From 772d853e379b35f4675e0ac5b89fee73e8a4365c Mon Sep 17 00:00:00 2001
From: Jacob Hagstedt <jacob.hagstedt@gmail.com>
Date: Sun, 14 Jun 2026 09:58:30 +0200
Subject: [PATCH] MVP frontend+backend

---
 .gitignore                                    |   3 +
 .graphifyignore                               |   4 +
 CLAUDE.md                                     | 190 ++++++
 JUNIOR_MVP_TODO.md                            | 123 ++++
 JUNIOR_styling_plan.md                        | 156 +++++
 SENIOR_MVP_TODO.md                            |  83 +++
 SENIOR_REPORT_3.md                            | 146 ++++
 backend/.env.example                          |  14 +
 backend/app/config.py                         |  10 +-
 backend/app/main.py                           |  52 +-
 backend/app/rate_limit.py                     |  10 +
 backend/app/routers/auth.py                   |  40 +-
 backend/app/routers/fetch_data.py             | 135 +++-
 backend/app/scrapers/fk_scraper.py            | 520 +++++++++++++-
 backend/migrations/env.py                     |   5 +-
 .../migrations/versions/001_initial_schema.py |  10 +-
 backend/pyproject.toml                        |   3 +
 backend/tests/unit/test_fk_scraper.py         | 644 ++++++++++++++++++
 backend/uv.lock                               |  63 +-
 data_refresh_plan.md                          | 268 ++++++++
 frontend/eslint.config.js                     |   2 +-
 frontend/package.json                         |  10 +-
 frontend/src/App.tsx                          |   4 +
 .../dashboard/ParentalLeaveBreakdown.test.tsx |  89 +++
 .../dashboard/ParentalLeaveBreakdown.tsx      |  77 +++
 .../src/components/layout/Header.test.tsx     |  72 +-
 frontend/src/components/layout/Header.tsx     |  95 ++-
 frontend/src/components/layout/Layout.tsx     |  28 +-
 frontend/src/components/layout/header.css     |  83 +++
 .../components/modals/QRCodeModal.test.tsx    | 223 ++++++
 .../src/components/modals/QRCodeModal.tsx     | 139 ++++
 frontend/src/context/AuthContext.tsx          |   8 +-
 frontend/src/context/WorkspaceContext.tsx     |  69 +-
 frontend/src/hooks/index.ts                   |   1 +
 frontend/src/hooks/useParentalLeave.test.ts   |  14 +-
 frontend/src/hooks/useParentalLeave.ts        |  11 +-
 frontend/src/hooks/usePlannedDays.test.ts     |  14 +-
 frontend/src/hooks/usePlannedDays.ts          |  13 +-
 frontend/src/hooks/useScraperFetch.test.ts    | 172 +++++
 frontend/src/hooks/useScraperFetch.ts         | 132 ++++
 frontend/src/pages/Auth.tsx                   |  16 +-
 frontend/src/pages/Calendar.tsx               |  11 +-
 frontend/src/pages/Dashboard.test.tsx         | 265 +++++++
 frontend/src/pages/Dashboard.tsx              | 153 ++++-
 frontend/src/pages/DevFetch.tsx               | 219 ++++++
 frontend/src/pages/Settings.tsx               | 179 ++++-
 frontend/src/pages/Tips.tsx                   |   2 +-
 frontend/src/services/api.ts                  | 147 +++-
 frontend/src/types/api.ts                     |   6 +-
 frontend_mvp_complete.md                      | 110 +++
 frontend_polish.md                            |  71 ++
 junior_mvp_report.md                          |  55 ++
 refine_login.md                               | 131 ++++
 refine_login_report.md                        | 164 +++++
 senior_mvp_report.md                          |  36 +
 todo-backend.txt                              |   6 +
 56 files changed, 5099 insertions(+), 207 deletions(-)
 create mode 100644 .graphifyignore
 create mode 100644 CLAUDE.md
 create mode 100644 JUNIOR_MVP_TODO.md
 create mode 100644 JUNIOR_styling_plan.md
 create mode 100644 SENIOR_MVP_TODO.md
 create mode 100644 SENIOR_REPORT_3.md
 create mode 100644 backend/.env.example
 create mode 100644 backend/app/rate_limit.py
 create mode 100644 backend/tests/unit/test_fk_scraper.py
 create mode 100644 data_refresh_plan.md
 create mode 100644 frontend/src/components/dashboard/ParentalLeaveBreakdown.test.tsx
 create mode 100644 frontend/src/components/dashboard/ParentalLeaveBreakdown.tsx
 create mode 100644 frontend/src/components/layout/header.css
 create mode 100644 frontend/src/components/modals/QRCodeModal.test.tsx
 create mode 100644 frontend/src/components/modals/QRCodeModal.tsx
 create mode 100644 frontend/src/hooks/useScraperFetch.test.ts
 create mode 100644 frontend/src/hooks/useScraperFetch.ts
 create mode 100644 frontend/src/pages/Dashboard.test.tsx
 create mode 100644 frontend/src/pages/DevFetch.tsx
 create mode 100644 frontend_mvp_complete.md
 create mode 100644 frontend_polish.md
 create mode 100644 junior_mvp_report.md
 create mode 100644 refine_login.md
 create mode 100644 refine_login_report.md
 create mode 100644 senior_mvp_report.md
 create mode 100644 todo-backend.txt

diff --git a/.gitignore b/.gitignore
index 55e7615..16b86a4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,6 +3,9 @@ __pycache__/
 *.py[codz]
 *$py.class
 
