:)

docs/IMPLEMENTATION_PLAN.md

@@ -1,5 +1,15 @@
 # ASSESSOR – Umsetzungsplan
 
+## Security export typography matching (2026-10-13, Phase 7 Report Engine)
+
+User correction: reduce popup text and match the complete report's type sizes to the application Security panel. The previous whole-report CSS zoom shrank every application type role and caused the large difference between report and unscaled popups. Renderer 1.3.0 removes this whole-report zoom and uses a responsive centered two-thirds width, retaining the full-width narrow-viewport fallback. Native Security roles remain 14px for structured data/category labels and 16px for context/finding prose; popup prose, fact values and scoring captions now use the existing 14px structured-data role. Popup headings keep the 16px title role. No global application tokens or Core components/styles change.
+
+To preserve actual 14px SVG labels, the existing 1280px diagram renders at its native width in a local horizontal scroll container when necessary. At report widths up to 1800px, the existing facts move below the diagram and lose the former horizontal centering transform; wider reports retain the two-column overview. This responsive reflow implements the latest explicit font-size correction while preserving the centered report surface, all evidence/counts, native category disclosure, popup scroll containment and maximization, and the no-JavaScript contract.
+
+Verified engine step: nine renderer/boundary/invariance checks pass. Synthetic browser inspection of existing full export fixture markup with the current renderer CSS confirms Light/Dark category and graph text 14px, zoom 1, original 1280px SVG geometry, a 1273.6px report at 1910px viewport (two thirds), no page-level horizontal overflow, popup data/cells/body/prose/captions 14px and popup titles 16px. Native category link still reveals its exact details; context prose retains the Security panel's 16px role. The permanent engine test protects no zoom, the responsive width, graph geometry, popup scale and retained native controls. Temporary preview files use synthetic data only and are outside the repository.
+
+Release follow-up: user supplies the complete current `Core-Freigabe: Platform, Core Tests` on 2026-10-13. The old Core export interaction assertions for scaled fixed-width markup/zoom now require the responsive width, absence of zoom, native SVG width and 14px popup roles after the actual export click; every original source/count/membership/disclosure/CSP assertion remains. Product patch 2.25.2 is synchronized in package/lock and UI/API version contracts. All 25 targeted export/renderer/boundary/invariance/version/API checks pass. Local-only and design checks pass from the verified engine step, and the final diff check passes. Running backend health reports 2.25.2, PostgreSQL and unchanged repository revision 592; app HTTP is 200. Final mandatory gate passes all 507 import checks and both client/server production builds; existing client chunk-size warning only. This release batch is verified; no full-suite or phase-completion claim, commit, database, source data, score or archived-report changes. A fresh Security export is required to receive the typography correction.
+
 ## Native Security export interaction and layout corrections (2026-10-13, Phase 7 Report Engine)
 
 User requests isolated popup/page scrolling, popup maximization, compact top facts, category click selection/disclosure and a centered two-thirds report with the Technical Report background. User explicitly retains the no-JavaScript export contract. Changes are confined to the Report Engine renderer and its tests; the Core snapshot adapter and source styles remain unchanged. Native checkbox controls maximize/restore each popup before the rightmost close X. Popup scroll containers contain overscroll, including nested source popups. Top-level popup fact lists use five columns, reducing to three/two on narrow windows. Graph links target a descendant inside each native category details element so the browser reveals the closed ancestor; the target category summary carries the existing amber selection role. The report preserves its logical source width while fitting two thirds of the desktop viewport; narrow windows use the available width. Body, report, Security panel and Findings table use the Technical Report surface-panel background. Renderer version 1.2.0; snapshot schema remains 1.1.0. Existing downloaded reports require a fresh export.

