale %>"
-  data-controller="theme"
-  data-color-scheme="<%= theme_attributes[:"data-color-scheme"] %>"
-  data-light-theme="<%= theme_attributes[:"data-light-theme"] %>"
-  data-dark-theme="<%= theme_attributes[:"data-dark-theme"] %>"
-  data-theme="<%= theme_attributes[:"data-theme"] %>">
+<%= tag.html(lang: I18n.locale, **theme_attributes, "data-controller": "theme") do %>
   <head>
     <title><%= Appkit.config.app_display_name %></title>
     <meta name="viewport" content="width=device-width,initial-scale=1">
@@ -24,4 +18,4 @@
       <%= yield %>
     </main>
   </body>
-</html>
+<% end %>
diff --git a/test/integration/login_layout_test.rb b/test/integration/login_layout_test.rb
new file mode 100644
index 00000000..56525dbe
--- /dev/null
+++ b/test/integration/login_layout_test.rb
@@ -0,0 +1,11 @@
+require "test_helper"
+
+class LoginLayoutTest < ActionDispatch::IntegrationTest
+  test "a signed-out visitor's page leaves the theme to the browser" do
+    get new_session_path
+
+    assert_select "html[data-controller=?]", "theme"
+    assert_select "html[data-theme]", count: 0
+    assert_select "html[data-color-scheme]", count: 0
+  end
+end

From 5a0299ae094d781b028434a1fee4662a225a3705 Mon Sep 17 00:00:00 2001
From: Etienne van Delden de la Haije <etienne@vandelden.family>
Date: Sat, 24 Oct 2026 09:17:50 +0200
Subject: [PATCH 08/10] Render the profile edit title bar without an empty
 block

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 app/views/users/profiles/edit.html.erb | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/app/views/users/profiles/edit.html.erb b/app/views/users/profiles/edit.html.erb
index 1cc7db5c..5ba4d482 100644
--- a/app/views/users/profiles/edit.html.erb
+++ b/app/views/users/profiles/edit.html.erb
@@ -1,6 +1,5 @@
 <% content_for(:title) { t(".title") } %>
-<%= render layout: "shared/title_bar", locals: { title: t('.title') } do %>
-<% end %>
+<%= render "shared/title_bar", title: t(".title") %>
 
 <article>
   <%= form_with model: @user, url: user_profile_path(@user) do |form| %>

From fb0612a21d1c1e34c32f56c94f6074d3759526da Mon Sep 17 00:00:00 2001
From: Etienne van Delden de la Haije <etienne@vandelden.family>
Date: Sat, 24 Oct 2026 09:21:44 +0200
Subject: [PATCH 09/10] Review for ui-review-bug-fixes

---
 docs/changes/ui-review-bug-fixes/review.md | 65 ++++++++++++++++++++++
 1 file changed, 65 insertions(+)
 create mode 100644 docs/changes/ui-review-bug-fixes/review.md

diff --git a/docs/changes/ui-review-bug-fixes/review.md b/docs/changes/ui-review-bug-fixes/review.md
new file mode 100644
index 00000000..b80625e6
--- /dev/null
+++ b/docs/changes/ui-review-bug-fixes/review.md
@@ -0,0 +1,65 @@
+## Round 1 — 2026-10-24 07:16 UTC — dd6a3fc
+
+Reviewed `git diff origin/main...HEAD` after fetching origin, plus the working tree (clean at review start). No root `REVIEW.md` or `REVIEW.local.md` exists; used the default Bugs, Security, Compliance and Design passes.
+
+- [ ] Nit: The host login layout is not the verbatim appkit copy the plan names. Appkit writes `<html <%= tag.attributes(theme_attributes) %> data-controller="theme">`; the copy writes four explicit `data-*` attributes. A signed-out visitor has an empty `theme_attributes`, so the page now carries `data-color-scheme=""`, `data-light-theme=""`, `data-dark-theme=""` and `data-theme=""` where appkit wrote none. The empty `data-theme` stops mvpa.css's `@media (prefers-color-scheme: dark) :root:not([data-theme])` button and header-link rules from matching until the theme controller connects, so a dark-OS visitor gets light buttons on first paint (and for good with JavaScript off). Keep appkit's `tag.attributes(theme_attributes)` and add only `lang`. — `app/views/layouts/login.html.erb:2` → fixed (Leave out empty theme attributes on the signed-out login page)
+- [ ] Nit: Removing the Terug link leaves an empty `render layout: "shared/title_bar" ... do %><% end %>` block, which adds a new herb `erb-no-empty-control-flow` hint (below the fail level). It is the only title bar in the app without controls. — `app/views/users/profiles/edit.html.erb:2` → fixed (Render the profile edit title bar without an empty block)
+
+### Validation
+
+- `bin/rails test`: 1332 runs, 3990 assertions, 0 failures, 0 errors, 0 skips.
+- `bin/rails test:system`: 30 runs, 119 assertions, 0 failures, 0 errors, 0 skips (includes `test/system/user_roles_test.rb`, 2 runs green).
+- RuboCop: 381 files, no offenses. Herb: exit 0 (hints only). ESLint `app/javascript`: exit 0.
+- Brakeman: no warnings. Bundler audit: no vulnerabilities. `i18n-tasks normalize`: no diff.
+
+### Bugs and security
+
+- `submit-on-change` calls `requestSubmit()`, so Turbo sends the form's `_method=patch`; a disabled role box fires no `change`. `UsersController#update` still runs `ensure_can_administer`, so the client-side `disabled` is not the only guard.