+graphify-out
+backend/debug
+
 # C extensions
 *.so
 
diff --git a/.graphifyignore b/.graphifyignore
new file mode 100644
index 0000000..3883dbe
--- /dev/null
+++ b/.graphifyignore
@@ -0,0 +1,4 @@
+node_modules/
+dist/
+*.generated.py
+*.pyc
diff --git a/CLAUDE.md b/CLAUDE.md
new file mode 100644
index 0000000..bec6c40
--- /dev/null
+++ b/CLAUDE.md
@@ -0,0 +1,190 @@
+# AGENTS.md
+
+Operating guide for humans and AI agents working in **Föräldraledigplannerare** — a web app for planning Swedish parental leave (alone or with a partner), folding in vacation days to optimize leave over time until the child turns 4 (after which only 96 days may be saved).
+
+This is a **full-stack monorepo**: a TypeScript/React/Vite frontend and a Python/FastAPI backend.
+
+---
+
+## 🛑 DIRECTORY NAVIGATION & FILE DISCOVERY
+
+**Context:** This repo contains massive generated/dependency folders (`node_modules`, `dist`, `build`, `.venv`/`venv`, `__pycache__`, `.mypy_cache`, `.ruff_cache`, `graphify-out`, etc.). Unrestricted file listings will bloat your context window, crash your session, and cause severe token waste.
+
+* **NEVER use `ls -R`:** This command is strictly forbidden in this repository.
+* **NEVER use `find` without `-maxdepth`:** Unbounded `find` crawls dependency trees just like `ls -R`. Always add `-maxdepth 3` or tighter.
+* **Primary Discovery:** To map out files or explore the project tree, **ALWAYS use `git ls-files`**. This is your default command and ensures you only interact with human-written source code.
+* **Structural Context:** If you explicitly need a visual directory layout to understand architecture, use `tree` with the mandatory ignore flags:
+
+  ```bash
+  tree -I 'node_modules|.git|dist|build|__pycache__|venv|.venv|env|.pytest_cache|.mypy_cache|.ruff_cache|graphify-out|*.egg-info'
+  ```
+
+* **Searching Code:** To search for text or code across the repo, **ALWAYS use `git grep "search_term"`** instead of `grep -r` to avoid crawling ignored or minified assets.
+* **NEVER** go outside the current directory; always use relative paths based on "here".
+
+---
+
+## graphify
+
+This project has a knowledge graph at `graphify-out/` with god nodes, community structure, and cross-file relationships.
+
+When the user types `/graphify`, invoke the `skill` tool with `skill: "graphify"` before doing anything else.
+
+Rules:
+
+* For codebase questions, first run `graphify query "<question>"` when `graphify-out/graph.json` exists. Use `graphify path "<A>" "<B>"` for relationships and `graphify explain "<concept>"` for focused concepts. These return a scoped subgraph, usually much smaller than `GRAPH_REPORT.md` or raw grep output.
+* Dirty `graphify-out/` files are expected after hooks or incremental updates; dirty graph files are not a reason to skip graphify. Only skip graphify if the task is about stale or incorrect graph output, or the user explicitly says not to use it.
+* If `graphify-out/wiki/index.md` exists, use it for broad navigation instead of raw source browsing.
+* Read `graphify-out/GRAPH_REPORT.md` only for broad architecture review or when query/path/explain do not surface enough context.
+* After modifying code, run `graphify update .` to keep the graph current (AST-only, no API cost).
+
+---
+
+## QUICK START
+
+The frontend `package.json` orchestrates both services. From `frontend/`:
+
+```bash
+npm install              # install frontend deps
+npm run dev              # runs BOTH: FastAPI (:8000) + Vite dev server concurrently
+```
+
+Backend can also be run on its own. From `backend/`:
+
+```bash
+uv sync                                              # install deps incl. dev group
+uv run uvicorn app.main:app --reload --port 8000     # serve API
+```
+
+The scraper (FK login flow via Playwright) is **off by default**. To exercise it locally, use `npm run login` from `frontend/`, which sets `APP_SCRAPER_ENABLED=true APP_SCRAPER_HEADLESS=true`. Chromium must be installed separately: `uv run playwright install chromium`.
+
+---
+
+## REPOSITORY LAYOUT
+
+```
+backend/                 Python 3.14 · FastAPI · uv (Hatchling build backend)
+  app/
+    entities/            Persistence-layer row shapes (DB-facing)
+    models/              Pydantic v2 request/response schemas (API-facing)
+    repositories/        Abstract repository interfaces
+    repositories_impl/
+      sqlite/            Default aiosqlite implementations
+      postgres/          Optional asyncpg implementations (extra: `postgres`)
+    routers/             FastAPI route handlers (thin)
+    services/            Business logic (planning, tips, analytics, auth, …)
+    scrapers/            Försäkringskassan (FK) scraper — Playwright
+    utils/               dates, holidays, errors, tip predicates
+    db/                  Connection management
+  migrations/            Alembic migrations (NOT auto-generated from ORM models)
+  tests/                 pytest + pytest-asyncio (asyncio_mode = auto)
+
+frontend/                TypeScript · React 18.3 · Vite 5 · Vitest
+  src/
+    pages/               Route-level screens (Dashboard, Calendar, Settings, …)
+    components/          Presentational + composite components (BEM CSS classes)
+    hooks/               Data-fetching/state hooks (the data layer — no TanStack Query)
+    services/            api.ts (HTTP client) + errors.ts
+    context/             Auth + Workspace React context
+    types/               Shared TS types (api.ts, entities.ts)
+    utils/               dates, formatting
+  tests/                 Vitest setup + fixtures; co-located *.test.tsx also used
+
+.github/workflows/       CI (GitHub Actions) — backend + frontend gates
+```
+
+**Layering rule (backend):** `routers` call `services`; `services` call `repositories` (the abstract interface). Concrete DB code lives only in `repositories_impl/`. Keep routers thin and put business logic in services. Don't reach across layers (e.g. a router talking directly to `repositories_impl`).
+
+**Data layer (frontend):** components consume `src/hooks/*`, which call `src/services/api.ts`. Components should not call `fetch`/the API client directly.
+
+---
+
+## CONVENTIONS
+
+* **Backend stack:** FastAPI + Pydantic v2 (request/response models) with a **hand-rolled repository pattern** — abstract interfaces in `app/repositories/`, concrete implementations in `app/repositories_impl/{sqlite,postgres}/`. There is **no ORM** (no SQLModel, no SQLAlchemy models). SQLite via **async `aiosqlite`** is the default; Postgres via `asyncpg` is an optional extra.
+* **Migrations:** Alembic (`backend/migrations/`, config `backend/alembic.ini`). Migrations are written by hand against the schema — they are not generated from ORM metadata. Add a new revision when you change the schema.
+* **Auth:** password hashing with `argon2-cffi`, sessions/tokens with `PyJWT`. Rate limiting via `slowapi`.
+* **Python:** `>=3.14` required. Managed via **`uv`** with the **Hatchling** build backend. Lint/format with **`ruff`** (line length 100, target `py314`). Tests with **`pytest` + `pytest-asyncio`** (`asyncio_mode = "auto"`, so no `@pytest.mark.asyncio` needed).
+* **Frontend stack:** **React 18.3**, **react-router-dom v6** (`BrowserRouter`/`Routes`/`Route`), **TypeScript 5.6**, **Vite 5**, **Vitest** + Testing Library. State/data fetching is done with **custom hooks** in `src/hooks/` (no TanStack Query, no Redux).
+* **Styling:** plain CSS using **BEM-style class names** (e.g. `calendar-day__number`, `calendar-day--disabled`). There is **no CSS framework** (no Tailwind) and no CSS-in-JS. Match the conventions in existing components before inventing new ones.
+* **Linting:** ESLint **is** configured (flat config, `frontend/eslint.config.js`, ESLint 9). `@typescript-eslint/no-explicit-any` is an **error**. CI runs `npm run lint` with `--max-warnings 0` — zero warnings allowed.
+* **Scripts:** any backend helper scripts must be placed explicitly in `backend/scripts/` (create the folder if needed). Frontend scripts go through `package.json`.
+* **CI/CD:** Deployment/CI is managed via **GitHub Actions** (`.github/workflows/`). Do **not** introduce `.gitea/`, `.gitlab-ci.yml`, or `Makefile`s — extend the existing GitHub workflow instead.
+
+---
+
+## TESTS, LINT & CI GATES
+
+Run the same checks CI runs before pushing.
+
+**Backend** (from `backend/`):
+
+```bash
+uv run ruff check .              # lint
+uv run ruff format --check .     # format check
+uv run pytest                    # tests with coverage (config in pyproject.toml)
+```
+
+CI gate: `--cov-fail-under=50` today, climbing toward **90** as tests land. Don't lower it.
+
+**Frontend** (from `frontend/`):
+
+```bash
+npx tsc --noEmit                 # type check
+npm run lint                     # ESLint, zero warnings
+npm run coverage                 # Vitest with coverage
+```
+
+CI gate: **90%** coverage on the frontend.
+
+---
+
+## ANTI-PATTERNS (CRITICAL GUARDRAILS)
+
+* **Type Safety (TS):** No type suppression — no `as any`, `@ts-ignore`, or `@ts-expect-error`. `no-explicit-any` is an ESLint error and CI fails on warnings.
+* **Type Safety (Python):** No bare `# type: ignore` to silence the type checker; fix the underlying type or model instead. Prefer precise Pydantic models over `dict[str, Any]` at API boundaries.
+* **Error Handling:** No empty `catch`/`except` blocks. Explicit handling/logging is required. Backend errors should flow through `app/utils/errors.py`; frontend errors through `src/services/errors.ts`.
+* **Testing Integrity:** NEVER delete or comment out failing tests to make a suite "pass". Fix the code, or update the test properly with a clear reason.
+* **No JS Slop (frontend):** NEVER create `.js`/`.jsx` files in the frontend. Use only TypeScript (`.ts`, `.tsx`).
+* **Respect the layering:** routers don't talk to `repositories_impl` directly; components don't call `fetch` directly. Go through services / hooks.
+* **No ORM creep:** don't add SQLModel/SQLAlchemy models — extend the existing repository pattern.
+* **Assumption Error:** NEVER assume the contents of ANY file. ALWAYS read the target file to confirm its structure and implementation before modifying or referencing it.
+
+---
+
+## MANDATORY EXECUTION PROTOCOLS
+
+* **Read Before Edit:** ALWAYS read the entire target file before performing any edit.
+* **Post-Edit Verification:** Immediately after an edit, verify that no lines were duplicated and imports are intact.
+* **Stability Check:** Following any code change, run the relevant side's checks above (lint + type check + tests). For cross-cutting changes (e.g. API contract edits in `app/models` and `src/types`), run **both** backend and frontend suites — they must agree on the wire format.
+* **Keep the graph current:** after modifying code, run `graphify update .`.
+
+---
+
+## DOMAIN RULES (Swedish parental leave)
+
+Useful context so calculations and UI copy stay correct:
+
+* **390 + 90 model:** of the parental-benefit days, 390 are sickness-benefit-level and 90 are at the minimum (lägstanivå) rate. Track day *types*, not just a single total.
+* **Reserved days:** a portion of days is reserved per parent and cannot be transferred to the partner — surface this in shared/partner planning.
+* **Dubbeldagar (double days):** both parents can take leave on the same day for a limited number of days early in the child's life; model these as consuming each parent's balance.
+* **No partial days:** the planner works in **whole days** — do not introduce fractional/percentage days in the model.
+* **The age-4 cutoff:** the core purpose is optimizing leave over time. After the child turns **4**, only **96 days** may be saved; the planner must show how many days remain at that boundary.
+* **Money/SGI is abstracted:** the app treats benefit amounts/SGI abstractly rather than computing exact kronor payouts — keep money handling at the agreed abstraction level rather than hardcoding rates.
+
+When in doubt about a rule, ask before encoding a number — Swedish parental-leave rules change and incorrect figures are worse than a TODO.
+
+---
+
+## WHERE TO LOOK FIRST
+
+* `ARCHITECTURE.md` — system design and rationale.
+* `graphify-out/wiki/index.md` — generated navigation over the codebase.
+* `backend/README.md` — backend-specific setup notes.
+* The various `*_REPORT.md` / `*_TODO.md` / `*_ONBOARDING.md` files at the root are working handoff notes between contributors; treat them as **historical context**, not authoritative spec.
+
+---
+
+## OUTPUTS
+
+Be concise: skip preamble, caveats, and restating the request. Use sentence fragments and short bullet points where clarity isn't lost. Explain reasoning only when it aids debugging or isn't obvious from the code/diff itself.
diff --git a/JUNIOR_MVP_TODO.md b/JUNIOR_MVP_TODO.md
new file mode 100644
index 0000000..c47f24e
--- /dev/null
+++ b/JUNIOR_MVP_TODO.md
@@ -0,0 +1,123 @@
+# Junior Developer — MVP Happy-Path TODO
+
+**Owner:** Junior developer
+**Status:** Ready to implement
+**Goal:** Make the core happy path work end-to-end: **register → land logged-in on the overview → log in → land on the overview → register a child → see the overview → fetch the child's data from Försäkringskassan.**
+**Date:** 2026-06-12
+
+> **Context:** The backend is in good shape and the FK scraper is now implemented (Playwright, real captured selectors). The breakages are almost all in **frontend wiring**. FK scraping is now legally cleared, so the overview's day numbers should come from the scraper.
+>
+> **Do NOT undo or rewrite** the scraper (`backend/app/scrapers/fk_scraper.py`), its captured selectors, or the `FetchDataService` contract. Reuse what exists.
+>
+> Work top-to-bottom; tasks are ordered so each unblocks the next. Run `npx tsc --noEmit` and `npm run lint` after each task — keep them green.
+
+---
+
+## J1 — Redirect after login & register *(the #1 visible bug)*
+
+**Problem:** `pages/Auth.tsx` calls `login()` / `register()`, which *do* authenticate you (AuthContext sets `isAuthenticated: true`), but the page never navigates, and nothing bounces an already-authenticated user off `/auth`. So you're silently logged in but stuck on the form — this is why "after registering I'm not logged in" and "login doesn't take me anywhere."
+
+**Do:**
+- In `pages/Auth.tsx`, after a successful `login`/`register`, navigate to `/` (use `useNavigate()` from `react-router-dom`, `navigate('/', { replace: true })`).
+- Also guard `/auth` itself: if `isAuthenticated` is already true, redirect to `/`. Either inside `Auth.tsx` (early `<Navigate to="/" replace />`) or in `App.tsx`'s `/auth` route. This handles the "I manually went to /auth while logged in" case cleanly.
+
+**Acceptance:**
+- Registering a brand-new account lands you on the dashboard, logged in, with no manual navigation.
+- Logging in lands you on the dashboard.
+- Visiting `/auth` while logged in redirects to `/`.
+
+---
+
+## J2 — Bootstrap the workspace after auth *(why the dashboard is empty)*
+
+**Problem:** `context/WorkspaceContext.tsx` only reads `workspaceId` from `localStorage`, which **nothing ever sets**. So after login there is no workspace → the dashboard shows defaults. The backend already exposes everything you need at **`GET /api/auth/context`** (`api.getUserContext()`), which returns `{ personal_data_uuid, workspace_id, children[] }`.
+
+**Do:**
+- When the user becomes authenticated, call `api.getUserContext()` and use its `workspace_id` to drive `WorkspaceContext` (set it via the existing `setWorkspaceId`, and keep persisting to `localStorage` is fine as a cache — just don't *depend* on it being pre-populated).
+- Expose the **children** and a **`selectedChildId`** from context (or a small `ChildContext`). For MVP, **auto-select the first child** if any exist. Add a `selectChild(id)` setter for later.
+- Also expose `personal_data_uuid` (the overview + FK fetch need it).
+- Re-fetch context after creating a child (see J4) so the new child appears and gets selected.
+
+**Acceptance:**
+- After logging in (fresh browser, empty localStorage), the dashboard loads the user's workspace automatically.
+- If the workspace has a child, it's auto-selected and the overview renders for it.
+
+*(Senior will review this context seam — keep the change small and readable.)*
+
+---
+
+## J3 — Fix the broken API client paths *(several calls 404 today)*
+
+**Problem:** `services/api.ts` invents `/workspaces/{id}/…` REST paths that **do not exist** on the backend. Confirmed mismatches:
+