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "assessor",
-  "version": "2.25.1",
+  "version": "2.25.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "assessor",
-      "version": "2.25.1",
+      "version": "2.25.2",
       "dependencies": {
         "@fontsource-variable/inter": "^5.3.0",
         "jsdom": "^29.1.1",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "assessor",
-  "version": "2.25.1",
+  "version": "2.25.2",
   "private": true,
   "type": "module",
   "scripts": {

src/reporting/security-view-report.ts

@@ -14,7 +14,7 @@ import scoring from '../styles/security-scoring.css?raw';
 import icons from '../styles/functional-icons.css?raw';
 
 export const SECURITY_VIEW_SNAPSHOT_VERSION = '1.1.0';
-export const SECURITY_HTML_RENDERER_VERSION = '1.2.0';
+export const SECURITY_HTML_RENDERER_VERSION = '1.3.0';
 
 /** Declared Core Presentation read port; the Report Engine receives only an authorized frozen view. */
 export interface SecurityViewReadPort {
@@ -45,8 +45,8 @@ export function buildSecurityViewReportHtml(port: SecurityViewReadPort): string
 @font-face{font-family:'Inter Variable';src:url('${REPORT_INTER_FONT}') format('woff2');font-weight:100 900;font-display:swap}
 ${uiTokens}\n${tokens}\n${base}\n${components}\n${datahub}\n${security}\n${policy}\n${scoring}\n${icons}
 html,body{background:var(--surface-panel)}
-body{overflow:auto;min-height:100vh}
+body{overflow:auto;min-height:100vh;font-size:var(--type-table-body-size)}
-.security-export{width:${snapshot.width}px;max-width:none;zoom:min(1,calc((100vw * 2 / 3) / ${snapshot.width}px));margin:0 auto;color:var(--text-primary);background:var(--surface-panel)}
+.security-export{width:min(${snapshot.width}px,calc(100vw * 2 / 3));max-width:100%;margin:0 auto;color:var(--text-primary);background:var(--surface-panel);container:security-report / inline-size}
 .security-export .client-security-group:has(>.client-security-group-content:target)>summary{background:var(--surface-selected);border-inline-start:var(--marker-width) solid var(--marking-color)}
 .security-export-head,.security-export-results{padding:var(--panel-inset)}
 .security-export-brand{display:flex;align-items:center;gap:var(--space-4)}
@@ -61,6 +61,9 @@ body{overflow:auto;min-height:100vh}
 .security-export-versions dd{margin:0;font-size:var(--type-body-size)}
 .security-export .client-security-panel{height:auto;min-height:0;overflow:visible;background:var(--surface-panel)}
 .security-export .client-security-table{background:var(--surface-panel)}
+.security-export .client-security-map-scroll{overflow-x:auto}
+.security-export .client-security-map-scroll>svg{width:1280px;max-width:none}
+@container security-report (max-width:1800px){.security-export .client-security-overview{grid-template-columns:minmax(0,1fr)}.security-export .client-security-hardfacts{transform:none;padding-inline-start:0;align-self:start}.security-export .client-security-hardfacts-content{max-width:1280px}}
 .security-export summary{list-style:none;cursor:pointer}
 .security-export summary::-webkit-details-marker{display:none}
 .security-export .client-security-group>summary>svg,.security-export .client-security-finding summary>svg{flex:none}
@@ -84,13 +87,14 @@ body{overflow:auto;min-height:100vh}
 .security-export-maximize:has(input:checked) .restore-label{display:inline}
 .security-export-popup:has(>.security-export-popup-body){overscroll-behavior:contain}