+- `shared/_pagination`'s `param` defaults to `:page`; `request.query_parameters` is indifferent-access, so the merge replaces the string key as before. The twelve other render sites pass no `param` and render unchanged links.
+- No new queries; no new user input reaches SQL, HTML or redirects.
+
+### Compliance
+
+| Acceptance criterion | Proving test |
+| --- | --- |
+| Admin ticks a member's role box; member becomes administrator, no other button | `test/system/user_roles_test.rb`: "an administrator makes a member an administrator by ticking the role box" |
+| Admin unticks another admin's role box; that user becomes a member | `test/system/user_roles_test.rb`: "an administrator makes another administrator a member by unticking the role box" |
+| Own role box disabled; a member sees every role box disabled | `test/integration/users_index_test.rb`: "your own role box is disabled", "a member sees every role box disabled" |
+| Own profile edit page has no Terug; Annuleren leads to your profile | `test/integration/users/profiles_test.rb`: "your own profile edit page has no back link", existing "the edit form ends in an action row of Annuleren and Opslaan" |
+| Another user's profile show page keeps Terug to `/users` | `test/integration/users/profiles_test.rb`: "another user's profile page links back to the users list" |
+| nl transaction edit labels | `test/integration/form_labels_test.rb`: "the transaction form labels its fields in Dutch" |
+| nl category direction/parent and chattel purchase transaction labels | `test/integration/form_labels_test.rb`: "the category form labels direction and parent category in Dutch", "the chattel form labels the purchase transaction in Dutch" |
+| it labels for the same fields | `test/integration/form_labels_test.rb`: the three "… in Italian" tests |
+| `<html lang>` nl / en / signed-out default | `test/integration/page_language_test.rb`: "a Dutch user gets lang nl", "an English user gets lang en", "the admin layout declares the user's language", "a signed-out visitor gets the default locale" |
+| Accounts index pagers unchanged, each paging its own table, through the shared pager | `test/integration/pagination_navigation_test.rb`: existing "accounts pagination shows correct links on first and last page", new "external accounts pagination writes external_page", "accounts pagination keeps the other query parameters"; `test/integration/accounts_index_test.rb`: existing "own and external pagination params are independent" |
+
+Every test named in `plan.md`'s `## Proof` exists, including the `param` default invariant tests and `test/i18n_test.rb`'s `test_no_missing_keys` and `test_files_are_normalized`. No existing test was weakened, skipped or deleted; the diff only adds tests.
+
+### Design
+
+- No new Ruby methods, so no RBS signatures are due; the one new JS method, `submit()`, is the one `### Signatures` names.
+- No Law of Demeter chains, no N+1 loops, and no glossary `Avoid:` word in names, comments or tests.
+- The five fixes land as five commits in the plan's order.
+
+## Round 2 — 2026-10-24 07:21 UTC — 5a0299a
+
+Re-reviewed `git diff origin/main...HEAD` after fetching origin, plus the working tree (only `review.md` untracked). No root `REVIEW.md` or `REVIEW.local.md` exists; used the default Bugs, Security, Compliance and Design passes. Focus: the two fix commits for the Round 1 nits.
+
+No findings.
+
+### Validation
+
+- `bin/rails test`: 1333 runs, 3994 assertions, 0 failures, 0 errors, 0 skips.
+- `bin/rails test:system`: 30 runs, 119 assertions, 0 failures, 0 errors, 0 skips.
+- RuboCop: 382 files, no offenses. Herb: exit 0; `users/profiles/edit` and `layouts/login` are clean, so the `erb-no-empty-control-flow` hint is gone. ESLint `app/javascript`: exit 0.
+- Brakeman: no warnings. Bundler audit: no vulnerabilities. `i18n-tasks normalize`: no diff.
+
+### Round 1 fixes
+
+- `layouts/login` now writes `tag.html(lang: I18n.locale, **theme_attributes, "data-controller": "theme")`. Like appkit's `tag.attributes(theme_attributes)`, it writes no attribute for an empty hash or a nil value, so a signed-out page carries no `data-theme` and mvpa.css's `:root:not([data-theme])` dark rules match again. `test/integration/login_layout_test.rb` proves it: no `data-theme`, no `data-color-scheme`, `data-controller="theme"` kept. `test/integration/page_language_test.rb` still proves `lang` on that layout.
+- `users/profiles/edit` renders `shared/title_bar` as a plain partial, the same form `dashboard/index`, `receipts/index` and `admin/dashboard/index` use; `controls` is blank, so no `<nav>` renders. "your own profile edit page has no back link" and the Annuleren action-row test stay green.
+
+### Bugs, security, compliance, design
+
+- No change since Round 1 outside the two fixes; Round 1's bug, security and compliance notes and its acceptance-criterion table still hold.
+- The two fixes add no queries, no user input and no Ruby methods.

From 564f3f33b7351b12bbb550bc9a360787d05a3076 Mon Sep 17 00:00:00 2001
From: Etienne van Delden de la Haije <etienne@vandelden.family>
Date: Sat, 24 Oct 2026 09:22:50 +0200
Subject: [PATCH 10/10] Remove change artifacts for ui-review-bug-fixes

---
 docs/changes/ui-review-bug-fixes/intent.md |  75 --------
 docs/changes/ui-review-bug-fixes/plan.md   | 198 ---------------------
 docs/changes/ui-review-bug-fixes/review.md |  65 -------
 3 files changed, 338 deletions(-)
 delete mode 100644 docs/changes/ui-review-bug-fixes/intent.md
 delete mode 100644 docs/changes/ui-review-bug-fixes/plan.md
 delete mode 100644 docs/changes/ui-review-bug-fixes/review.md

diff --git a/docs/changes/ui-review-bug-fixes/intent.md b/docs/changes/ui-review-bug-fixes/intent.md
deleted file mode 100644
index 9ddf917a..00000000
--- a/docs/changes/ui-review-bug-fixes/intent.md
+++ /dev/null
@@ -1,75 +0,0 @@
-# Intent: UI review bug fixes
-
-Author: Etienne van Delden de la Haije. Status: accepted (2026-10-22). Type: bugfix. Delivery: autonomous. Codex review: no.