+| `api.ts` call (wrong) | Real backend route |
+|---|---|
+| `GET /workspaces/{id}/break-periods` | prefix is `/api/break-periods` (see `routers/break_periods.py` + `routers/settings.py`) |
+| `POST /workspaces/{id}/break-periods` | `/api/break-periods` |
+| `GET /workspaces/{id}/tips` | `/api/tips/{workspace_id}` (prefix `/api/tips`, see `routers/settings.py`) |
+| `GET /workspaces/{id}/planned-days` | prefix `/api/planned-days` (see `routers/planned_days.py`) |
+| `POST /workspaces/{id}/planned-days` | `/api/planned-days` |
+| `GET /workspaces/{id}/parental-leave` | `/api/parental-leave/{personal_data_uuid}/{child_id}` — **different shape; see note** |
+
+**Do:**
+- Open `backend/app/routers/*.py`, read the **actual** `@router` decorators under each prefix, and correct each path + its params/body in `api.ts`. The analytics overview path (`/analytics/{ws}/overview?child_id=…`) is already correct — use it as your reference for "right".
+- For **parental-leave**, the backend route needs `personal_data_uuid` + `child_id`, not a workspace id. **Don't guess** — the senior is adding/clarifying a workspace-friendly read route (Senior task S2). Until that lands, wire `getParentalLeave` to the contract the senior specifies (likely `/api/parental-leave/{personal_data_uuid}/{child_id}` using the IDs from context). Coordinate; don't invent a path.
+
+**Acceptance:**
+- No 404s in the network tab when the dashboard loads.
+- `tsc`/lint green; existing hook tests updated to the corrected paths and passing.
+
+---
+
+## J4 — Child registration on the overview *(empty-state happy path)*
+
+**Problem:** There's no way to add a child from the overview. The pieces exist: `api.createChild()` → `POST /api/children`, and the `ChildBirthdayInput` component.
+
+**Do:**
+- On the Dashboard, when the selected workspace has **no children**, render an empty state with an **"Lägg till barn"** form (reuse `ChildBirthdayInput`; collect name + birth date).
+- On submit: call `api.createChild({ workspace_id, name, birth_date })`, then re-fetch context (J2) so the child appears and is auto-selected, and the overview re-renders for it.
+- Show a clear success/error message; disable the submit button while in flight.
+- Keep it simple — one child is enough for MVP. A child switcher can come later.
+
+**Acceptance:**
+- A freshly registered user sees "no child yet → add one", can add a child, and immediately sees the overview populate for that child.
+
+---
+
+## J5 — "Hämta från Försäkringskassan" on the overview
+
+**Problem:** The FK fetch flow currently only lives in the dev harness (`pages/DevFetch.tsx`). The real overview should let the user pull their data for the selected child.
+
+**Do:**
+- Extract the harness's session logic (start → poll every ~1s → render QR `data:image/png;base64,…` → show result/error → cancel) out of `DevFetch.tsx` into a **reusable hook** (e.g. `useScraperFetch`) and a small **`QRCodeModal`** component. `DevFetch` should then use these too (don't duplicate).
+- On the Dashboard, add a **"Hämta från Försäkringskassan"** button (enabled only when a child is selected). Clicking it opens the `QRCodeModal`, starts a session (the backend auto-resolves IDs from the logged-in user — send an empty body, or pass the selected `child_id`), shows the live QR, and on `done` closes the modal and **refreshes the overview** (re-fetch parental-leave for the selected child).
+- Handle the readable error states the backend can return (e.g. "No child in workspace — add one before fetching"). Show the message; don't crash.
+
+**Acceptance:**
+- From the overview, clicking the button shows the BankID QR, and after a successful scan the overview updates with the fetched numbers.
+
+> Depends on Senior **S1** (persist the scraped snapshot) for the refreshed read to actually return data. You can build and demo the modal/QR against the live `done` result before S1 lands; full overview refresh works once S1 is in.
+
+---
+
+## J6 — Small dev-harness auth fix *(stop the bare "Not authenticated")*
+
+**Problem:** `npm run login` opens `/dev/fetch` directly. The auth token lives only in memory after an app login, so opening the harness cold makes `getUserContext()` / `start` return **"Not authenticated"** with no guidance.
+
+**Do (minimal):**
+- In `pages/DevFetch.tsx`, when `getUserContext()` (or any scraper call) returns a 401/unauthorized, render a friendly banner with a **"Logga in först"** link to `/auth` (use `isUnauthorized` from `services/errors.ts`). Optionally auto-redirect to `/auth` and back.
+- Keep the existing dev-only mount and the "real BankID" warning. This is a small UX fix, not a redesign.
+
+**Acceptance:**
+- Opening `/dev/fetch` while logged out shows a clear "log in first" link instead of a raw error. After logging in (J1 now redirects properly), the harness works.
+
+---
+
+## Definition of done (the demo to run)
+1. Register a new account → you land on the dashboard, logged in.
+2. Dashboard shows the empty state → add a child → overview renders for that child.
+3. Click "Hämta från Försäkringskassan" → scan QR → overview updates with FK numbers.
+4. Log out, log back in → you land on the dashboard with the child still there.
+5. `npx tsc --noEmit`, `npm run lint`, `npm test` all green.
+
+**Escalate to senior** (don't guess): the parental-leave read contract (J3/S2), and anything about how/where scraped data is persisted (S1).
diff --git a/JUNIOR_styling_plan.md b/JUNIOR_styling_plan.md
new file mode 100644
index 0000000..de7e8e9
--- /dev/null
+++ b/JUNIOR_styling_plan.md
@@ -0,0 +1,156 @@
+# Junior Developer — Styling Plan
+
+**Owner:** Junior developer (the filename says it — this is frontend craft, not backend)
+**Status:** Ready to implement (best **after** `frontend_mvp_complete.md` Tier 1, so the header/nav exist to style; the foundation in S1 can start anytime)
+**Goal:** Turn the unstyled MVP into a calm, trustworthy, readable app — without rewriting components.
+
+> **Big win you already have:** every component uses consistent BEM-style class names (`dashboard__section`, `calendar__grid`, `progress-chart__fill`, `settings-page__message--success`, …) but there is **no CSS at all** and nothing is imported. So you can style the *entire* app from stylesheets keyed to those existing classes with **almost zero JSX changes**. Don't refactor markup to style it — write CSS that targets what's there.
+
+---
+
+## S0 — Decisions (don't introduce a new build dependency)
+
+- **Use plain CSS with design tokens (CSS custom properties).** ARCHITECTURE already anticipates `src/styles/global.css` + `src/styles/components.module.css`. Match that.
+- **Do NOT add Tailwind / styled-components / a UI kit** mid-MVP. They'd mean rewriting every `className` and adding build config — high churn, no payoff right now. (If the team later wants a framework, that's a separate, deliberate migration.)
+- Keep it light: one global stylesheet for tokens + base + layout + shared component classes. Reach for CSS Modules (`*.module.css`) only if a component needs scoping that the BEM names don't already give you.
+- **Tone:** this app touches family + money, so aim for *calm and reassuring*, not flashy — generous whitespace, soft neutral background, one trustworthy accent color, clear hierarchy. ARCHITECTURE calls the calendar "Google Calendar-like," so use that as the visual north star for the calendar.
+
+---
+
+## S1 — Foundation: tokens, reset, typography
+
+**Create `src/styles/global.css` and import it once** at the top of `src/main.tsx` (`import './styles/global.css'`).
+
+**Define design tokens** as CSS variables on `:root` so everything else references them (change once, update everywhere). Starter set — tune the palette to taste:
+
+```css
+:root {
+  /* Color */
+  --c-bg: #f7f8fa;
+  --c-surface: #ffffff;
+  --c-border: #e3e6eb;
+  --c-text: #1c2733;
+  --c-text-muted: #5b6675;
+  --c-accent: #2f6f4f;        /* calm green — trustworthy, on-brand for "leave/time at home" */
+  --c-accent-weak: #e8f1ec;
+  --c-danger: #b3261e;
+  --c-danger-weak: #fdeceb;
+  --c-success: #1e7d4f;
+  --c-success-weak: #e7f4ec;
+  --c-warning: #8a6d1f;
+
+  /* Spacing scale (8px base) */
+  --sp-1: 4px; --sp-2: 8px; --sp-3: 12px; --sp-4: 16px;
+  --sp-5: 24px; --sp-6: 32px; --sp-8: 48px;
+
+  /* Type scale */
+  --fs-sm: 0.875rem; --fs-base: 1rem; --fs-lg: 1.25rem;
+  --fs-xl: 1.5rem; --fs-2xl: 2rem;
+  --lh: 1.5;
+
+  /* Shape & depth */
+  --radius: 8px;
+  --shadow-sm: 0 1px 2px rgba(16,24,40,0.06);
+  --shadow-md: 0 4px 12px rgba(16,24,40,0.08);
+
+  --maxw: 960px;             /* content column width */
+  color-scheme: light;
+}
+```
+
+Then a small reset + base: `*, *::before, *::after { box-sizing: border-box }`, zero default margins, set `body { font-family: system-ui, -apple-system, "Segoe UI", Roboto, sans-serif; background: var(--c-bg); color: var(--c-text); line-height: var(--lh); }`, a sensible type scale on `h1–h3`, and a centered content container.
+
+**Acceptance:** importing one file visibly transforms the whole app — proper font, background, spacing, readable headings — with no component edits.
+
+---
+
+## S2 — App shell: header, nav, footer, page container
+
+Targets the layout classes (`[data-testid="layout"]`, `[data-testid="header"]`, `header-nav`, `[data-testid="footer"]`, `.dashboard`, `.settings-page`, etc.) and the header built in `frontend_mvp_complete.md` T1.1.
+
+**Do:**
+- Sticky top header: app name/title left, primary nav center/right (Översikt / Kalender / Tips / Inställningar), and the user + child selector + "Logga ut" on the far right. Give the **active nav link** a clear state (use `NavLink`'s active class).
+- Style the **child selector** as a clean dropdown so "which child am I viewing" reads at a glance.
+- Constrain main content to `--maxw`, centered, with comfortable page padding.
+- Quiet footer (muted text, top border).
+- Make every page sit inside this shell consistently (Layout already wraps them).
+
+**Acceptance:** A coherent top bar on every page with obvious current-page, current-child, and logout; content is centered and comfortably padded.
+
+---
+
+## S3 — Cards, sections, metrics, tables
+
+Targets `.dashboard__section`, `[data-testid="overview-metrics"]`, `.days-breakdown__table`, `.dashboard__break-list/__break-item`.
+
+**Do:**
+- Turn each `dashboard__section` / `settings-page__section` into a **card**: `background: var(--c-surface)`, `border: 1px solid var(--c-border)`, `border-radius: var(--radius)`, padding `--sp-5`, `box-shadow: var(--shadow-sm)`, vertical rhythm between cards.
+- **Overview metrics:** lay the metric list out as a responsive row of stat blocks — big number (`--fs-2xl`, accent or bold), small muted label beneath. This is the hero of the dashboard; make the numbers legible.
+- **Tables** (`days-breakdown__table`): full width, subtle row separators, padded cells, muted bold header row, right-align numeric columns.
+- Style the **provenance/freshness line** from polish P1 as small muted text.
+
+**Acceptance:** The dashboard reads as a set of clean cards; the key day numbers stand out; tables are tidy.
+
+---
+
+## S4 — Buttons, forms, inputs, messages
+
+Targets `.form-group`, `.error-message`, `.settings-page__message--success/--error`, `.parent-profile-input*`, `.planning-goal-selector*`, `.break-periods-input*`, `.vacation-days-input` (and the bare `<button>`s on the dashboard).
+
+**Do:**
+- A shared button style: primary (accent bg, white text), secondary/ghost (border, surface bg), and a disabled state (the FK button is disabled until a child is selected — make that visually obvious). Add `:hover`, `:active`, and a visible `:focus-visible` outline.
+- Inputs/selects: consistent height, padding, border, radius; clear `:focus` ring using the accent; label spacing via `.form-group`.
+- Message banners: `--success-weak`/`--danger-weak` backgrounds with matching text + a left accent border. Style `error-message` and the settings save messages.
+- Fieldsets (planning goal, parent profile) as labeled groups with breathing room.
+
+**Acceptance:** All buttons/inputs share one consistent look; success/error feedback is color-coded and unmistakable; focus states are visible for keyboard users.
+
+---
+
+## S5 — Calendar (the "Google Calendar-like" view)
+
+Targets `.calendar`, `.calendar__header`, `.calendar__grid`, `.calendar__weekday`, `.calendar-day*`, `.calendar-event*`, `.calendar__legend*`.
+
+**Do:**
+- `calendar__grid` as a **7-column CSS grid** with square-ish day cells, thin borders, day number top-left, room for event chips below.
+- Distinguish **current month vs. adjacent**, **today** (accent ring/dot), and **weekends/red days** (subtle tint).
+- **Event chips** (`calendar-event`) color-coded by leave type — define a token per type and reuse the same colors in the legend so they match: e.g. `--type-sjukpenning`, `--type-lagsta`, `--type-vacation`, plus a marker for dubbeldagar. Keep chips compact and readable.
+- Month nav header (prev/next + month label) styled as a clean toolbar.
+- Legend as small labeled swatches.
+
+**Acceptance:** The calendar looks like a familiar month calendar; leave types are color-coded consistently between cells and legend; today/weekends/other-month are visually distinct.
+
+---
+
+## S6 — Modal & loading states
+
+Targets the `QRCodeModal` (built in the MVP rounds) and `LoadingSpinner`.
+
+**Do:**
+- Modal: centered card over a dimmed full-screen overlay (`position: fixed`, semi-transparent backdrop), `--shadow-md`, max-width, padding; the **QR image sized large and crisp** (don't let it blur — it must be scannable); clear status text and a cancel/close button. Disable/hide close while a session is running (the component already gates this).
+- Spinner: simple CSS keyframe spinner using the accent, with the muted message beneath, centered in the content area.
+
+**Acceptance:** The FK fetch modal looks intentional and the QR is comfortably scannable; loading states are centered and calm.
+
+---
+
+## S7 — Responsive & accessibility pass
+
+**Do:**
+- One mobile breakpoint (~640px): header nav collapses to a simple stacked/wrapped layout; metric row and form grids stack to one column; calendar stays usable (allow horizontal scroll or shrink cells — don't break the 7-column grid).
+- A11y: ensure text/background contrast meets WCAG AA (check the accent on white and white on accent), keep a visible `:focus-visible` outline everywhere, and respect `@media (prefers-reduced-motion: reduce)` by disabling the spinner/transition animations.
+
+**Acceptance:** Usable on a narrow viewport without horizontal chaos; keyboard focus is always visible; contrast passes AA; reduced-motion is honored.
+
+---
+
+## Sequencing & guardrails
+1. **S1 → S2 → S3 → S4** give the biggest visible lift fastest (foundation + shell + cards + controls).
+2. **S5 (calendar)** is the most involved; do it once `frontend_mvp_complete.md` T2.1 has the calendar interactive.
+3. **S6, S7** finish it off.
+
+- **Don't change component markup or `data-testid`s** to style — tests rely on them. Style via the existing classes; only add a `className` where one is genuinely missing.
+- Keep all colors/spacing referencing the **tokens** from S1 — no hardcoded hex scattered through the file.
+- After each section: `npm run lint`, `npm test` (should stay green — CSS shouldn't break tests; if a test asserts on inline styles, reconcile), and eyeball the page.
+
+**Out of scope:** dark mode, animations beyond basic transitions, a component-library migration, custom fonts/branding assets — all separate later passes if desired.
diff --git a/SENIOR_MVP_TODO.md b/SENIOR_MVP_TODO.md
new file mode 100644
index 0000000..d9aa32e
--- /dev/null
+++ b/SENIOR_MVP_TODO.md
@@ -0,0 +1,83 @@
+# Senior Developer — MVP Happy-Path TODO
+
+**Owner:** Senior developer
+**Status:** Ready to implement
+**Goal:** Make the FK-scraped data actually flow into the overview, and own the contract/config/integration decisions the junior can't make alone.
+**Date:** 2026-06-12
+
+> **Context:** The happy path is mostly frontend wiring (delegated to the junior — see `JUNIOR_MVP_TODO.md`). FK scraping is now legally cleared and the scraper itself is implemented (`backend/app/scrapers/fk_scraper.py`, Playwright, real captured selectors). Your job is the few things that need backend seniority: **persisting scraped data, the read contract, enabling the scraper safely, and the end-to-end review.**
+>