 .security-export-popup:has(>header input:checked){width:calc(100vw - var(--space-8));height:calc(100dvh - var(--space-8));resize:none}
-.security-export-popup-body{overflow:auto;overscroll-behavior:contain;min-height:0;padding:var(--panel-inset);font-size:var(--type-body-size)}
+.security-export-popup-body{overflow:auto;overscroll-behavior:contain;min-height:0;padding:var(--panel-inset);font-size:var(--type-table-body-size)}
+.security-export-popup .security-export-popup-body p,.security-export-popup .security-export-popup-body dd,.security-export-popup .security-export-popup-body .client-env-evidence-empty,.security-export-popup .security-export-popup-body .security-scoring-methodology caption{font-size:var(--type-table-body-size)}
 .security-export-popup-body>dl{display:grid;grid-template-columns:repeat(5,minmax(0,1fr));gap:0;margin:0 0 var(--space-4);font-size:var(--type-table-body-size)}
 .security-export-popup-body>dl>div{min-width:0;padding:var(--space-2);border:var(--border-hair) solid var(--border-subtle)}
 .security-export-popup-body>dl dt{color:var(--text-secondary);font-weight:var(--fw-regular)}
 .security-export-popup-body>dl dd{margin:0;overflow-wrap:anywhere}
 .security-export-popup .client-env-evidence-scroll{max-height:none}
-@media(max-width:900px){.security-export{zoom:min(1,calc((100vw - var(--space-8)) / ${snapshot.width}px))}.security-export-popup-body>dl{grid-template-columns:repeat(3,minmax(0,1fr))}}
+@media(max-width:900px){.security-export{width:calc(100vw - var(--space-8))}.security-export-popup-body>dl{grid-template-columns:repeat(3,minmax(0,1fr))}}
 @media(max-width:600px){.security-export-popup-body>dl{grid-template-columns:repeat(2,minmax(0,1fr))}}
 @media print{.security-export-maximize{display:none}}
 @media print{body{overflow:visible}.security-export{margin:0}.security-export-confidential{-webkit-print-color-adjust:exact;print-color-adjust:exact}details::details-content{content-visibility:visible;display:block}summary{break-after:avoid}tr,.client-security-finding-detail{break-inside:avoid}.security-export-popup{display:block;position:static;max-height:none;box-shadow:none;margin:var(--space-5) 0}.security-export-popup>header button{display:none}.security-export-popup-body{overflow:visible}}
@@ -98,7 +102,7 @@ body{overflow:auto;min-height:100vh}
 <header class="security-export-head"><div class="security-export-brand"><img src="${REPORT_ASSESSOR_LOGO}" alt="ASSESSOR Logo"><div><b>ASSESSOR</b><div>${esc(ASSESSOR_PRODUCT_VERSION)}</div></div><strong class="security-export-confidential">VERTRAULICH</strong></div>
 <h1>Security Export</h1><p>${esc(snapshot.client)} · ${esc(snapshot.assessments)}</p><h2>Datenstand und Versionen</h2>
 <dl class="security-export-versions">${pairs.map(([label, value]) => `<div><dt>${esc(label)}</dt><dd>${esc(value)}</dd></div>`).join('')}</dl>
-<p>Vollständige Security-Ansicht · Proportional an die Fensterbreite angepasst. Kategorien und Findings sind aufklappbar; Results und Originaltabellen öffnen als Popups.</p></header>
+<p>Vollständige Security-Ansicht · Schriftgrößen wie im Security-Panel. Kategorien und Findings sind aufklappbar; Results und Originaltabellen öffnen als Popups.</p></header>
 ${markup}<footer class="security-export-foot">VERTRAULICH · ${esc(snapshot.client)} · ASSESSOR ${esc(ASSESSOR_PRODUCT_VERSION)}</footer>
 </main>${popups}</body></html>`;
 }