-
-## Problem
-
-The October 2026 UI review ([artifact](https://claude.ai/artifact/Btg62aW6itkPG4pZJiKFe6), slice 8 "clean-up") found small defects that are still present on main after #386:
-
-- On the user list (`/users`), an administrator cannot change a user between member and administrator: ticking the role box does nothing. The markup asks for a `form` Stimulus controller that exists neither in the app nor in appkit.
-- On your own profile edit page (reached from the menu), "Terug" sends you to the user list, a page the menu does not offer.
-- Labels on the transaction, category and chattel forms show English attribute names (Debitor, Creditor, Category, Note, Booked at, Interest at, Type, Original note, Direction, Parent category, Purchase transaction) for a user whose locale is Dutch or Italian.
-- The page has no `<html lang>`, so browsers and screen readers do not know the page language.
-- The accounts index writes its pager by hand, twice per table, while `shared/_pagination` exists but only knows the `page` parameter.
-
-## Proposed outcome
-
-An administrator changes a role on `/users` with one click. Your own profile edit page has no misleading back link. Form labels speak the user's language. Every page declares its language. The accounts index uses the shared pager.
-
-## Affected users and systems
-
-- Administrators managing roles on `/users`.
-- Every signed-in user on their own profile edit page.
-- Users with locale `nl` or `it` on the transaction, category and chattel forms.
-- Screen readers and browsers (page language).
-- Views: `users/_user`, `users/profiles/edit`, `transactions/_form`, `categories/_form`, `chattels/_form`, `layouts/application` (and `layouts/admin`), `accounts/index`, `shared/_pagination`; locale files `nl.yml` and `it.yml`; a Stimulus controller for the role toggle.
-
-## Constraints
-
-- Binding UI rules: `rails-ui` skill, `references/interaction-design.md`.
-- Every user-facing string comes from i18n; locale files stay normalized (`i18n-tasks normalize`).
-- Each fix is a bug fix: its regression test comes first and fails before the fix. The pager change is a refactor: existing behaviour stays and stays tested.
-- No new gems, npm packages, system tools, destructive migrations or deploy-file changes are expected; any such need is a stop-and-ask.
-- Stay clear of the parallel slices: navigation-hubs (menu, navigation, menu highlighting) and sheets-segmented-control-badges in mvpa.css.
-
-## In scope
-
-- Role toggle on `/users`: changing the box saves the role at once. Keep the existing rules: disabled for your own row and for non-administrators.
-- Remove "Terug" from your own profile edit page. Profile show keeps "Terug" to `/users`, since you reach it from there.
-- Translate in `nl` and `it` every attribute name the transaction, category and chattel forms label, including the admin-only import fields and the chattel purchase transaction field.
-- Set `<html lang>` to the current locale on every layout.
-- Accounts index pager through the shared pagination partial, with the page parameter per table (`own_page`, `external_page`) kept.
-- One pull request, one commit per fix.
-
-## Out of scope
-
-- The red invalid border before typing: the cause is mvpa.css `:invalid`; it goes to a later mvpa.css change.
-- The parent-category field: #386 already replaced the category show form with a `<dl>`.
-- Navigation, the menu and menu highlighting (navigation-hubs slice).
-- Other pages' layout, the admin user edit page, and English labels outside the three forms.
-
-## Acceptance criteria
-
-- An administrator on `/users` ticks the role box of a member; that member is now an administrator, without pressing another button.
-- An administrator on `/users` unticks the role box of another administrator; that user is now a member.
-- On `/users` the role box of your own row stays disabled, and a member sees every role box disabled.
-- On your own profile edit page there is no "Terug" link; Annuleren still leads to your profile.
-- On another user's profile show page, "Terug" still leads to `/users`.
-- A user with locale `nl` opening a transaction's edit page sees Dutch labels for debitor, creditor, category, note, booked at, interest at, type and the original import fields, not the English names.
-- A user with locale `nl` sees Dutch labels for direction and parent category on the category form, and for purchase transaction on the chattel form.
-- A user with locale `it` sees Italian labels for the same fields.
-- A user with locale `nl` gets `<html lang="nl">`; a user with locale `en` gets `<html lang="en">`; a signed-out visitor gets the default locale.
-- The accounts index shows the same previous/next links as today for own and external accounts, each paging its own table, now rendered through the shared pager.
-
-## Decisions
-
-- Include the role toggle, the profile Terug, the Dutch/Italian labels and `<html lang>` — chosen from the review's clean-up list after verifying each on main.
-- Pager refactor in, red border out — the pager is small and in the same area; the border is an mvpa.css fix.
-- One PR, one commit per fix — chosen over one PR per fix.
-- Make the role toggle work, rather than remove it from `/users` — no reason given.
-- Remove Terug on your own profile edit page — the menu and Annuleren are enough.
-- Autonomous delivery, no Codex review — chosen at the delivery question.