+> **Preserve** the existing scraper implementation, captured selectors (`_SEL`), and the `FetchDataService` contract. Don't rewrite them.
+
+---
+
+## S1 — Persist the scraped snapshot *(the critical gap)*
+
+**Problem:** The scraper is **write-only and never writes**. `FKScraperService.get_latest` / `list_history` raise `NotImplementedError` (`fk_scraper.py:117-125`), and a finished session only sets `state.result` in memory and returns it in the `poll` response (`fk_scraper.py:162-163`). Nothing persists a `ParentalLeaveFetch(source='scraped')` to the DB. So once the session ends, the dashboard's read (`get_latest` via `ManualFetchService`) returns nothing — the overview can never show scraped data after the fact.
+
+**Do:**
+- When a session reaches `done` (after `_do_extract` builds the `ParentalLeaveFetch`, `fk_scraper.py:273-290`), **persist it via `ParentalLeaveRepository`** so subsequent reads return it. `ManualFetchService` already shows the create/validate shape — reuse the same repo + invariants (`days_left >= 0`, `reserved_days_left <= reserved_days_total`).
+- **The hard part is DB access from the background asyncio task.** The session runs in a detached `asyncio.create_task(_run_session(...))` (`fk_scraper.py:145`), outside the request scope, so it has no `ConnectionDep`. The app uses a single process-wide `aiosqlite` connection on `app.state.db_connection` (`dependencies.py:get_connection`). Decide and implement a clean approach, e.g.:
+  - pass a repository (or a connection/factory) into `start_session()` from the router (which *does* have `ParentalLeaveRepositoryDep`), and hand it down to the session state; **or**
+  - inject a small persistence callback.
+  - Mind aiosqlite concurrency: a single shared connection serializes; confirm a long-running background task writing mid-session doesn't deadlock or race the request handlers. If it's risky, open a short-lived dedicated connection for the write.
+- Validate before persisting; on invariant violation set status `error` with a message (don't persist garbage) — consistent with `data_refresh_plan.md §2`.
+- Keep the "never persist cookies/session/QR" rule intact — this persists only the **extracted numbers**.
+
+**Acceptance:**
+- After a successful scrape for (personal_data_uuid, child_id), a read returns the freshly scraped `ParentalLeaveFetch` with `source='scraped'`.
+- A new integration test covers: run a session to `done` (scraper internals mocked) → row is persisted → read returns it.
+
+---
+
+## S2 — Reconcile the parental-leave read contract for the overview
+
+**Problem:** The frontend wants a workspace-centric read, but the backend route is `GET /api/parental-leave/{personal_data_uuid}/{child_id}` (`routers/fetch_data.py`). The junior's `getParentalLeave('/workspaces/{id}/parental-leave')` is wrong on both prefix and shape.
+
+**Do:**
+- Pick one and implement it, then tell the junior the exact path/params for `api.ts`:
+  - **Option A (recommended):** keep the existing per-(personal_data_uuid, child_id) route; the frontend already has both IDs from `/auth/context` + selected child. Just correct the client path. Least backend change.
+  - **Option B:** add a convenience route `GET /api/parental-leave/workspace/{workspace_id}/{child_id}` that resolves the caller's `personal_data_uuid` from `CurrentUserDep`. Nicer for the client, small addition.
+- Whichever you choose, make sure it returns the **latest** snapshot regardless of `source` ('scraped' or 'manual') so S1's data shows up.
+
+**Acceptance:**
+- The overview can fetch the latest parental-leave for the selected child via a route that actually exists, and it returns scraped data after S1.
+- The chosen path is written down for the junior (J3 depends on it).
+
+---
+
+## S3 — Enable the scraper for the real app (legal gate cleared)
+
+**Problem:** `settings.scraper_enabled` defaults to `False` and the endpoints 501 when off (`routers/fetch_data.py`). `npm run login` flips it for the dev harness only — so the *real* app overview can't start a fetch. Legal sign-off is now done (confirmed by product owner).
+
+**Do:**
+- Make `scraper_enabled` **env-controlled and on for the running app** (e.g. default stays conservative but the deployed/dev env sets `SCRAPER_ENABLED=true`), so J5's overview button works outside the harness. Keep it a single switch.
+- Update the now-stale "DO NOT SHIP / pending legal review" comments in `fk_scraper.py` and `fetch_data.py` to reflect that legal has cleared, **but keep the operational guardrails**: sandboxed browser, no credential/session/QR persistence, no personal data in logs, per-session user consent (`ARCHITECTURE.md §2.3`).
+- Confirm `playwright install chromium` is documented/run wherever the backend runs (browser binaries aren't in the lockfile).
+
+**Acceptance:**
+- Starting a fetch from the real app (not just `/dev/fetch`) reaches the QR step.
+- Guardrail comments are accurate; no secrets/PII logged.
+
+---
+
+## S4 — End-to-end smoke test + review the junior's seams
+
+**Do (once J1–J5 land):**
+- Walk the full happy path in a browser: register → land on dashboard → add child → "Hämta från Försäkringskassan" → scan → overview shows scraped numbers → logout → login → still there.
+- Review the junior's **workspace bootstrap** (J2: `/auth/context` → `WorkspaceContext`, selected-child state) and the **`QRCodeModal`/`useScraperFetch`** extraction (J5) for correctness and for not leaking the in-memory token anywhere it shouldn't go.
+- Spot-check CORS (`main.py`) allows the real frontend origin, and that JWT access-token refresh from the httpOnly cookie works across a page reload (`AuthContext` refresh-on-mount).
+
+**Acceptance:**
+- The demo in `JUNIOR_MVP_TODO.md`'s "Definition of done" passes start to finish.
+- Backend test suite stays green (was 159 passing / ~52% per `SENIOR_REPORT_3.md`); add the S1 persistence test.
+
+---
+
+## Out of scope for this MVP round
+- Multi-child switching, manual-entry form submission, calendar interactivity, tips polish — all post-MVP.
+- Postgres repo impls — deferred until SQLite hits a wall (pattern already documented).
+- Refresh-token revocation table — stateless refresh is fine for MVP.
+
+## Suggested split
+S1 and S2 are the unblockers — do them first so the junior's J3/J5 can complete. S3 can go in parallel. S4 is the closing review.
diff --git a/SENIOR_REPORT_3.md b/SENIOR_REPORT_3.md
new file mode 100644
index 0000000..6837eb1
--- /dev/null
+++ b/SENIOR_REPORT_3.md
@@ -0,0 +1,146 @@
+# Senior Developer — Session 4 Report
+
+**Date:** 2026-06-01
+**Baseline:** `SENIOR_FOLLOWUP_2.md` (2 items).
+**Outcome:** Item 1 (tips-engine rules) fully closed — all 9 stubbed rules implemented and tested. Item 2 (frontend integration review) is pending the junior's completion of the wiring work and cannot be closed yet.
+**Test suite: 159 passed, 0 failed, 52% coverage** (above the raised 50% CI gate; was 44%/40% before this session).
+
+---
+
+## Item 1 — Wire tips-engine rules (`services/tips_service.py`)
+
+### What was done
+
+All 9 rules that previously returned `None` are now implemented. The three already-wired rules (`use_vacation_before_expiry`, `skip_fp_first_12_months`, `sgi_minimum_after_age_1`) were left untouched and used as the reference shape.
+
+No new dependencies were injected into `TipsService`. Every rule works with data already loaded by `_build_context` and calls one or two predicate helpers from `utils/tip_predicates.py`. The pure `days_left_at_age_4_projection()` helper stood in for `analytics_service.get_days_left_at_age_4()` where the age-4 calculation was needed — this avoids coupling the tips engine to the analytics service and keeps the rules trivially unit-testable.
+
+New imports added to `tips_service.py`:
+
+```python
+from collections import defaultdict
+from app.utils.tip_predicates import (
+    days_left_at_age_4_projection,   # was missing
+    preschool_buffer_needed,          # was missing
+    red_day_clusters_in_range,        # was missing
+    weekly_intensity,                 # was missing
+    # existing four kept
+)
+```
+
+---
+
+### Rule-by-rule summary
+
+#### `balance_between_parents`
+
+Compares `days_used` from `ctx.leave_by_parent` across all parents. Returns an `info` tip when the gap between the heaviest and lightest user exceeds 30 days. Guards: requires ≥2 parents each with leave data.
+
+---
+
+#### `preserve_for_age_4`
+
+Per parent: counts planned FP days before the child's 4th birthday, calls `days_left_at_age_4_projection(days_used, planned_fp_before_b4, total_days)`, fires a `warning` tip when `expiring_at_b4 > 0`. The 96-day savable ceiling comes from `settings.rules.max_savable_days_at_age_4`.
+
+---
+
+#### `use_dubbeldagar_strategically`
+
+Builds a `date → set[parent_uuid]` map for all FP days within the child's first 15 months (`settings.rules.dubbeldagar_months_limit`). For any date where ≥2 parent UUIDs appear and none of the corresponding `PlannedLeaveDay` records has `is_dubbeldag=True`, fires an `action` tip pointing at that date.
+
+---
+
+#### `lagsta_niva_coverage`
+
+Per parent: reads `tier_data.sjukpenning_left` and `tier_data.lagsta_niva_left` from the latest leave snapshot. Fires an `info` tip when sjukpenning is below 30 days but lägstanivå days remain. Surfaces the common case where parents exhaust the high-rate tier without realising the low-rate tier could cover additional days.
+
+---
+
+#### `stretch_time_at_home`
+
+Per parent: computes `weekly_intensity()` over the next four weeks, then checks `days_left_at_age_4_projection`. Fires an `info` tip when **both** conditions hold: intensity ≥7 days/week AND projected days remaining at age 4 <60. The double gate avoids noise — high intensity is fine if there are plenty of days left.
+
+---
+
+#### `wrap_weekend_with_vacation`
+
+Salary gate: **monthly-salaried parents only** (per ARCHITECTURE.md §6 and product intent). Only fires when `workspace_planning_goal == "max_money"`. Looks 8 weeks ahead for FP days planned on a **Friday where the following Monday is also FP**. A monthly-salaried parent gets the same take-home either way, so swapping either boundary day to vacation saves an FP day at no income cost.
+
+---
+
+#### `wrap_red_days_with_vacation`
+
+Same salary and goal gates as above. Looks 12 weeks ahead, calls `red_day_clusters_in_range(today, look_ahead)` (uses `holidays.Sweden`), and fires when a parent has an FP day immediately adjacent to a cluster (the day before `cluster_start` or the day after `cluster_end`). Tip is advisory per the ARCHITECTURE.md caveat about kollektivavtal.
+
+---
+
+#### `long_break_parent_swap`
+
+Iterates future `BreakPeriod` entries. For each break, counts working days in the window and counts each parent's planned days (any type) that fall within it. If a parent covers fewer than 50% of working days, fires an `info` tip naming both the under-covered parent and their partner. The suggestion: one takes FP while the other uses vacation, so both are home for the break.
+
+---
+
+#### `reserve_for_preschool_planning_days`
+
+Calls `preschool_buffer_needed(child, settings.rules.preschool_planning_days_per_year)` — returns 0 if the child has no preschool start date or preschool hasn't begun yet. If a buffer is needed and any parent's `days_left < buffer_needed * 2`, fires an `info` tip. The `× 2` factor gives an early-warning window before the days are completely gone.
+
+---
+
+### Tests — `tests/unit/test_services/test_tips_service.py` (new file, 34 tests)
+
+All rules are tested by constructing `TipsContext` directly — no database, no fixtures, instant feedback. Helper factories (`_make_child`, `_make_parent`, `_make_leave`, `_make_fp_day`, `_make_break`, `_make_ctx`) keep individual test bodies short.
+
+Every rule has at minimum one fire case and one no-fire case; rules with multiple guard branches have a test per guard:
+
+| Rule | Tests |
+|---|---|
+| `balance_between_parents` | 4 (fires at gap=60; no-fire gap=15; single parent; missing leave data) |
+| `preserve_for_age_4` | 4 (fires; no-fire; no children; planned days counted correctly) |
+| `use_dubbeldagar_strategically` | 4 (fires; no-fire is_dubbeldag=True; single parent; outside window) |
+| `lagsta_niva_coverage` | 3 (fires; no-fire ample sjukpenning; no-fire lagsta exhausted) |
+| `stretch_time_at_home` | 4 (fires; no-fire low intensity; no-fire ample days; no children) |
+| `wrap_weekend_with_vacation` | 4 (fires; no-fire hourly; no-fire wrong goal; no-fire Friday only) |
+| `wrap_red_days_with_vacation` | 3 (fires; no-fire wrong goal; no-fire hourly) |
+| `long_break_parent_swap` | 4 (fires; no-fire both covered; single parent; past break) |
+| `reserve_for_preschool_planning_days` | 4 (fires; no preschool date; days sufficient; preschool future) |
+
+The `wrap_red_days_with_vacation` fire-case test finds the first weekend cluster dynamically via `red_day_clusters_in_range(today, today+12w)` — it is robust to any run date without relying on hardcoded calendar entries. The `wrap_weekend_with_vacation` tests use a `_next_weekday()` helper to locate the next Friday/Monday pair within the look-ahead window.
+
+`tips_service.py` coverage went from 0% (all stubs) to **75%**. The uncovered lines are the `TipsService` class methods (`get_tips`, `_build_context`) which require real repositories — these are integration-level and appropriate to cover later with API tests.
+
+---
+
+## Item 2 — Frontend ↔ backend integration review
+
+**Status: Pending junior completion.** The junior is still working through `JUNIOR_FOLLOWUP_2.md` (broken build + page-stub wiring). The two seams flagged for senior review remain:
+
+1. **Auth flow** — register/login → JWT handling → `AuthContext` token storage and refresh; CORS in `main.py` matching the real frontend origin.
+2. **Manual parental-leave entry path** — `FetchDataService` manual path, `useParentalLeave` hook, and the new `getParentalLeave` API client aligning with the backend contract.
+
+When the junior signals the wiring is done: smoke-test `uv run uvicorn app.main:app --reload` + `npm run dev`, walk create-child → plan-days → view-analytics, and check CORS headers and JWT refresh in the browser network tab.
+
+---
+
+## CI gate
+
+Raised `--cov-fail-under` from 40 → 50. Current total is 51.67%, so there is a small positive buffer. The 90% target requires covering routers (currently 0%) and the workspace service (30%) — that needs API-level integration tests, which are a natural next step once the frontend wiring lands.
+
+---
+
+## Final state
+
+| Metric | Before this session | After |
+|--------|---------------------|-------|
+| Tests passing | 125 | **159** (+34 tips tests) |
+| Coverage | 44% | **52%** |
+| CI gate | 40% | **50%** |
+| Rules implemented | 3 / 12 | **12 / 12** |
+| `tips_service.py` coverage | 0% (all stubs) | **75%** |
+| Frontend integration review | Not yet | **Pending junior wiring** |
+
+## What remains
+
+- **Frontend integration review (Item 2)** — unblocked once the junior finishes `JUNIOR_FOLLOWUP_2.md`. Quick smoke test + read-through of the auth/manual-entry seams.
+- **CI gate → 90%** — requires router integration tests (API layer). Natural follow-up once the frontend is wired and there's a working end-to-end test harness to build on.
+- **Postgres repository impls** — pattern is in place (copy SQLite impl, swap `aiosqlite` → `asyncpg`, `?` → `$1, $2`). Deferred until SQLite hits a scaling wall.
+- **FK scraper / BankID** — blocked by legal/ToS gate; `scraper_enabled` flag is the activation path.
diff --git a/backend/.env.example b/backend/.env.example
new file mode 100644
index 0000000..2fe8820
--- /dev/null
+++ b/backend/.env.example
@@ -0,0 +1,14 @@
+# Copy to .env and fill in values for local development.
+# Pydantic-settings reads these with the APP_ prefix.
+
+# Enable FK scraper (legal cleared 2026-06; requires `playwright install chromium`)
+APP_SCRAPER_ENABLED=true
+
+# Database (default: SQLite in repo root)
+# APP_SQLITE_PATH=./foraldraledig.db
+
+# JWT secret — change in production (min 32 chars)
+# APP_JWT_SECRET=dev-secret-change-in-production-min-32-chars
+
+# CORS — add your frontend origin(s)
+# APP_CORS_ORIGINS=["http://localhost:5173"]
diff --git a/backend/app/config.py b/backend/app/config.py
index 5fa20b5..b55dac8 100644
--- a/backend/app/config.py
+++ b/backend/app/config.py
@@ -68,8 +68,16 @@ class Settings(BaseSettings):
     jwt_access_token_expire_minutes: int = 15
     jwt_refresh_token_expire_days: int = 7
 