tests/app/app-version.test.ts

@@ -9,7 +9,7 @@ const components = readFileSync(new URL('../../src/styles/components.css', impor
 
 describe('ASSESSOR version in the brand header', () => {
   it('shows the centrally maintained product version and opens About from the brand', () => {
-    expect(ASSESSOR_PRODUCT_VERSION).toBe('2.25.1');
+    expect(ASSESSOR_PRODUCT_VERSION).toBe('2.25.2');
     expect(app).toContain("'db-structure': 'Data Flow'");
     expect(app).toContain("['db-structure', 'Data Flow']");
     expect(app).not.toContain("'DB Structure'");

tests/features/security-html-export.test.tsx

@@ -92,7 +92,7 @@ describe.each(['light', 'dark'])('Complete Security HTML export (%s)', theme =>
       expect(report.querySelector('title')?.textContent).toContain('Synthetic <client>');
       expect(report.querySelector('.security-export-confidential')?.textContent).toBe('VERTRAULICH');
       expect(report.querySelector('img[alt="ASSESSOR Logo"]')?.getAttribute('src')).toMatch(/^data:image/);
-      expect(report.querySelector('style')?.textContent).toContain('width:2320px');
+      expect(report.querySelector('style')?.textContent).toContain('width:min(2320px,calc(100vw * 2 / 3))');
       expect(/minmax\(0,\s*2fr\)\s+minmax\(0,\s*1fr\)/.test(report.querySelector('style')?.textContent ?? '')).toBe(true);
       expect(report.querySelector('.client-security-remediation strong')?.textContent).toBe('2');
       expect(report.querySelectorAll('.client-security-group')).toHaveLength(panel.querySelectorAll('.client-security-group').length);
@@ -109,7 +109,13 @@ describe.each(['light', 'dark'])('Complete Security HTML export (%s)', theme =>
       expect(popup.getAttribute('popover')).toBe('auto'); expect(popup.getAttribute('role')).toBe('dialog');
       expect(popup.closest('.security-export')).toBeNull();
       expect(popup.querySelector('header')?.lastElementChild?.getAttribute('popovertargetaction')).toBe('hide');
-      expect(report.querySelector('style')?.textContent?.includes('zoom:min(1,calc(')).toBe(true);
+      const reportCss = report.querySelector('style')?.textContent ?? '';
+      expect(reportCss).not.toContain('zoom:');
+      expect(reportCss).toContain('.security-export-popup-body{overflow:auto;overscroll-behavior:contain;min-height:0;padding:var(--panel-inset);font-size:var(--type-table-body-size)}');
+      expect(reportCss).toContain('.client-security-map-scroll>svg{width:1280px;max-width:none}');
+      expect(reportCss).toContain('@container security-report (max-width:1800px)');
+      expect(reportCss).toContain('.security-export-popup .security-export-popup-body p');
+      expect(reportCss).toContain('.security-export-popup .security-export-popup-body dd');
       expect(report.querySelector('style')?.textContent?.includes('.triangle-icon-right { transform: rotate(180deg); }')).toBe(true);
       expect(report.querySelector('style')?.textContent?.includes('transform:rotate(-90deg)')).toBe(true);
       expect(exportedSvg.getAttribute('viewBox')).toBe(new DOMParser().parseFromString(originalSvg, 'text/html').querySelector('svg')!.getAttribute('viewBox'));

tests/reporting/security-view-report.test.ts

@@ -27,6 +27,10 @@ describe('Standalone Security view renderer', () => {
     expect(html).toContain('<div class="client-security-group-content" id="security-category-content-synthetic">');
     expect(html).toContain('overscroll-behavior:contain');
     expect(html).toContain('100vw * 2 / 3');
+    expect(html).not.toContain('zoom:');
+    expect(html).toContain('font-size:var(--type-table-body-size)');
+    expect(html).toContain('@container security-report (max-width:1800px)');
+    expect(html).toContain('.client-security-map-scroll>svg{width:1280px;max-width:none}');
     expect(html).toContain('html,body{background:var(--surface-panel)}');
     expect(html).toContain('grid-template-columns:repeat(5,minmax(0,1fr))');
     expect(html).toContain('aria-label="Maximize popup"');
@@ -51,7 +55,7 @@ describe('Standalone Security view renderer', () => {
       expect(html.includes(readFileSync(`src/styles/${file}.css`, 'utf8'))).toBe(true);
     }
     expect(html).toContain(snapshot.markup); expect(html).toContain('Synthetic &lt;client&gt;');
-    expect(html).toContain('width:1910px'); expect(html).toContain('VERTRAULICH');
+    expect(html).toContain('width:min(1910px,calc(100vw * 2 / 3))'); expect(html).toContain('VERTRAULICH');
     expect(html).toContain('data:font/woff2;base64,'); expect(html).toContain('data:image/png;base64,');
     expect(html).not.toMatch(/<script|<(?:img|link)\b[^>]*(?:src|href)=["']https?:/i);
     expect(JSON.stringify(snapshot)).toBe(before);

tests/server/assessor-http-server.test.ts

@@ -60,7 +60,7 @@ describe('local ASSESSOR HTTP server', () => {
 
     const health = await fetch(`${baseUrl}/api/v1/health`);
     expect(await health.json()).toEqual({
-      status: 'ok', application: 'ASSESSOR', productVersion: '2.25.1', apiVersion: 1, repositoryRevision: 0, persistence: 'memory'
+      status: 'ok', application: 'ASSESSOR', productVersion: '2.25.2', apiVersion: 1, repositoryRevision: 0, persistence: 'memory'
     });
     expect(health.headers.get('access-control-allow-origin')).toBeNull();
   });