-
-## Open questions
-
-None.
diff --git a/docs/changes/ui-review-bug-fixes/plan.md b/docs/changes/ui-review-bug-fixes/plan.md
deleted file mode 100644
index ea8c0505..00000000
--- a/docs/changes/ui-review-bug-fixes/plan.md
+++ /dev/null
@@ -1,198 +0,0 @@
-# Plan: UI review bug fixes
-
-From `intent.md` (2026-10-22). Status: accepted.
-
-Base: `origin/main` at 92372d4 (includes #378 eslint/stylelint and #387 category blank parent). The branch `ui-review-bug-fixes` is already rebased onto it. #387 touched only `CategoriesController` params and a data migration, not `categories/_form`, so the scope holds. #378 added eslint (`eslint.config.mjs`, recommended rules, browser globals) over `app/javascript`; the new Stimulus controller must pass it.
-
-## Design
-
-### Domain terms
-
-No new domain terms; `GLOSSARY.md` stays unchanged. No word of the intent is on an `Avoid:` list. UI words used in this plan:
-
-- **Role box**: the role checkbox of one row on `/users`. It carries the `hidden` attribute; its `<label>` is what the user clicks.
-- **Submit on change**: a form that saves as soon as one of its fields changes, with no submit button.
-- **Pager**: the `shared/_pagination` partial. **Page parameter**: the query key one pager writes (`page`, `own_page`, `external_page`).
-- **Page language**: the `lang` attribute of `<html>`, equal to `I18n.locale` while the page renders.
-
-### Diagrams
-
-```mermaid
-sequenceDiagram
-  actor Admin
-  Admin ->> RoleBox: click label (change event)
-  RoleBox ->> SubmitOnChangeController: submit()
-  SubmitOnChangeController ->> UserForm: requestSubmit()
-  UserForm ->> UsersController: PATCH /users/:id {user: {role}}
-  UsersController -->> Admin: redirect users_url (Turbo visit, new role label)
-```
-
-```mermaid
-classDiagram
-  class UserRow["users/_user"] { form data-controller=submit-on-change }
-  class SubmitOnChangeController { +submit() }
-  class Pagination["shared/_pagination"] { locals: page, param = :page }
-  class AccountsIndex["accounts/index"] { 2 tables x 2 pagers }
-  class OtherCallers { 6 templates, 12 render sites, page only }
-  class LoginLayout["layouts/login (host override)"] { html lang }
-  UserRow ..> SubmitOnChangeController : data-action change->submit-on-change#submit
-  AccountsIndex --> Pagination : param own_page / external_page
-  OtherCallers --> Pagination : default param page
-```
-
-Before: `users/_user` names a `form` controller that does not exist, so the change event goes nowhere; `accounts/index` writes its own `nav.pagination` four times; `layouts/application`, `layouts/admin` and appkit's `layouts/login` have no `lang`.
-
-### Signatures
-
-- `app/javascript/controllers/submit_on_change_controller.js` (new): submits the form it is attached to. Eager-loaded as `submit-on-change` by the existing `eagerLoadControllersFrom("controllers", application)`.
-  - `submit() // (): void` — calls `this.element.requestSubmit()`, so Turbo submits the form with its `_method=patch`.
-- `app/views/users/_user.html.erb`: `form_with ... data: { controller: "submit-on-change" }`; the role box gets `data: { action: "change->submit-on-change#submit" }`. `hidden`, `id` and the `disabled` rule stay exactly as they are.
-- `app/views/shared/_pagination.html.erb`: renders previous/next links for one page parameter. Strict locals become `<%# locals: (page:, param: :page) %>`; both `merge(page: ...)` calls become `merge(param => ...)`. The six other templates that render it (twelve render sites: `receipts/index`, `products/index`, `admin/users/index`, `shared/_recent_transactions`, `transactions/_table`, `todos/index`) do not change.
-- `app/views/accounts/index.html.erb`: each of the two hand-written `<nav class="pagination">` blocks becomes `<%= render "shared/pagination", page: table[:page], param: table[:page_param] %>`.
-- `app/views/users/profiles/edit.html.erb`: the `link_to t("common.back"), users_path` line goes; the title-bar block stays and yields nothing, so `shared/_title_bar` renders no `<nav>`.
-- `app/views/layouts/application.html.erb`, `app/views/layouts/admin.html.erb`: `<html lang="<%= I18n.locale %>" ...>`.
-- `app/views/layouts/login.html.erb` (new): host override of appkit's `layouts/login`, copied verbatim from the locked appkit revision (`bundle show appkit`, revision 9b5b30d), plus `lang="<%= I18n.locale %>"` on `<html>`. Host views win the lookup over engine views.
-- `config/locales/{en,nl,it}.yml`, under `activerecord.attributes`:
-  - `transaction`: `booked_at`, `category_id`, `id`, `creditor`, `debitor`, `interest_at`, `note`, `original_balance_after_mutation`, `original_note`, `original_tag`, `type`.
-  - `category`: `direction`, `parent_category`.
-  - `chattel`: `purchase_transaction_id`.
-  - `Debit`, `Credit`, `Transfer` resolve to the `transaction` keys through STI `lookup_ancestors`; the `f.label` calls stay as they are.