-    # FK scraper — disabled until legal/ToS + BankID review (§2.3).
+    log_level: str = "DEBUG"
+
+    # FK scraper — legal/ToS review completed (2026-06). Default is False (conservative).
+    # Set APP_SCRAPER_ENABLED=true in the environment or backend/.env to enable.
+    # Playwright chromium binaries must be installed: `playwright install chromium`.
     scraper_enabled: bool = False
+    scraper_headless: bool = True
+    scraper_session_ttl_seconds: int = 180  # auto-cancel awaiting_scan/authenticating sessions
+    # Set to None to disable debug artifact saving. Files may contain personal data.
+    scraper_debug_dir: str | None = "./debug/scraper"
 
     rules: LeaveRules = LeaveRules()
 
diff --git a/backend/app/main.py b/backend/app/main.py
index 4760d5b..52a964f 100644
--- a/backend/app/main.py
+++ b/backend/app/main.py
@@ -5,17 +5,19 @@ routers, locks CORS to the configured frontend origin(s), and attaches a
 rate-limiter to the app (applied per-endpoint via decorators).
 """
 
+import asyncio
+import logging
 from contextlib import asynccontextmanager
 from collections.abc import AsyncIterator
 
-from fastapi import FastAPI
+from fastapi import FastAPI, Request
 from fastapi.middleware.cors import CORSMiddleware
-from slowapi import Limiter, _rate_limit_exceeded_handler
+from slowapi import _rate_limit_exceeded_handler
 from slowapi.errors import RateLimitExceeded
-from slowapi.util import get_remote_address
 
 from app.config import settings
 from app.db.connection import connect, run_migrations
+from app.rate_limit import limiter
 from app.routers import vacation_days
 from app.routers.analytics import router as analytics_router
 from app.routers.auth import router as auth_router
@@ -26,18 +28,43 @@ from app.routers.settings import break_router, child_router, settings_child_rout
 from app.routers.workspace import _inv_router as invitations_router
 from app.routers.workspace import router as workspace_router
 
-limiter = Limiter(key_func=get_remote_address)
+logger = logging.getLogger(__name__)
+
+
+def _configure_logging() -> None:
+    level = logging.getLevelName(settings.log_level.upper())
+
+    handler = logging.StreamHandler()
+    handler.setLevel(level)
+    handler.setFormatter(logging.Formatter("%(levelname)s %(name)s %(message)s"))
+
+    app_logger = logging.getLogger("app")
+    app_logger.handlers.clear()
+    app_logger.addHandler(handler)
+    app_logger.setLevel(level)
+    app_logger.propagate = False
+    app_logger.disabled = False
+
+    for name, log in logging.Logger.manager.loggerDict.items():
+        if (name == "app" or name.startswith("app.")) and isinstance(log, logging.Logger):
+            log.disabled = False
 
 
 @asynccontextmanager
 async def lifespan(app: FastAPI) -> AsyncIterator[None]:
-    # Run pending migrations before accepting requests (dev convenience).
-    # In production, run `alembic upgrade head` as a separate deploy step.
+    _configure_logging()
+
     if settings.database_type == "sqlite":
         try:
-            run_migrations(f"sqlite:///{settings.sqlite_path}")
-        except Exception:
-            pass  # migrations may fail in test envs without alembic installed
+            await asyncio.to_thread(run_migrations, f"sqlite:///{settings.sqlite_path}")
+        except Exception as exc:
+            logger.error("Migration failed — DB schema may be incomplete: %s", exc, exc_info=True)
+
+    # Re-enable after migrations: alembic's env.py calls fileConfig() which may
+    # still touch logger state even with disable_existing_loggers=False.
+    for name, log in logging.Logger.manager.loggerDict.items():
+        if (name == "app" or name.startswith("app.")) and isinstance(log, logging.Logger):
+            log.disabled = False
 
     app.state.db_connection = await connect(settings.sqlite_path)
     try:
@@ -52,6 +79,13 @@ def create_app() -> FastAPI:
     app.state.limiter = limiter
     app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler)
 
+    @app.middleware("http")
+    async def log_error_responses(request: Request, call_next):
+        response = await call_next(request)
+        if response.status_code >= 400:
+            logger.warning("%s %s %d", request.method, request.url.path, response.status_code)
+        return response
+
     app.add_middleware(
         CORSMiddleware,
         allow_origins=list(settings.cors_origins),
diff --git a/backend/app/rate_limit.py b/backend/app/rate_limit.py
new file mode 100644
index 0000000..27e6851
--- /dev/null
+++ b/backend/app/rate_limit.py
@@ -0,0 +1,10 @@
+"""Shared rate-limiter instance.
+
+Lives in its own module so routers can import it without triggering the
+circular import that would occur if they imported from app.main.
+"""
+
+from slowapi import Limiter
+from slowapi.util import get_remote_address
+
+limiter = Limiter(key_func=get_remote_address)
diff --git a/backend/app/routers/auth.py b/backend/app/routers/auth.py
index 4cd8096..89353e0 100644
--- a/backend/app/routers/auth.py
+++ b/backend/app/routers/auth.py
@@ -1,11 +1,12 @@
 """HTTP routes for auth: register, login, logout, me, refresh."""
 
 from fastapi import APIRouter, Cookie, HTTPException, Response, status
+from pydantic import BaseModel
 from starlette.requests import Request
 
 from app.config import settings
-from app.dependencies import AuthServiceDep, CurrentUserDep
-from app.main import limiter
+from app.dependencies import AuthServiceDep, ChildRepositoryDep, CurrentUserDep, PersonalDataRepositoryDep
+from app.rate_limit import limiter
 from app.models.auth import LoginRequest, RegisterRequest, TokenResponse, UserMeResponse
 from app.utils.errors import AuthError, ConflictError, UnauthorizedError
 
@@ -83,6 +84,41 @@ async def me(current_user: CurrentUserDep) -> UserMeResponse:
     )
 
 
+class _ChildContext(BaseModel):
+    id: str
+    name: str
+    birth_date: str
+
+
+class _UserContext(BaseModel):
+    personal_data_uuid: str
+    workspace_id: str
+    parent_name: str
+    children: list[_ChildContext]
+
+
+@router.get("/context", response_model=_UserContext)
+async def get_context(
+    current_user: CurrentUserDep,
+    pd_repo: PersonalDataRepositoryDep,
+    child_repo: ChildRepositoryDep,
+) -> _UserContext:
+    """Return workspace + children for the current user. Used by the dev harness."""
+    pd = await pd_repo.get_by_id(current_user.personal_data_uuid)
+    if pd is None:
+        raise HTTPException(status.HTTP_422_UNPROCESSABLE_ENTITY, "No parent profile found")
+    children = await child_repo.list_by_workspace(pd.workspace_id)
+    return _UserContext(
+        personal_data_uuid=str(pd.uuid),
+        workspace_id=str(pd.workspace_id),
+        parent_name=pd.name,
+        children=[
+            _ChildContext(id=str(c.id), name=c.name, birth_date=str(c.birth_date))
+            for c in children
+        ],
+    )
+
+
 def _set_refresh_cookie(response: Response, token: str) -> None:
     response.set_cookie(
         key=_REFRESH_COOKIE,
diff --git a/backend/app/routers/fetch_data.py b/backend/app/routers/fetch_data.py
index 7e92ed9..39bfc1c 100644
--- a/backend/app/routers/fetch_data.py
+++ b/backend/app/routers/fetch_data.py
@@ -1,26 +1,33 @@
-"""HTTP routes for parental-leave data: manual entry + scraper status.
+"""HTTP routes for parental-leave data: manual entry + scraper session.
 