-
-Words:
-
-| key | en | nl | it |
-|---|---|---|---|
-| transaction.id | Id | ID | ID |
-| transaction.debitor | Debitor | Debiteur | Debitore |
-| transaction.creditor | Creditor | Crediteur | Creditore |
-| transaction.category_id | Category | Categorie | Categoria |
-| transaction.note | Note | Opmerking | Nota |
-| transaction.booked_at | Booked at | Boekingsdatum | Data registrazione |
-| transaction.interest_at | Interest at | Rentedatum | Data valuta |
-| transaction.type | Type | Type | Tipo |
-| transaction.original_note | Original note | Oorspronkelijke omschrijving | Descrizione originale |
-| transaction.original_balance_after_mutation | Original balance after mutation | Oorspronkelijk saldo na mutatie | Saldo originale dopo il movimento |
-| transaction.original_tag | Original tag | Oorspronkelijk label | Etichetta originale |
-| category.direction | Direction | Richting | Direzione |
-| category.parent_category | Parent category | Hoofdcategorie | Categoria principale |
-| chattel.purchase_transaction_id | Purchase transaction | Aankooptransactie | Transazione d'acquisto |
-
-The nl/it words for debitor, creditor, note, booked_at and interest_at are the ones `transactions.table` already uses. `Hoofdcategorie` matches the existing `must_be_parent` error text. The en values equal today's humanized output, so English pages do not change.
-
-Not checked: journal_administration has no Steepfile, and this change adds no Ruby methods.
-
-### Complexity
-
-- Role box: one PATCH per change through the existing `UsersController#update` (find + update), then one redirect to the index. A disabled box fires no event and sends nothing.
-- Labels, page language and pager add no queries. The pager reuses the page objects the controller already loads.
-
-### Invariants
-
-- A change to an enabled role box saves the opposite role with no other click; enforced by `submit_on_change_controller.js` and its wiring in `users/_user`.
-- Your own role box, and every role box a member sees, stay `disabled`; enforced by the existing `disabled:` expression in `users/_user` (and `ensure_can_administer` on `UsersController#update`).
-- A pager link changes only its own page parameter and keeps every other query parameter; enforced by `request.query_parameters.merge(param => ...)` in `shared/_pagination`.
-- With `param` left out, the pager writes `page`, so the twelve other render sites render the same links as today.
-- `<html lang>` equals `I18n.locale` on the application, admin and login layouts; `ApplicationController#switch_locale` sets the locale (user locale, else `I18n.default_locale`, `en`). Appkit's session, first-run and transfer controllers inherit `::ApplicationController`, so the login layout gets the same locale.
-- en, nl and it hold the same `activerecord.attributes` keys for the three forms; `test/i18n_test.rb` (missing keys, normalized files) enforces it.
-
-### Alternatives
-
-- **A. Generic `form_controller.js`** (smallest): add a `form` controller with `submit()`, so the existing `data-controller="form"` markup starts to work with no view change. Rejected: `form` says nothing about the behaviour, and the markup relies on Stimulus' default `input` event for a checkbox. One line of view change buys an intention-revealing name and an explicit `change` event.
-- **B. Host `submit-on-change` controller** (chosen): as above. One repository, no gem bump, eslint-checked. It can move to appkit later without a markup change beyond the registration.
-- **C. Appkit `submit-on-change` controller, `Appkit::FormsHelper#submit_on_change_form_with`, and `lang` in appkit's login layout**: most reusable, and no layout copy in the host. Rejected for this PR: it needs a separate appkit change and a `bundle update appkit` before the host commits can go green, which the intent's constraints make stop-and-ask, and it adds public appkit API that must then stay stable. Kept as the recommended follow-up for the login layout (see `## Design decisions`).
-
-## Design decisions
-
-- The role box listens to `change`, not Stimulus' default `input` event, so the wiring states the event it relies on.
-- en gets the same keys as nl and it, with today's English text. The intent asks only for nl and it; the en keys make `i18n-tasks missing` (diff against base `en`) flag a future locale that lacks a label, and they change no English output.
-- The signed-out page language needs the login layout, which lives in appkit. This plan overrides it in the host (`app/views/layouts/login.html.erb`), because the intent rules out dependency changes without asking. The copy drifts from appkit until a follow-up moves `lang` into appkit's login layout, bumps appkit and deletes the host copy; that follow-up is a separate change, not part of this PR.
-- Profile edit keeps its title bar; only the Terug link goes. Its controls block becomes empty and `shared/_title_bar` already renders no `<nav>` for an empty block.
-- One commit per fix, five commits, in the order of `## Order of work`.
-- No conflict with `intent.md`'s `## Decisions`.
-
-## Integration points
-
-- Turbo: `requestSubmit()` on a `form_with` form goes through Turbo; the redirect to `users_url` becomes a Turbo visit that re-renders the index with the new role label.
-- Stimulus eager loading via `@hotwired/stimulus-loading` and `pin_all_from "app/javascript/controllers"`; no importmap change.
-- Appkit engine: `layouts/login` lookup (host view wins); `Appkit::SessionsController`, `FirstRunsController`, `Sessions::TransfersController` render it.
-- i18n-tasks (`test/i18n_test.rb`, `bundle exec i18n-tasks normalize`).
-
-## Files that change
-
-- `app/javascript/controllers/submit_on_change_controller.js` — new; submits its form on change.
-- `app/views/users/_user.html.erb` — wire the role box to `submit-on-change`.
-- `app/views/users/profiles/edit.html.erb` — drop the Terug link.
-- `config/locales/en.yml`, `config/locales/nl.yml`, `config/locales/it.yml` — the 14 attribute keys above.
-- `app/views/layouts/application.html.erb`, `app/views/layouts/admin.html.erb` — `lang`.
-- `app/views/layouts/login.html.erb` — new host override with `lang`.
-- `app/views/shared/_pagination.html.erb` — optional `param` local.
-- `app/views/accounts/index.html.erb` — render the shared pager.
-- Tests: `test/system/user_roles_test.rb` (new), `test/integration/users_index_test.rb`, `test/integration/users/profiles_test.rb`, `test/integration/form_labels_test.rb` (new), `test/integration/page_language_test.rb` (new), `test/integration/pagination_navigation_test.rb`.
-
-## Order of work
-
-Setup in the worktree: put the worktree's `bin/` first on `PATH` (`export PATH="$PWD/bin:$PATH"`) and run `npm install` once, or the pre-push hooks boot the main checkout and herb-lint fails.
-
-1. Role toggle (commit `Save a user's role when its role box changes`).
-   1. Write `test/system/user_roles_test.rb`: tick a member's role box, untick another administrator's box. Run `bin/rails test test/system/user_roles_test.rb`, watch both fail (the role stays unchanged).
-   2. Add `submit_on_change_controller.js`, wire `users/_user`. Run the system test green.
-   3. Add the disabled-box tests to `test/integration/users_index_test.rb` (they guard existing behaviour and pass before and after).
-   4. `npx eslint app/javascript`, `npx @herb-tools/linter app/views/`, commit.
-2. Profile Terug (commit `Drop the back link from your own profile edit page`).
-   1. Add the edit-page test to `test/integration/users/profiles_test.rb`, watch it fail; add the show-page Terug test (passes, guards it).
-   2. Remove the link. Run the file green. Commit.
-3. Form labels (commit `Translate the transaction, category and chattel form labels`).
-   1. Write `test/integration/form_labels_test.rb`, run it, watch the nl and it tests fail on the English names.
-   2. Add the keys to en, nl, it; run `bundle exec i18n-tasks normalize`. Run the file and `test/i18n_test.rb` green. Commit.
-4. Page language (commit `Declare the page language on every layout`).
-   1. Write `test/integration/page_language_test.rb`, watch it fail.
-   2. Add `lang` to application and admin; copy appkit's `layouts/login.html.erb` from `$(bundle show appkit)/app/views/layouts/login.html.erb` into `app/views/layouts/` and add `lang`. Run green. Commit.
-5. Pager (commit `Render the accounts pager through the shared partial`).
-   1. Extend `test/integration/pagination_navigation_test.rb` with the external-table and kept-parameter tests; they pass before the refactor (refactor, not bug fix).
-   2. Add `param:` to `shared/_pagination`, replace the four blocks in `accounts/index`. Run `pagination_navigation_test.rb`, `accounts_index_test.rb` and every caller's tests green. Commit.
-6. Full suite: `bin/rails test`, `bin/rails test:system`, `bundle exec rubocop`, `npx @herb-tools/linter app/views/`, `npx eslint app/javascript`, `bundle exec brakeman --no-pager -q`, `bundle exec bundler-audit check`, `bundle exec i18n-tasks normalize` (no diff). Re-read the full diff against `origin/main`.
-
-## Risks
-
-- The role box is `hidden`; a system test must click its `<label>`, not the input. A clicked label of a hidden checkbox still toggles it and fires `change` in Chrome and Edge.
-- The test must wait for the redirect (assert the new role label text) before it reads the database, or it races the PATCH.
-- The new attribute keys also translate the show pages that call `human_attribute_name` for the same attributes (transaction show original fields, category show direction and parent, chattel show purchase transaction). That is wanted; no test asserts the English text there today.
-- The host `layouts/login.html.erb` hides later appkit changes to its login layout. Mitigated by the appkit follow-up named in `## Design decisions`.
-- Rejected: `form_controller.js` (vague name), appkit upstream in this PR (second repository and gem bump), `lang` on `layouts/mailer` (no mailer class inherits `ApplicationMailer`, so it renders nowhere) and on static `public/*.html` pages (not in the intent's view list).
-
-Out of scope: the red invalid border (mvpa.css), the parent-category field on the category show page, navigation and menu highlighting, the admin user edit page, English labels outside the three forms, the untranslated option values of the direction and type selects.
-
-## Proof
-
-- An administrator on `/users` ticks the role box of a member; that member is now an administrator, without pressing another button → `test/system/user_roles_test.rb` `test "an administrator makes a member an administrator by ticking the role box"`
-- An administrator on `/users` unticks the role box of another administrator; that user is now a member → `test/system/user_roles_test.rb` `test "an administrator makes another administrator a member by unticking the role box"`
-- On `/users` the role box of your own row stays disabled, and a member sees every role box disabled → `test/integration/users_index_test.rb` `test "your own role box is disabled"`, `test "a member sees every role box disabled"`
-- On your own profile edit page there is no "Terug" link; Annuleren still leads to your profile → `test/integration/users/profiles_test.rb` `test "your own profile edit page has no back link"`, existing `test "the edit form ends in an action row of Annuleren and Opslaan"`
-- On another user's profile show page, "Terug" still leads to `/users` → `test/integration/users/profiles_test.rb` `test "another user's profile page links back to the users list"`
-- A user with locale `nl` opening a transaction's edit page sees Dutch labels for debitor, creditor, category, note, booked at, interest at, type and the original import fields (and id) → `test/integration/form_labels_test.rb` `test "the transaction form labels its fields in Dutch"`
-- A user with locale `nl` sees Dutch labels for direction and parent category on the category form, and for purchase transaction on the chattel form → `test/integration/form_labels_test.rb` `test "the category form labels direction and parent category in Dutch"`, `test "the chattel form labels the purchase transaction in Dutch"`
-- A user with locale `it` sees Italian labels for the same fields → `test/integration/form_labels_test.rb` `test "the transaction form labels its fields in Italian"`, `test "the category form labels direction and parent category in Italian"`, `test "the chattel form labels the purchase transaction in Italian"`
-- A user with locale `nl` gets `<html lang="nl">`; a user with locale `en` gets `<html lang="en">`; a signed-out visitor gets the default locale → `test/integration/page_language_test.rb` `test "a Dutch user gets lang nl"`, `test "an English user gets lang en"`, `test "the admin layout declares the user's language"`, `test "a signed-out visitor gets the default locale"`
-- The accounts index shows the same previous/next links as today for own and external accounts, each paging its own table, now rendered through the shared pager → existing `test/integration/pagination_navigation_test.rb` `test "accounts pagination shows correct links on first and last page"`, new `test "external accounts pagination writes external_page"`, `test "accounts pagination keeps the other query parameters"`; existing `test/integration/accounts_index_test.rb` `test "own and external pagination params are independent"`
-- Invariant: with `param` left out the pager writes `page`, enforced by the partial's default local → existing `test/integration/pagination_navigation_test.rb` `test "transactions pagination keeps filter params and does not show next on overflow pages"`, `test "todo pagination is clamped and hides next on the last page"`
-- Invariant: en, nl and it hold the same label keys, enforced by i18n-tasks → `test/i18n_test.rb` `test_no_missing_keys`, `test_files_are_normalized`
-
-Per changed file, the unit tests expected:
-
-- `app/javascript/controllers/submit_on_change_controller.js`: no JS unit test runner exists; covered by the role toggle system tests, and `npx eslint app/javascript` passes.