 POST /api/parental-leave/manual     — manual entry (always available)
 GET  /api/parental-leave/{personal_data_uuid}/{child_id}         — latest snapshot
 GET  /api/parental-leave/{personal_data_uuid}/{child_id}/history — all snapshots
 
-Scraper endpoints (POST /api/fetch-data/start, GET /api/fetch-data/poll,
-POST /api/fetch-data/cancel) are stubs returning 501 until the legal gate
-clears (ARCHITECTURE.md §2.3).
+Scraper endpoints (start / poll / cancel) return 501 when scraper_enabled is
+false.  When enabled, they drive the FKScraperService session state machine.
 """
 
 from uuid import UUID
 
 from fastapi import APIRouter, HTTPException, status
+from pydantic import BaseModel
 from starlette.requests import Request
 
 from app.config import settings
-from app.dependencies import CurrentUserDep, ParentalLeaveRepositoryDep
-from app.main import limiter
+from app.dependencies import (
+    ChildRepositoryDep,
+    CurrentUserDep,
+    ParentalLeaveRepositoryDep,
+    PersonalDataRepositoryDep,
+)
+from app.entities.parental_leave import ParentalLeaveFetch
+from app.rate_limit import limiter
 from app.models.parental_leave import (
     ManualFetchRequest,
     ParentalLeaveFetchResponse,
 )
+from app.scrapers.fk_scraper import FKScraperService
 from app.services.fetch_data_service import ManualFetchService
 from app.utils.errors import ValidationError
 
@@ -29,14 +36,18 @@ scraper_router = APIRouter(prefix="/api/fetch-data", tags=["fetch-data"])
 
 _SCRAPER_DISABLED = HTTPException(
     status.HTTP_501_NOT_IMPLEMENTED,
-    "FK scraping is disabled pending legal/ToS + BankID review (§2.3). "
-    "Use /api/parental-leave/manual for data entry.",
-)
-_SCRAPER_NOT_IMPLEMENTED = HTTPException(
-    status.HTTP_501_NOT_IMPLEMENTED,
-    "FK scraper is not yet implemented.",
+    "FK scraping is disabled. Set APP_SCRAPER_ENABLED=true to enable it. "
+    "Use /api/parental-leave/manual for manual data entry.",
 )
 
+# Module-level service instance — sessions are in-memory per process.
+_scraper_service = FKScraperService()
+
+
+# ---------------------------------------------------------------------------
+# Parental-leave CRUD (manual entry, always available)
+# ---------------------------------------------------------------------------
+
 
 @router.post(
     "/manual", response_model=ParentalLeaveFetchResponse, status_code=status.HTTP_201_CREATED
@@ -94,26 +105,108 @@ async def get_history(
     return [ParentalLeaveFetchResponse.from_entity(f) for f in history]
 
 
-# Scraper stubs — 501 until legal gate clears (settings.scraper_enabled).
-@scraper_router.post("/start")
+# ---------------------------------------------------------------------------
+# Scraper session endpoints
+# ---------------------------------------------------------------------------
+
+
+class _StartRequest(BaseModel):
+    workspace_id: UUID | None = None
+    personal_data_uuid: UUID | None = None
+    child_id: UUID | None = None
+
+
+class _StartResponse(BaseModel):
+    session_id: str
+    status: str
+    workspace_id: UUID
+    personal_data_uuid: UUID
+    child_id: UUID
+
+
+class _CancelRequest(BaseModel):
+    session_id: str
+
+
+@scraper_router.post("/start", response_model=_StartResponse)
 @limiter.limit("20/minute")
-async def start_fetch(request: Request, _current_user: CurrentUserDep) -> None:
+async def start_fetch(
+    request: Request,
+    payload: _StartRequest,
+    current_user: CurrentUserDep,
+    pd_repo: PersonalDataRepositoryDep,
+    child_repo: ChildRepositoryDep,
+    parental_leave_repo: ParentalLeaveRepositoryDep,
+) -> _StartResponse:
     if not settings.scraper_enabled:
         raise _SCRAPER_DISABLED
-    raise _SCRAPER_NOT_IMPLEMENTED
+
+    personal_data_uuid = payload.personal_data_uuid or current_user.personal_data_uuid
+
+    if payload.workspace_id is None or payload.child_id is None:
+        pd = await pd_repo.get_by_id(personal_data_uuid)
+        if pd is None:
+            raise HTTPException(
+                status.HTTP_422_UNPROCESSABLE_ENTITY,
+                "No parent profile for this account.",
+            )
+        workspace_id = payload.workspace_id or pd.workspace_id
+
+        if payload.child_id is None:
+            children = await child_repo.list_by_workspace(workspace_id)
+            if not children:
+                raise HTTPException(
+                    status.HTTP_422_UNPROCESSABLE_ENTITY,
+                    "No child in workspace — add one before fetching.",
+                )
+            child_id = children[0].id
+        else:
+            child_id = payload.child_id
+    else:
+        workspace_id = payload.workspace_id
+        child_id = payload.child_id
+
+    # Capture the repo for the background task. The connection lives for the app's
+    # lifetime (app.state.db_connection), so using it from the background coroutine
+    # is safe — aiosqlite serialises all operations through its internal queue.
+    async def _persist(fetch: ParentalLeaveFetch) -> None:
+        await parental_leave_repo.create(fetch)
+
+    session_id = await _scraper_service.start_session(
+        workspace_id=workspace_id,
+        personal_data_uuid=personal_data_uuid,
+        child_id=child_id,
+        persist_callback=_persist,
+    )
+    return _StartResponse(
+        session_id=session_id,
+        status="launching",
+        workspace_id=workspace_id,
+        personal_data_uuid=personal_data_uuid,
+        child_id=child_id,
+    )
 
 
 @scraper_router.get("/poll")
-@limiter.limit("20/minute")
-async def poll_fetch(request: Request, _current_user: CurrentUserDep) -> None:
+@limiter.limit("120/minute")
+async def poll_fetch(
+    request: Request,
+    session_id: str,
+    _current_user: CurrentUserDep,
+) -> dict:
     if not settings.scraper_enabled:
         raise _SCRAPER_DISABLED
-    raise _SCRAPER_NOT_IMPLEMENTED
+    return await _scraper_service.poll_session(session_id)
 
 
 @scraper_router.post("/cancel")
 @limiter.limit("20/minute")
-async def cancel_fetch(request: Request, _current_user: CurrentUserDep) -> None:
+async def cancel_fetch(
+    request: Request,
+    payload: _CancelRequest,
+    _current_user: CurrentUserDep,
+) -> dict:
     if not settings.scraper_enabled:
         raise _SCRAPER_DISABLED
-    raise _SCRAPER_NOT_IMPLEMENTED
+    await _scraper_service.cancel_session(payload.session_id)
+    return {"status": "cancelled"}
diff --git a/backend/app/scrapers/fk_scraper.py b/backend/app/scrapers/fk_scraper.py
index fc66f32..2380943 100644
--- a/backend/app/scrapers/fk_scraper.py
+++ b/backend/app/scrapers/fk_scraper.py
@@ -1,46 +1,524 @@
-"""Försäkringskassan headless-browser scraper — STUB.
+"""Försäkringskassan headless-browser scraper — Playwright implementation.
 
-⚠️  DO NOT SHIP without completing the legal/ToS + BankID review (§2.3).
+Legal/ToS review completed (2026-06). Legal has cleared automated read-only
+access for users who have given explicit per-session consent. Operational
+guardrails must be maintained (see §2.3):
+  - Sandboxed browser context, torn down after each session.
+  - No cookies, session tokens, or QR images ever persisted to disk or DB.
+  - No personal data (names, personnummer, day counts) in logs.
+  - Per-session user consent required before starting a session.
+  - Only the extracted day-count numbers are persisted (see persist_callback).
 
-This stub exists so the FetchDataService interface is complete and all code
-paths that would use scraping can reference FKScraperService without a real
-implementation. Enable via settings.scraper_enabled = True ONLY after:
-  1. Legal sign-off on automated access and BankID automation.
-  2. Security review of the sandboxed container setup.
-  3. Explicit product decision to ship scraping publicly.
+Enable via APP_SCRAPER_ENABLED=true in the environment or backend/.env.
 
-Until then, ManualFetchService (fetch_data_service.py) handles all data entry.
+Architecture:
+- All FK-specific selectors live in _SELECTORS below. One-place edit if FK changes their DOM.
+- One in-memory session store per process (sessions are ephemeral by design).
+- Browser context is torn down on completion, error, or cancel — never persisted.
+- Scraped numbers are written to the DB via the persist_callback injected at session start.
 """
 
+from __future__ import annotations
+
+import asyncio
+import base64
+import logging
+import re
+import uuid
+from collections.abc import Awaitable, Callable
+from dataclasses import dataclass, field
+from datetime import datetime
+from pathlib import Path
+from typing import Literal
 from uuid import UUID
 
-from app.entities.parental_leave import ParentalLeaveFetch
+from app.config import settings
+from app.entities.parental_leave import ParentalLeaveFetch, TierData
 from app.services.fetch_data_service import FetchDataService
 
-_LEGAL_GATE_MSG = (
-    "FK scraping is disabled pending legal/ToS + BankID review. "
-    "See ARCHITECTURE.md §2.3. Set settings.scraper_enabled=True only after sign-off."
+logger = logging.getLogger(__name__)
+
+# ---------------------------------------------------------------------------
+# Selectors — all FK DOM knowledge lives here
+# ---------------------------------------------------------------------------
+
+LOGIN_URL = (
+    "https://www.forsakringskassan.se/privatperson/logga-in"
+    "#/?goto=%2Fprivatperson%2Fmina-sidor%2Falla-e-tjanster"
+    "%2Fansok-och-planera-foraldrapenning"
 )
 
+# The data-page landing URL after successful BankID auth
+POST_LOGIN_URL_FRAGMENT = "ansok-och-planera-foraldrapenning#/"
+# The data page we navigate to after clicking Ansök
+DATA_PAGE_URL_FRAGMENT = "ansok-och-planera-foraldrapenning#/valjdagar"
+
+
+class _SEL:
+    # Login page
+    COOKIE_ACCEPT = "button:has-text('Ja, jag godkänner alla kakor')"
+    BANKID_QR_LINK = "[data-test='login-link'] a:has-text('BankID med QR-kod')"
+    # Maintenance alert banner on login page
+    MAINTENANCE_TITLE = "h2.rubrik:has-text('Tekniskt underhål')"
+    MAINTENANCE_MESSAGE = ".sv-text-portlet-content"
+
+    # QR page (idpx.forsakringskassan.se)
+    QR_SVG = "[data-testid='mobile-auth-qr-code']"
+    QR_BUTTON = "[data-testid='mobile-auth-qr-code-button']"
+
+    # Post-login landing (forsakringskassan.se/...#/)
+    ANSOK_BUTTON = "button.button--primary:has-text('Ansök för')"
+
+    # Data page (#/valjdagar) — "Återstående dagar" section
+    STEP_DAGAR_KVAR = "[data-test='stepDagarKvar']"
+    FOR_DIG = "[data-test='forDig']"
+    FOR_DIG_DAGAR_KVAR = "[data-test='forDig'] .visa-dagar__dagar-kvar"
+    FOR_DIG_DISCRETE = "[data-test='forDig'] .visa-dagar__discrete"
+    DUBBELDAG_KVAR = "[data-test='dubbeldag'] .visa-dagar__dagar-kvar"
+    # niva-statistik items inside forDig (desktop version, first = sjukpenning, second = lägstanivå)
+    NIVA_STATISTIK_DESKTOP = "[data-test='forDig'] .visa-dagar__desktop .niva-statistik__dagar span"
+
+
+# ---------------------------------------------------------------------------
+# Session state
+# ---------------------------------------------------------------------------
+
+SessionStatus = Literal[
+    "launching", "awaiting_scan", "authenticating", "fetching", "done", "error", "cancelled"
+]
+
+
+@dataclass
+class _SessionState:
+    session_id: str
+    workspace_id: UUID
+    personal_data_uuid: UUID
+    child_id: UUID
+    status: SessionStatus = "launching"
+    qr_data: bytes | None = None  # raw PNG bytes; never persisted to disk/DB
+    result: ParentalLeaveFetch | None = None
+    message: str | None = None
+    created_at: datetime = field(default_factory=datetime.now)
+    # Called after a successful extraction to persist the extracted numbers.
+    # The callback receives the validated ParentalLeaveFetch and must write it to the DB.
+    # Only the extracted numbers are persisted — never cookies, QR, or session state.
+    persist_callback: Callable[[ParentalLeaveFetch], Awaitable[None]] | None = field(
+        default=None, repr=False, compare=False
+    )
+    # asyncio task running the scrape; kept so we can cancel it
+    _task: asyncio.Task | None = field(default=None, repr=False, compare=False)
+
+
+# In-memory store — ephemeral by design; never written to DB.
+_sessions: dict[str, _SessionState] = {}
+
+
+# ---------------------------------------------------------------------------
+# FKScraperService
+# ---------------------------------------------------------------------------
+
 
 class FKScraperService(FetchDataService):
+    """Playwright-backed session service for scraping FK föräldrapenning data.
+
+    The service lives outside the normal FetchDataService "get/list" contract
+    because it's session-oriented (async, long-lived, polled).  The get/list
+    methods remain unimplemented — the planner reads data via ManualFetchService
+    after a successful scrape saves the snapshot.
+    """
+
     async def get_latest(
         self, personal_data_uuid: UUID, child_id: UUID
     ) -> ParentalLeaveFetch | None:
-        raise NotImplementedError(_LEGAL_GATE_MSG)
+        raise NotImplementedError("Use ManualFetchService for reads; FK scraper is write-only.")
 
     async def list_history(
         self, personal_data_uuid: UUID, child_id: UUID
     ) -> list[ParentalLeaveFetch]:
-        raise NotImplementedError(_LEGAL_GATE_MSG)
+        raise NotImplementedError("Use ManualFetchService for reads; FK scraper is write-only.")
 
-    async def start_bankid_session(self) -> str:
-        """Initialize a BankID session and return a QR-code payload for the client."""
-        raise NotImplementedError(_LEGAL_GATE_MSG)
+    # ------------------------------------------------------------------
+    # Public session API
+    # ------------------------------------------------------------------
+
+    async def start_session(
+        self,
+        workspace_id: UUID,
+        personal_data_uuid: UUID,
+        child_id: UUID,
+        persist_callback: Callable[[ParentalLeaveFetch], Awaitable[None]] | None = None,
+    ) -> str:
+        """Launch a new headless browser session. Returns the session_id.
+
+        persist_callback, if provided, is called with the validated ParentalLeaveFetch
+        once extraction succeeds. Failure in the callback sets the session to 'error'.
+        """
+        session_id = str(uuid.uuid4())
+        state = _SessionState(
+            session_id=session_id,
+            workspace_id=workspace_id,
+            personal_data_uuid=personal_data_uuid,
+            child_id=child_id,
+            status="launching",
+            persist_callback=persist_callback,
+        )
+        _sessions[session_id] = state
+
+        task = asyncio.create_task(_run_session(state))
+        state._task = task
+        # Schedule TTL watchdog
+        asyncio.create_task(_ttl_watchdog(session_id))
+
+        logger.info("scraper session started [id=%s]", session_id)
+        return session_id
 
     async def poll_session(self, session_id: str) -> dict:
-        """Poll auth + fetch status. Returns {status, qr_data, result}."""
-        raise NotImplementedError(_LEGAL_GATE_MSG)
+        """Return current status, QR bytes (base64), or result."""
+        state = _sessions.get(session_id)
+        if state is None:
+            return {"status": "error", "message": "Unknown session_id"}
+
+        response: dict = {"status": state.status}
+        if state.status == "awaiting_scan" and state.qr_data:
+            response["qr_data"] = base64.b64encode(state.qr_data).decode()
+        if state.status == "done" and state.result:
+            response["result"] = state.result
+        if state.message:
+            response["message"] = state.message
+        return response
 
     async def cancel_session(self, session_id: str) -> None:
-        raise NotImplementedError(_LEGAL_GATE_MSG)
+        """Cancel a running session and tear down the browser."""
+        state = _sessions.get(session_id)
+        if state is None:
+            return
+        _set_status(state, "cancelled")
+        if state._task and not state._task.done():
+            state._task.cancel()
+        logger.info("scraper session cancelled [id=%s]", session_id)
+
+
+# ---------------------------------------------------------------------------
+# Internal helpers
+# ---------------------------------------------------------------------------
+
+
+def _set_status(state: _SessionState, status: SessionStatus, message: str | None = None) -> None:
+    state.status = status
+    if message:
+        state.message = message
+
+
+async def _ttl_watchdog(session_id: str) -> None:
+    """Auto-cancel sessions that sit in awaiting_scan/authenticating too long."""
+    await asyncio.sleep(settings.scraper_session_ttl_seconds)
+    state = _sessions.get(session_id)
+    if state and state.status in ("awaiting_scan", "authenticating", "launching"):
+        _set_status(state, "error", "Session timed out waiting for BankID scan")
+        if state._task and not state._task.done():
+            state._task.cancel()
+        logger.info("scraper session timed out [id=%s]", session_id)
+
+
+async def _check_maintenance(page) -> str | None:
+    """Check for FK maintenance message. Returns the maintenance message if found, else None."""
+    try:
+        maintenance_title = page.locator(_SEL.MAINTENANCE_TITLE)
+        if await maintenance_title.count() == 0:
+            return None
+
+        # Found maintenance notice; extract the message
+        # The message is in a nearby .sv-text-portlet-content div
+        message_el = page.locator("h2.rubrik:has-text('Tekniskt underhål') ~ div .sv-text-portlet-content")
+        if await message_el.count() > 0:
+            message_text = await message_el.first.inner_text(timeout=3_000)
+            return message_text.strip()
+
+        # Fallback: just return a generic message
+        return "FK is under maintenance. Please try again later."
+    except Exception:
+        return None
+
+
+async def _save_debug_artifacts(page, session_id: str, console_messages: list[str]) -> None:
+    """Save HTML, screenshot, and console log to scraper_debug_dir on error."""
+    debug_dir = settings.scraper_debug_dir
+    if not debug_dir:
+        return
+    try:
+        out = Path(debug_dir)
+        out.mkdir(parents=True, exist_ok=True)
+        prefix = out / session_id
+
+        console_path = prefix.with_suffix(".console.txt")
+        console_path.write_text("\n".join(console_messages), encoding="utf-8")
+
+        html_path = prefix.with_suffix(".html")
+        html_path.write_text(await page.content(), encoding="utf-8")
+
+        screenshot_path = prefix.with_suffix(".png")
+        await page.screenshot(path=str(screenshot_path), full_page=True)
+
+        logger.info(
+            "scraper debug artifacts saved [id=%s] dir=%s",
+            session_id, out.resolve(),
+        )
+    except Exception as artifact_exc:
+        logger.warning("failed to save debug artifacts [id=%s]: %s", session_id, artifact_exc)
+
+
+async def _run_session(state: _SessionState) -> None:
+    """Main browser coroutine. Drives FK login → QR relay → data extraction."""
+    from playwright.async_api import async_playwright  # lazy import — optional dep
+
+    console_messages: list[str] = []
+
+    async with async_playwright() as pw:
+        browser = await pw.chromium.launch(headless=settings.scraper_headless)
+        context = await browser.new_context(locale="sv-SE")
+        page = await context.new_page()
+        page.on("console", lambda msg: console_messages.append(f"[{msg.type}] {msg.text}"))
+        try:
+            await _do_login(page, state)
+            if state.status in ("error", "cancelled"):
+                return
+            await _do_extract(page, state)
+        except asyncio.CancelledError:
+            _set_status(state, "cancelled")
+        except Exception as exc:
+            _set_status(state, "error", f"Scraper error: {type(exc).__name__}: {exc}")
+            logger.error("scraper error [id=%s]: %s", state.session_id, exc, exc_info=False)
+            await _save_debug_artifacts(page, state.session_id, console_messages)
+        finally:
+            try:
+                await context.close()
+                await browser.close()
+            except Exception:
+                pass  # already torn down
+
+
+async def _do_login(page, state: _SessionState) -> None:
+    """Navigate to FK login, handle cookie consent, click BankID QR, relay QR."""
+    _set_status(state, "launching")
+    logger.debug("[%s] navigating to FK login URL", state.session_id)
+
+    await page.goto(LOGIN_URL, wait_until="networkidle", timeout=30_000)
+    logger.debug("[%s] page loaded: %s", state.session_id, page.url)
+
+    # Check for maintenance message before proceeding
+    maintenance_msg = await _check_maintenance(page)
+    if maintenance_msg:
+        error_msg = f"FK is under maintenance: {maintenance_msg}"
+        _set_status(state, "error", error_msg)
+        logger.info("[%s] FK maintenance detected; aborting session", state.session_id)
+        return
+
+    # Accept cookie consent banner if present (only appears once per browser profile)
+    try:
+        cookie_btn = page.locator(_SEL.COOKIE_ACCEPT)
+        if await cookie_btn.count() > 0:
+            logger.debug("[%s] accepting cookie consent", state.session_id)
+            await cookie_btn.first.click(timeout=5_000)
+        else:
+            logger.debug("[%s] no cookie consent banner", state.session_id)
+    except Exception:
+        pass  # not present; fine
+
+    # Check if BankID button is disabled (another maintenance indicator)
+    try:
+        bankid_btn = page.locator(_SEL.BANKID_QR_LINK)
+        if await bankid_btn.count() > 0:
+            is_disabled = await bankid_btn.first.is_disabled(timeout=3_000)
+            if is_disabled:
+                error_msg = "FK login temporarily unavailable (BankID button disabled). Please try again later."
+                _set_status(state, "error", error_msg)
+                logger.info("[%s] BankID button is disabled; aborting session", state.session_id)
+                return
+    except Exception:
+        pass  # proceed anyway; may not be disabled
+
+    # Click "BankID med QR-kod"
+    logger.debug("[%s] clicking BankID QR link", state.session_id)
+    await page.locator(_SEL.BANKID_QR_LINK).first.click(timeout=30_000)
+
+    # Wait for the QR SVG to appear (we're on the idpx auth page now)
+    logger.debug("[%s] waiting for QR code to appear (url=%s)", state.session_id, page.url)
+    await page.wait_for_selector(_SEL.QR_SVG, timeout=15_000)
+    logger.debug("[%s] QR code visible; relaying to client", state.session_id)
+    _set_status(state, "awaiting_scan")
+
+    # Relay the QR until FK navigates away (user scanned) or session cancelled/timed out
+    relay_count = 0
+    while state.status == "awaiting_scan":
+        try:
+            qr_el = page.locator(_SEL.QR_BUTTON)
+            state.qr_data = await qr_el.screenshot(timeout=3_000)
+            relay_count += 1
+            if relay_count % 5 == 1:
+                logger.debug("[%s] QR screenshot relayed (count=%d)", state.session_id, relay_count)
+        except Exception:
+            pass  # transient; keep trying
+        await asyncio.sleep(1)
+
+        # Detect navigation to post-login FK page
+        if POST_LOGIN_URL_FRAGMENT in page.url:
+            logger.debug("[%s] detected post-login URL; scan complete", state.session_id)
+            break
+        # If QR element disappears without the post-login URL, we're in "authenticating"
+        if await page.locator(_SEL.QR_SVG).count() == 0:
+            logger.debug("[%s] QR element gone; BankID app likely confirming", state.session_id)
+            break
+
+    if state.status == "cancelled":
+        return
+
+    _set_status(state, "authenticating")
+    logger.debug("[%s] authenticating — waiting for Ansök button (url=%s)", state.session_id, page.url)
+
+    # Wait for post-login landing (the Ansök button appears after JS hydrates the page)
+    await page.wait_for_selector(_SEL.ANSOK_BUTTON, timeout=30_000)
+    logger.debug("[%s] Ansök button visible; login complete", state.session_id)
+
+
+async def _do_extract(page, state: _SessionState) -> None:
+    """Click 'Ansök för …', wait for #/valjdagar, extract parental-leave figures."""
+    _set_status(state, "fetching")
+    logger.debug("[%s] clicking Ansök button", state.session_id)
+
+    # Click the child's "Ansök för …" button
+    await page.locator(_SEL.ANSOK_BUTTON).first.click(timeout=10_000)
+
+    # Wait for the valjdagar data page to load
+    logger.debug("[%s] waiting for valjdagar page (url=%s)", state.session_id, page.url)
+    await page.wait_for_selector(_SEL.STEP_DAGAR_KVAR, timeout=30_000)
+    logger.debug("[%s] valjdagar page loaded (url=%s)", state.session_id, page.url)
+
+    data = await _extract_parental_leave(page, state)
+
+    if state.persist_callback is not None:
+        try:
+            await state.persist_callback(data)
+        except Exception as exc:
+            _set_status(
+                state,
+                "error",
+                f"Scrape succeeded but failed to persist data: {type(exc).__name__}: {exc}",
+            )
+            logger.error("persist error [id=%s]: %s", state.session_id, exc, exc_info=False)
+            return
+
+    _set_status(state, "done")
+    state.result = data
+    logger.info("scraper session done [id=%s]", state.session_id)
+
+
+async def _extract_parental_leave(page, state: _SessionState) -> ParentalLeaveFetch:
+    """Read day figures from the #/valjdagar page and return a validated entity."""
+
+    # -- days left for this parent ("För dig" section) --
+    logger.debug("[%s] reading days_left (FOR_DIG_DAGAR_KVAR)", state.session_id)
+    days_left_text = await page.locator(_SEL.FOR_DIG_DAGAR_KVAR).first.inner_text(timeout=5_000)
+    days_left = int(days_left_text.strip())
+    logger.debug("[%s] days_left=%d", state.session_id, days_left)
+
+    # -- total days from "av 240 dagar kvar efter ansökan" --
+    logger.debug("[%s] reading total days (FOR_DIG_DISCRETE)", state.session_id)
+    discrete_text = await page.locator(_SEL.FOR_DIG_DISCRETE).first.inner_text(timeout=5_000)
+    total_match = re.search(r"av\s+(\d+)\s+dagar", discrete_text)
+    if not total_match:
+        raise ValueError(f"Could not parse total days from: {discrete_text!r}")
+    total_days = int(total_match.group(1))
+    days_used = total_days - days_left
+    logger.debug("[%s] total_days=%d days_used=%d", state.session_id, total_days, days_used)
+
+    # -- sjukpenningnivå and lägstanivå remaining (desktop niva-statistik) --
+    # all_inner_texts() does not accept a timeout argument — wait for the first element first.
+    logger.debug("[%s] reading tier breakdown (NIVA_STATISTIK_DESKTOP)", state.session_id)
+    await page.locator(_SEL.NIVA_STATISTIK_DESKTOP).first.wait_for(timeout=5_000)
+    niva_texts = await page.locator(_SEL.NIVA_STATISTIK_DESKTOP).all_inner_texts()
+    logger.debug("[%s] niva_texts raw=%r", state.session_id, niva_texts)
+    # Each item is like "(119 dagar)" — filter to desktop section (first two)
+    niva_numbers = []
+    for t in niva_texts:
+        m = re.search(r"\((\d+)\s+dagar\)", t)
+        if m:
+            niva_numbers.append(int(m.group(1)))
+        if len(niva_numbers) == 2:
+            break
+
+    if len(niva_numbers) < 2:
+        raise ValueError(f"Expected 2 tier values, got {niva_numbers} from {niva_texts!r}")
+
+    sjukpenning_left, lagsta_niva_left = niva_numbers[0], niva_numbers[1]
+    logger.debug(
+        "[%s] sjukpenning_left=%d lagsta_niva_left=%d",
+        state.session_id, sjukpenning_left, lagsta_niva_left,
+    )
+
+    # Cross-check: sjukpenning_left + lagsta_niva_left should equal days_left
+    if sjukpenning_left + lagsta_niva_left != days_left:
+        logger.warning(
+            "Tier sum mismatch: sjukpenning=%d + lagstaniva=%d != days_left=%d [id=%s]",
+            sjukpenning_left, lagsta_niva_left, days_left, state.session_id,
+        )
+
+    # -- dubbeldagar remaining --
+    logger.debug("[%s] reading dubbeldagar (DUBBELDAG_KVAR)", state.session_id)
+    dubbeldag_text = await page.locator(_SEL.DUBBELDAG_KVAR).first.inner_text(timeout=5_000)
+    dubbeldagar_left = int(dubbeldag_text.strip())
+    logger.debug("[%s] dubbeldagar_left=%d", state.session_id, dubbeldagar_left)
+
+    # -- Derive tier totals (standard FK allocation per parent) --
+    # Standard: 195 sjukpenningnivå + 45 lägstanivå = 240 per parent.
+    # Transfers can change this, but the page doesn't expose the totals directly.
+    # Assumption: lägstanivå days are never used before sjukpenning (most common case).
+    lagsta_niva_total = 45  # standard per-parent lägstanivå allocation (= rules.lagsta_niva_days/2)
+    sjukpenning_total = total_days - lagsta_niva_total  # typically 195 for standard 240-day split
+    lagsta_niva_used = lagsta_niva_total - lagsta_niva_left
+    sjukpenning_used = sjukpenning_total - sjukpenning_left
+
+    # -- Derive reserved / transferable split --
+    # Reserved days (90 per parent) cannot be transferred; used assumption: transferable taken first.
+    reserved_days_total = settings.rules.reserved_days_per_parent  # 90
+    transferable_total = total_days - reserved_days_total  # 150 for standard 240-day case
+    transferable_used = min(days_used, transferable_total)
+    reserved_used = days_used - transferable_used
+    reserved_days_left = reserved_days_total - reserved_used
+    transferable_days_left = transferable_total - transferable_used
+
+    # -- Validate before returning --
+    if days_left < 0:
+        raise ValueError(f"days_left is negative ({days_left}) — FK data inconsistency")
+    if reserved_days_left > reserved_days_total:
+        raise ValueError(
+            f"reserved_days_left ({reserved_days_left}) > reserved_days_total ({reserved_days_total})"
+        )
+
+    now = datetime.now()
+    tier_data = TierData(
+        sjukpenning_total=sjukpenning_total,
+        sjukpenning_used=sjukpenning_used,
+        sjukpenning_left=sjukpenning_left,
+        lagsta_niva_total=lagsta_niva_total,
+        lagsta_niva_used=lagsta_niva_used,
+        lagsta_niva_left=lagsta_niva_left,
+    )
+
+    return ParentalLeaveFetch(
+        id=uuid.uuid4(),
+        personal_data_uuid=state.personal_data_uuid,
+        workspace_id=state.workspace_id,
+        child_id=state.child_id,
+        source="scraped",
+        fetched_at=now,
+        total_days=total_days,
+        days_used=days_used,
+        days_left=days_left,
+        reserved_days_total=reserved_days_total,
+        reserved_days_left=reserved_days_left,
+        transferable_days_left=transferable_days_left,
+        dubbeldagar_left=dubbeldagar_left,
+        tier_data=tier_data,
+        created_at=now,
+        updated_at=now,
+    )
diff --git a/backend/migrations/env.py b/backend/migrations/env.py
index 0c54894..9e2372c 100644
--- a/backend/migrations/env.py
+++ b/backend/migrations/env.py
@@ -12,9 +12,10 @@ from typing import Any
 