-- `app/views/shared/_pagination.html.erb`: covered by the integration tests above (the `param` local and its `page` default).
-- Views and locale files: covered by the integration tests above.
-
-Test setup: fixtures only. `users(:admin)` is an nl administrator, `users(:member)` an en member. The untick test first runs `users(:member).update!(role: :administrator)`. The Italian tests first run `users(:admin).update!(locale: :it)` before `sign_in_as`. Forms: `transactions(:debit_grocery)`, `categories(:groceries)`, `chattels(:one)`; the admin sees the admin-only original fields. Label assertions use the literal words from the table above, scoped to `form label`. Pager tests create accounts as `create_accounts` does today; the external variant creates external accounts (no household owner). Page language tests: signed-in GET `dashboard_index_path` and `admin_root_path`; signed-out GET `new_session_path`, asserting `html[lang=?]`, `I18n.default_locale.to_s`.
-
----
-Domain skills applied: rails-ui (interaction-design: immediate feedback, Back/Cancel links), rails-testing, hwc-stimulus-fundamentals, software-design, glossary, diagrams.
-
-## Critique
-
-### Round 1 (codex exec -p terra)
-
-- The appkit login-layout choice is left as an open decision although the accepted intent has no open questions; choose the host override and record appkit as a follow-up → fixed (`## Design decisions` now decides the host override and names the appkit change as a separate follow-up, not part of this PR)
-- "Every layout" omits `layouts/mailer.html.erb`; add `lang` and a mailer assertion → dismissed: no mailer class inherits `ApplicationMailer` (`app/mailers` holds only `application_mailer.rb`), so the layout renders nowhere and cannot be asserted; the intent's view list names only the application and admin layouts
-- The plan excludes the transaction form's `id` label although the intent says every labelled attribute is translated → fixed (added `activerecord.attributes.transaction.id` in en, nl and it, removed it from out of scope, and the Dutch transaction label test covers it)
-- The plan says seven existing pager callers stay unchanged; there are six templates with twelve render sites → fixed (Signatures, diagram and Invariants now name the six templates and twelve render sites)
diff --git a/docs/changes/ui-review-bug-fixes/review.md b/docs/changes/ui-review-bug-fixes/review.md
deleted file mode 100644
index b80625e6..00000000
--- a/docs/changes/ui-review-bug-fixes/review.md
+++ /dev/null
@@ -1,65 +0,0 @@
-## Round 1 — 2026-10-24 07:16 UTC — dd6a3fc
-
-Reviewed `git diff origin/main...HEAD` after fetching origin, plus the working tree (clean at review start). No root `REVIEW.md` or `REVIEW.local.md` exists; used the default Bugs, Security, Compliance and Design passes.
-
-- [ ] Nit: The host login layout is not the verbatim appkit copy the plan names. Appkit writes `<html <%= tag.attributes(theme_attributes) %> data-controller="theme">`; the copy writes four explicit `data-*` attributes. A signed-out visitor has an empty `theme_attributes`, so the page now carries `data-color-scheme=""`, `data-light-theme=""`, `data-dark-theme=""` and `data-theme=""` where appkit wrote none. The empty `data-theme` stops mvpa.css's `@media (prefers-color-scheme: dark) :root:not([data-theme])` button and header-link rules from matching until the theme controller connects, so a dark-OS visitor gets light buttons on first paint (and for good with JavaScript off). Keep appkit's `tag.attributes(theme_attributes)` and add only `lang`. — `app/views/layouts/login.html.erb:2` → fixed (Leave out empty theme attributes on the signed-out login page)
-- [ ] Nit: Removing the Terug link leaves an empty `render layout: "shared/title_bar" ... do %><% end %>` block, which adds a new herb `erb-no-empty-control-flow` hint (below the fail level). It is the only title bar in the app without controls. — `app/views/users/profiles/edit.html.erb:2` → fixed (Render the profile edit title bar without an empty block)
-
-### Validation
-
-- `bin/rails test`: 1332 runs, 3990 assertions, 0 failures, 0 errors, 0 skips.
-- `bin/rails test:system`: 30 runs, 119 assertions, 0 failures, 0 errors, 0 skips (includes `test/system/user_roles_test.rb`, 2 runs green).
-- RuboCop: 381 files, no offenses. Herb: exit 0 (hints only). ESLint `app/javascript`: exit 0.
-- Brakeman: no warnings. Bundler audit: no vulnerabilities. `i18n-tasks normalize`: no diff.
-
-### Bugs and security
-
-- `submit-on-change` calls `requestSubmit()`, so Turbo sends the form's `_method=patch`; a disabled role box fires no `change`. `UsersController#update` still runs `ensure_can_administer`, so the client-side `disabled` is not the only guard.
-- `shared/_pagination`'s `param` defaults to `:page`; `request.query_parameters` is indifferent-access, so the merge replaces the string key as before. The twelve other render sites pass no `param` and render unchanged links.
-- No new queries; no new user input reaches SQL, HTML or redirects.
-
-### Compliance
-
-| Acceptance criterion | Proving test |
-| --- | --- |
-| Admin ticks a member's role box; member becomes administrator, no other button | `test/system/user_roles_test.rb`: "an administrator makes a member an administrator by ticking the role box" |
-| Admin unticks another admin's role box; that user becomes a member | `test/system/user_roles_test.rb`: "an administrator makes another administrator a member by unticking the role box" |
-| Own role box disabled; a member sees every role box disabled | `test/integration/users_index_test.rb`: "your own role box is disabled", "a member sees every role box disabled" |
-| Own profile edit page has no Terug; Annuleren leads to your profile | `test/integration/users/profiles_test.rb`: "your own profile edit page has no back link", existing "the edit form ends in an action row of Annuleren and Opslaan" |
-| Another user's profile show page keeps Terug to `/users` | `test/integration/users/profiles_test.rb`: "another user's profile page links back to the users list" |
-| nl transaction edit labels | `test/integration/form_labels_test.rb`: "the transaction form labels its fields in Dutch" |
-| nl category direction/parent and chattel purchase transaction labels | `test/integration/form_labels_test.rb`: "the category form labels direction and parent category in Dutch", "the chattel form labels the purchase transaction in Dutch" |
-| it labels for the same fields | `test/integration/form_labels_test.rb`: the three "… in Italian" tests |
-| `<html lang>` nl / en / signed-out default | `test/integration/page_language_test.rb`: "a Dutch user gets lang nl", "an English user gets lang en", "the admin layout declares the user's language", "a signed-out visitor gets the default locale" |
-| Accounts index pagers unchanged, each paging its own table, through the shared pager | `test/integration/pagination_navigation_test.rb`: existing "accounts pagination shows correct links on first and last page", new "external accounts pagination writes external_page", "accounts pagination keeps the other query parameters"; `test/integration/accounts_index_test.rb`: existing "own and external pagination params are independent" |
-
-Every test named in `plan.md`'s `## Proof` exists, including the `param` default invariant tests and `test/i18n_test.rb`'s `test_no_missing_keys` and `test_files_are_normalized`. No existing test was weakened, skipped or deleted; the diff only adds tests.
-
-### Design
-
-- No new Ruby methods, so no RBS signatures are due; the one new JS method, `submit()`, is the one `### Signatures` names.
-- No Law of Demeter chains, no N+1 loops, and no glossary `Avoid:` word in names, comments or tests.
-- The five fixes land as five commits in the plan's order.
-
-## Round 2 — 2026-10-24 07:21 UTC — 5a0299a
-
-Re-reviewed `git diff origin/main...HEAD` after fetching origin, plus the working tree (only `review.md` untracked). No root `REVIEW.md` or `REVIEW.local.md` exists; used the default Bugs, Security, Compliance and Design passes. Focus: the two fix commits for the Round 1 nits.
-
-No findings.
-
-### Validation
-
-- `bin/rails test`: 1333 runs, 3994 assertions, 0 failures, 0 errors, 0 skips.
-- `bin/rails test:system`: 30 runs, 119 assertions, 0 failures, 0 errors, 0 skips.
-- RuboCop: 382 files, no offenses. Herb: exit 0; `users/profiles/edit` and `layouts/login` are clean, so the `erb-no-empty-control-flow` hint is gone. ESLint `app/javascript`: exit 0.
-- Brakeman: no warnings. Bundler audit: no vulnerabilities. `i18n-tasks normalize`: no diff.
-
-### Round 1 fixes
-
-- `layouts/login` now writes `tag.html(lang: I18n.locale, **theme_attributes, "data-controller": "theme")`. Like appkit's `tag.attributes(theme_attributes)`, it writes no attribute for an empty hash or a nil value, so a signed-out page carries no `data-theme` and mvpa.css's `:root:not([data-theme])` dark rules match again. `test/integration/login_layout_test.rb` proves it: no `data-theme`, no `data-color-scheme`, `data-controller="theme"` kept. `test/integration/page_language_test.rb` still proves `lang` on that layout.
-- `users/profiles/edit` renders `shared/title_bar` as a plain partial, the same form `dashboard/index`, `receipts/index` and `admin/dashboard/index` use; `controls` is blank, so no `<nav>` renders. "your own profile edit page has no back link" and the Annuleren action-row test stay green.
-
-### Bugs, security, compliance, design
-
-- No change since Round 1 outside the two fixes; Round 1's bug, security and compliance notes and its acceptance-criterion table still hold.
-- The two fixes add no queries, no user input and no Ruby methods.