 from alembic import context
 
-# Load the alembic.ini logging config.
+# Load the alembic.ini logging config without disabling existing loggers —
+# when running inside the FastAPI app the app's own loggers must not be reset.
 if context.config.config_file_name is not None:
-    fileConfig(context.config.config_file_name)
+    fileConfig(context.config.config_file_name, disable_existing_loggers=False)
 
 
 def run_migrations_offline() -> None:
diff --git a/backend/migrations/versions/001_initial_schema.py b/backend/migrations/versions/001_initial_schema.py
index 10c76c2..f863f06 100644
--- a/backend/migrations/versions/001_initial_schema.py
+++ b/backend/migrations/versions/001_initial_schema.py
@@ -149,8 +149,14 @@ DROP TABLE IF EXISTS workspace;
 
 
 def upgrade() -> None:
-    op.execute(_UPGRADE_SQL)
+    from sqlalchemy import text
+
+    for stmt in [s.strip() for s in _UPGRADE_SQL.split(";") if s.strip()]:
+        op.execute(text(stmt))
 
 
 def downgrade() -> None:
-    op.execute(_DOWNGRADE_SQL)
+    from sqlalchemy import text
+
+    for stmt in [s.strip() for s in _DOWNGRADE_SQL.split(";") if s.strip()]:
+        op.execute(text(stmt))
diff --git a/backend/pyproject.toml b/backend/pyproject.toml
index 9dbab10..a13b6e0 100644
--- a/backend/pyproject.toml
+++ b/backend/pyproject.toml
@@ -8,6 +8,7 @@ dependencies = [
     "fastapi>=0.115",
     "uvicorn[standard]>=0.34",
     "pydantic>=2.9",
+    "pydantic[email]>=2.9",
     "pydantic-settings>=2.5",
     "aiosqlite>=0.20",
     # Auth
@@ -18,6 +19,8 @@ dependencies = [
     "greenlet>=3.1",      # required for alembic async support
     # Rate limiting
     "slowapi>=0.1.9",
+    # Headless browser scraper (optional — install Chromium separately: playwright install chromium)
+    "playwright>=1.47",
     # Tips engine
     "holidays>=0.62",
     "python-dateutil>=2.9",
diff --git a/backend/tests/unit/test_fk_scraper.py b/backend/tests/unit/test_fk_scraper.py
new file mode 100644
index 0000000..cb1be26
--- /dev/null
+++ b/backend/tests/unit/test_fk_scraper.py
@@ -0,0 +1,644 @@
+"""Tests for the FK scraper: extractor, validation, and session state machine.
+
+Three independent test concerns:
+
+1. _extract_parental_leave — parses the FK #/valjdagar HTML fixture and
+   produces a correct ParentalLeaveFetch.  No network, no BankID.
+
+2. Validation helpers — out-of-bounds numbers raise rather than persist.
+
+3. Session state machine — start/poll/cancel transitions, TTL auto-cancel,
+   double-cancel safety.  Browser is mocked; no headless Chromium needed.
+"""
+
+from __future__ import annotations
+
+import re
+import uuid
+from datetime import date, datetime
+from pathlib import Path
+from typing import Any
+from unittest.mock import AsyncMock, MagicMock, patch
+
+import pytest
+
+from app.entities.parental_leave import ParentalLeaveFetch, TierData
+from app.scrapers.fk_scraper import (
+    FKScraperService,
+    _SessionState,
+    _do_extract,
+    _set_status,
+    _sessions,
+)
+
+# ---------------------------------------------------------------------------
+# Helpers for the HTML-fixture tests
+# ---------------------------------------------------------------------------
+
+CAPTURES_DIR = Path(__file__).parents[3] / "captures"
+
+
+def _load_fixture(name: str) -> str:
+    """Read a page capture from captures/, skipping if not present."""
+    path = CAPTURES_DIR / name
+    if not path.exists():
+        pytest.skip(f"Fixture {name} not found — run the captures step first")
+    return path.read_text(encoding="utf-8")
+
+
+# ---------------------------------------------------------------------------
+# Minimal mock of a Playwright Page that answers our CSS queries from HTML
+# ---------------------------------------------------------------------------
+
+
+def _make_mock_page(html: str):
+    """
+    Build a minimal async mock page that serves inner_text / all_inner_texts
+    for the selectors used by _extract_parental_leave.
+
+    Uses basic regex over the fixture HTML rather than a real browser — fast
+    and dependency-free.
+    """
+    NIVA_SEL = "[data-test='forDig'] .visa-dagar__desktop .niva-statistik__dagar span"
+
+    def _for_dig_kvar() -> str:
+        m = re.search(
+            r'data-test="forDig".*?'
+            r'class="visa-dagar__dagar-kvar">(\d+)<',
+            html, re.DOTALL,
+        )
+        if m:
+            return m.group(1)
+        raise ValueError("No forDig dagar-kvar found in fixture")
+
+    def _for_dig_discrete() -> str:
+        m = re.search(
+            r'data-test="forDig".*?'
+            r'class="visa-dagar__discrete">(.*?)<',
+            html, re.DOTALL,
+        )
+        if m:
+            return m.group(1)
+        raise ValueError("No forDig discrete found in fixture")
+
+    def _dubbeldag_kvar() -> str:
+        m = re.search(
+            r'data-test="dubbeldag".*?'
+            r'class="visa-dagar__dagar-kvar">(\d+)<',
+            html, re.DOTALL,
+        )
+        if m:
+            return m.group(1)
+        raise ValueError("No dubbeldag dagar-kvar found in fixture")
+
+    def _niva_all_texts() -> list[str]:
+        m_block = re.search(
+            r'data-test="forDig"(.*?)data-test="footer"',
+            html, re.DOTALL,
+        )
+        block = m_block.group(1) if m_block else ""
+        desktop_m = re.search(r'visa-dagar__desktop(.*?)visa-dagar__mobile', block, re.DOTALL)
+        target = desktop_m.group(1) if desktop_m else block
+        return re.findall(r'\(\d+ dagar\)', target)
+
+    page = MagicMock()
+
+    def locator_factory(sel: str) -> MagicMock:
+        loc = MagicMock()
+        if sel == NIVA_SEL:
+            loc.first.inner_text = AsyncMock(return_value="")
+            loc.all_inner_texts = AsyncMock(return_value=_niva_all_texts())
+        elif "visa-dagar__dagar-kvar" in sel and "forDig" in sel:
+            loc.first.inner_text = AsyncMock(return_value=_for_dig_kvar())
+            loc.all_inner_texts = AsyncMock(return_value=[])
+        elif "visa-dagar__discrete" in sel and "forDig" in sel:
+            loc.first.inner_text = AsyncMock(return_value=_for_dig_discrete())
+            loc.all_inner_texts = AsyncMock(return_value=[])
+        elif "dubbeldag" in sel and "visa-dagar__dagar-kvar" in sel:
+            loc.first.inner_text = AsyncMock(return_value=_dubbeldag_kvar())
+            loc.all_inner_texts = AsyncMock(return_value=[])
+        else:
+            loc.first.inner_text = AsyncMock(return_value="")
+            loc.all_inner_texts = AsyncMock(return_value=[])
+        return loc
+
+    page.locator.side_effect = locator_factory
+    return page
+
+
+# ---------------------------------------------------------------------------
+# Extract from real HTML fixture
+# ---------------------------------------------------------------------------
+
+# Import the extractor directly (no browser needed)
+from app.scrapers.fk_scraper import _extract_parental_leave  # noqa: E402
+
+
+class TestExtractFromFixture:
+    """Parse the captured overview HTML and assert correct field values."""
+
+    async def test_days_left_and_total_parsed(self) -> None:
+        html = _load_fixture("05_foraldrapenning_overview.html")
+        state = _SessionState(
+            session_id="test-1",
+            workspace_id=uuid.uuid4(),
+            personal_data_uuid=uuid.uuid4(),
+            child_id=uuid.uuid4(),
+        )
+        page = _make_mock_page(html)
+        result = await _extract_parental_leave(page, state)
+        # From the capture: 164 av 240 dagar
+        assert result.days_left == 164
+        assert result.total_days == 240
+        assert result.days_used == 76
+
+    async def test_tier_values_parsed(self) -> None:
+        html = _load_fixture("05_foraldrapenning_overview.html")
+        state = _SessionState(
+            session_id="test-2",
+            workspace_id=uuid.uuid4(),
+            personal_data_uuid=uuid.uuid4(),
+            child_id=uuid.uuid4(),
+        )
+        page = _make_mock_page(html)
+        result = await _extract_parental_leave(page, state)
+        # From the capture: sjukpenning 119, lägstanivå 45
+        assert result.tier_data.sjukpenning_left == 119
+        assert result.tier_data.lagsta_niva_left == 45
+
+    async def test_dubbeldagar_parsed(self) -> None:
+        html = _load_fixture("05_foraldrapenning_overview.html")
+        state = _SessionState(
+            session_id="test-3",
+            workspace_id=uuid.uuid4(),
+            personal_data_uuid=uuid.uuid4(),
+            child_id=uuid.uuid4(),
+        )
+        page = _make_mock_page(html)
+        result = await _extract_parental_leave(page, state)
+        # From the capture: 39 av 60 dubbeldagar
+        assert result.dubbeldagar_left == 39
+
+    async def test_source_is_scraped(self) -> None:
+        html = _load_fixture("05_foraldrapenning_overview.html")
+        state = _SessionState(
+            session_id="test-4",
+            workspace_id=uuid.uuid4(),
+            personal_data_uuid=uuid.uuid4(),
+            child_id=uuid.uuid4(),
+        )
+        page = _make_mock_page(html)
+        result = await _extract_parental_leave(page, state)
+        assert result.source == "scraped"
+
+    async def test_reserved_days_derived(self) -> None:
+        html = _load_fixture("05_foraldrapenning_overview.html")
+        state = _SessionState(
+            session_id="test-5",
+            workspace_id=uuid.uuid4(),
+            personal_data_uuid=uuid.uuid4(),
+            child_id=uuid.uuid4(),
+        )
+        page = _make_mock_page(html)
+        result = await _extract_parental_leave(page, state)
+        # 76 days used < 150 transferable → all reserved days remain
+        assert result.reserved_days_total == 90
+        assert result.reserved_days_left == 90
+        assert result.transferable_days_left == 240 - 90 - 76  # 74
+
+    async def test_tier_totals_sum_to_total_days(self) -> None:
+        html = _load_fixture("05_foraldrapenning_overview.html")
+        state = _SessionState(
+            session_id="test-6",
+            workspace_id=uuid.uuid4(),
+            personal_data_uuid=uuid.uuid4(),
+            child_id=uuid.uuid4(),
+        )
+        page = _make_mock_page(html)
+        result = await _extract_parental_leave(page, state)
+        assert result.tier_data.sjukpenning_total + result.tier_data.lagsta_niva_total == result.total_days
+
+    async def test_tier_used_nonnegative(self) -> None:
+        html = _load_fixture("05_foraldrapenning_overview.html")
+        state = _SessionState(
+            session_id="test-7",
+            workspace_id=uuid.uuid4(),
+            personal_data_uuid=uuid.uuid4(),
+            child_id=uuid.uuid4(),
+        )
+        page = _make_mock_page(html)
+        result = await _extract_parental_leave(page, state)
+        assert result.tier_data.sjukpenning_used >= 0
+        assert result.tier_data.lagsta_niva_used >= 0
+
+
+# ---------------------------------------------------------------------------
+# Validation: bad numbers raise rather than persist
+# ---------------------------------------------------------------------------
+
+
+class TestValidation:
+    """Feed impossible numbers and assert the extractor raises."""
+
+    def _make_bad_page(self, days_left: int, total_days: int, sjukpenning: int, lagsta: int, dubbel: int) -> Any:
+        NIVA_SEL = "[data-test='forDig'] .visa-dagar__desktop .niva-statistik__dagar span"
+
+        page = MagicMock()
+
+        def locator_factory(sel: str) -> MagicMock:
+            loc = MagicMock()
+            if sel == NIVA_SEL:
+                loc.first.inner_text = AsyncMock(return_value="")
+                loc.all_inner_texts = AsyncMock(
+                    return_value=[f"({sjukpenning} dagar)", f"({lagsta} dagar)"]
+                )
+            elif "visa-dagar__dagar-kvar" in sel and "forDig" in sel:
+                loc.first.inner_text = AsyncMock(return_value=str(days_left))
+                loc.all_inner_texts = AsyncMock(return_value=[])
+            elif "visa-dagar__discrete" in sel and "forDig" in sel:
+                loc.first.inner_text = AsyncMock(
+                    return_value=f"av {total_days} dagar kvar efter ansökan"
+                )
+                loc.all_inner_texts = AsyncMock(return_value=[])
+            elif "dubbeldag" in sel:
+                loc.first.inner_text = AsyncMock(return_value=str(dubbel))
+                loc.all_inner_texts = AsyncMock(return_value=[])
+            else:
+                loc.first.inner_text = AsyncMock(return_value="")
+                loc.all_inner_texts = AsyncMock(return_value=[])
+            return loc
+
+        page.locator.side_effect = locator_factory
+        return page
+
+    def _state(self) -> _SessionState:
+        return _SessionState(
+            session_id="val-test",
+            workspace_id=uuid.uuid4(),
+            personal_data_uuid=uuid.uuid4(),
+            child_id=uuid.uuid4(),
+        )
+
+    async def test_negative_days_left_raises(self) -> None:
+        page = self._make_bad_page(-1, 240, 100, 45, 39)
+        with pytest.raises(ValueError, match="negative"):
+            await _extract_parental_leave(page, self._state())
+
+    async def test_total_days_parse_failure_raises(self) -> None:
+        NIVA_SEL = "[data-test='forDig'] .visa-dagar__desktop .niva-statistik__dagar span"
+        page = MagicMock()
+
+        def locator_factory(sel: str) -> MagicMock:
+            loc = MagicMock()
+            if sel == NIVA_SEL:
+                loc.first.inner_text = AsyncMock(return_value="")
+                loc.all_inner_texts = AsyncMock(return_value=["(80 dagar)", "(20 dagar)"])
+            elif "dagar-kvar" in sel and "forDig" in sel:
+                loc.first.inner_text = AsyncMock(return_value="100")
+                loc.all_inner_texts = AsyncMock(return_value=[])
+            elif "discrete" in sel and "forDig" in sel:
+                loc.first.inner_text = AsyncMock(return_value="INVALID TEXT")
+                loc.all_inner_texts = AsyncMock(return_value=[])
+            elif "dubbeldag" in sel:
+                loc.first.inner_text = AsyncMock(return_value="39")
+                loc.all_inner_texts = AsyncMock(return_value=[])
+            else:
+                loc.first.inner_text = AsyncMock(return_value="0")
+                loc.all_inner_texts = AsyncMock(return_value=[])
+            return loc
+
+        page.locator.side_effect = locator_factory
+        with pytest.raises(ValueError, match="parse total days"):
+            await _extract_parental_leave(page, self._state())
+
+    async def test_fewer_than_two_niva_values_raises(self) -> None:
+        NIVA_SEL = "[data-test='forDig'] .visa-dagar__desktop .niva-statistik__dagar span"
+        page = MagicMock()
+
+        def locator_factory(sel: str) -> MagicMock:
+            loc = MagicMock()
+            if sel == NIVA_SEL:
+                loc.first.inner_text = AsyncMock(return_value="")
+                loc.all_inner_texts = AsyncMock(return_value=["(119 dagar)"])  # only one
+            elif "dagar-kvar" in sel and "forDig" in sel:
+                loc.first.inner_text = AsyncMock(return_value="164")
+                loc.all_inner_texts = AsyncMock(return_value=[])
+            elif "discrete" in sel and "forDig" in sel:
+                loc.first.inner_text = AsyncMock(return_value="av 240 dagar kvar efter ansökan")
+                loc.all_inner_texts = AsyncMock(return_value=[])
+            elif "dubbeldag" in sel:
+                loc.first.inner_text = AsyncMock(return_value="39")
+                loc.all_inner_texts = AsyncMock(return_value=[])
+            else:
+                loc.first.inner_text = AsyncMock(return_value="0")
+                loc.all_inner_texts = AsyncMock(return_value=[])
+            return loc
+
+        page.locator.side_effect = locator_factory
+        with pytest.raises(ValueError, match="Expected 2 tier values"):
+            await _extract_parental_leave(page, self._state())
+
+
+# ---------------------------------------------------------------------------
+# Session state machine
+# ---------------------------------------------------------------------------
+
+
+class TestSessionStateMachine:
+    """Session transitions, TTL watchdog, and double-cancel safety."""
+
+    def setup_method(self) -> None:
+        _sessions.clear()
+
+    def teardown_method(self) -> None:
+        _sessions.clear()
+
+    async def test_start_session_creates_entry(self) -> None:
+        service = FKScraperService()
+        with patch("app.scrapers.fk_scraper._run_session", new_callable=AsyncMock) as mock_run:
+            mock_run.return_value = None
+            sid = await service.start_session(
+                workspace_id=uuid.uuid4(),
+                personal_data_uuid=uuid.uuid4(),
+                child_id=uuid.uuid4(),
+            )
+        assert sid in _sessions
+        assert _sessions[sid].status == "launching"
+
+    async def test_poll_unknown_session_returns_error(self) -> None:
+        service = FKScraperService()
+        result = await service.poll_session("nonexistent")
+        assert result["status"] == "error"
+        assert "Unknown" in result["message"]
+
+    async def test_poll_awaiting_scan_returns_qr_data(self) -> None:
+        service = FKScraperService()
+        sid = str(uuid.uuid4())
+        state = _SessionState(
+            session_id=sid,
+            workspace_id=uuid.uuid4(),
+            personal_data_uuid=uuid.uuid4(),
+            child_id=uuid.uuid4(),
+            status="awaiting_scan",
+            qr_data=b"PNG_BYTES",
+        )
+        _sessions[sid] = state
+
+        result = await service.poll_session(sid)
+        assert result["status"] == "awaiting_scan"
+        assert "qr_data" in result
+        import base64
+        assert base64.b64decode(result["qr_data"]) == b"PNG_BYTES"
+
+    async def test_cancel_sets_status(self) -> None:
+        service = FKScraperService()
+        sid = str(uuid.uuid4())
+        state = _SessionState(
+            session_id=sid,
+            workspace_id=uuid.uuid4(),
+            personal_data_uuid=uuid.uuid4(),
+            child_id=uuid.uuid4(),
+            status="awaiting_scan",
+        )
+        _sessions[sid] = state
+
+        await service.cancel_session(sid)
+        assert _sessions[sid].status == "cancelled"
+
+    async def test_cancel_nonexistent_session_is_safe(self) -> None:
+        service = FKScraperService()
+        await service.cancel_session("does-not-exist")  # should not raise
+
+    async def test_ttl_watchdog_cancels_stale_session(self) -> None:
+        from app.scrapers.fk_scraper import _ttl_watchdog
+
+        with patch("app.scrapers.fk_scraper.settings") as mock_settings:
+            mock_settings.scraper_session_ttl_seconds = 0  # immediate
+            sid = str(uuid.uuid4())
+            state = _SessionState(
+                session_id=sid,
+                workspace_id=uuid.uuid4(),
+                personal_data_uuid=uuid.uuid4(),
+                child_id=uuid.uuid4(),
+                status="awaiting_scan",
+            )
+            _sessions[sid] = state
+
+            await _ttl_watchdog(sid)
+
+            assert _sessions[sid].status == "error"
+            assert "timed out" in (_sessions[sid].message or "")
+
+    async def test_set_status_updates_message(self) -> None:
+        sid = str(uuid.uuid4())
+        state = _SessionState(
+            session_id=sid,
+            workspace_id=uuid.uuid4(),
+            personal_data_uuid=uuid.uuid4(),
+            child_id=uuid.uuid4(),
+        )
+        _set_status(state, "error", "Something went wrong")
+        assert state.status == "error"
+        assert state.message == "Something went wrong"
+
+    async def test_do_extract_calls_persist_callback_on_success(self) -> None:
+        """_do_extract invokes the persist_callback with the extracted result."""
+        persisted: list[ParentalLeaveFetch] = []
+
+        async def mock_persist(fetch: ParentalLeaveFetch) -> None:
+            persisted.append(fetch)
+
+        now = datetime.now()
+        expected = ParentalLeaveFetch(
+            id=uuid.uuid4(),
+            personal_data_uuid=uuid.uuid4(),
+            workspace_id=uuid.uuid4(),
+            child_id=uuid.uuid4(),
+            source="scraped",
+            fetched_at=now,
+            total_days=240,
+            days_used=76,
+            days_left=164,
+            reserved_days_total=90,
+            reserved_days_left=90,
+            transferable_days_left=74,
+            dubbeldagar_left=39,
+            tier_data=TierData(
+                sjukpenning_total=195,
+                sjukpenning_used=76,
+                sjukpenning_left=119,
+                lagsta_niva_total=45,
+                lagsta_niva_used=0,
+                lagsta_niva_left=45,
+            ),
+            created_at=now,
+            updated_at=now,
+        )
+
+        sid = str(uuid.uuid4())
+        state = _SessionState(
+            session_id=sid,
+            workspace_id=uuid.uuid4(),
+            personal_data_uuid=uuid.uuid4(),
+            child_id=uuid.uuid4(),
+            persist_callback=mock_persist,
+        )
+        _sessions[sid] = state
+
+        page = MagicMock()
+        page.wait_for_selector = AsyncMock()
+
+        def locator_factory(sel: str) -> MagicMock:
+            loc = MagicMock()
+            loc.first.click = AsyncMock()
+            return loc
+
+        page.locator.side_effect = locator_factory
+
+        with patch(
+            "app.scrapers.fk_scraper._extract_parental_leave", new_callable=AsyncMock
+        ) as mock_extract:
+            mock_extract.return_value = expected
+            await _do_extract(page, state)
+
+        assert state.status == "done"
+        assert state.result is expected
+        assert len(persisted) == 1
+        assert persisted[0] is expected
+
+    async def test_do_extract_sets_error_when_persist_callback_fails(self) -> None:
+        """_do_extract sets status=error if the persist_callback raises."""
+
+        async def failing_persist(fetch: ParentalLeaveFetch) -> None:
+            raise RuntimeError("DB unavailable")
+
+        now = datetime.now()
+        dummy = ParentalLeaveFetch(
+            id=uuid.uuid4(),
+            personal_data_uuid=uuid.uuid4(),
+            workspace_id=uuid.uuid4(),
+            child_id=uuid.uuid4(),
+            source="scraped",
+            fetched_at=now,
+            total_days=240,
+            days_used=0,
+            days_left=240,
+            reserved_days_total=90,
+            reserved_days_left=90,
+            transferable_days_left=150,
+            dubbeldagar_left=60,
+            tier_data=TierData(195, 0, 195, 45, 0, 45),
+            created_at=now,
+            updated_at=now,
+        )
+
+        sid = str(uuid.uuid4())
+        state = _SessionState(
+            session_id=sid,
+            workspace_id=uuid.uuid4(),
+            personal_data_uuid=uuid.uuid4(),
+            child_id=uuid.uuid4(),
+            persist_callback=failing_persist,
+        )
+        _sessions[sid] = state
+
+        page = MagicMock()
+        page.wait_for_selector = AsyncMock()
+
+        def locator_factory(sel: str) -> MagicMock:
+            loc = MagicMock()
+            loc.first.click = AsyncMock()
+            return loc
+
+        page.locator.side_effect = locator_factory
+
+        with patch(
+            "app.scrapers.fk_scraper._extract_parental_leave", new_callable=AsyncMock
+        ) as mock_extract:
+            mock_extract.return_value = dummy
+            await _do_extract(page, state)
+
+        assert state.status == "error"
+        assert "persist" in (state.message or "").lower()
+
+
+# ---------------------------------------------------------------------------
+# Persistence integration: real SQLite repo round-trip
+# ---------------------------------------------------------------------------
+
+
+class TestPersistenceIntegration:
+    """Run _do_extract with a real SQLiteParentalLeaveRepository and verify the row."""
+
+    def setup_method(self) -> None:
+        _sessions.clear()
+
+    def teardown_method(self) -> None:
+        _sessions.clear()
+
+    async def test_scraped_row_is_readable_after_session_done(
+        self, parental_leave_repo, seeded_ids
+    ) -> None:
+        """After _do_extract completes, repo.get_latest_by_parent returns the scraped row."""
+        from app.repositories_impl.sqlite.parental_leave_repository import (
+            SQLiteParentalLeaveRepository,
+        )
+
+        async def persist_callback(fetch: ParentalLeaveFetch) -> None:
+            await parental_leave_repo.create(fetch)
+
+        now = datetime.now()
+        scraped = ParentalLeaveFetch(
+            id=uuid.uuid4(),
+            personal_data_uuid=seeded_ids.personal_data_uuid,
+            workspace_id=seeded_ids.workspace_id,
+            child_id=seeded_ids.child_id,
+            source="scraped",
+            fetched_at=now,
+            total_days=240,
+            days_used=76,
+            days_left=164,
+            reserved_days_total=90,
+            reserved_days_left=90,
+            transferable_days_left=74,
+            dubbeldagar_left=39,
+            tier_data=TierData(195, 76, 119, 45, 0, 45),
+            created_at=now,
+            updated_at=now,
+        )
+
+        sid = str(uuid.uuid4())
+        state = _SessionState(
+            session_id=sid,
+            workspace_id=seeded_ids.workspace_id,
+            personal_data_uuid=seeded_ids.personal_data_uuid,
+            child_id=seeded_ids.child_id,
+            persist_callback=persist_callback,
+        )
+        _sessions[sid] = state
+
+        page = MagicMock()
+        page.wait_for_selector = AsyncMock()
+
+        def locator_factory(sel: str) -> MagicMock:
+            loc = MagicMock()
+            loc.first.click = AsyncMock()
+            return loc
+
+        page.locator.side_effect = locator_factory
+
+        with patch(
+            "app.scrapers.fk_scraper._extract_parental_leave", new_callable=AsyncMock
+        ) as mock_extract:
+            mock_extract.return_value = scraped
+            await _do_extract(page, state)
+
+        assert state.status == "done"
+
+        result = await parental_leave_repo.get_latest_by_parent(
+            seeded_ids.personal_data_uuid, seeded_ids.child_id
+        )
+        assert result is not None
+        assert result.source == "scraped"
+        assert result.days_left == 164
+        assert result.total_days == 240
diff --git a/backend/uv.lock b/backend/uv.lock
index 287848b..e8a0595 100644
--- a/backend/uv.lock
+++ b/backend/uv.lock
@@ -236,6 +236,28 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/84/d0/205d54408c08b13550c733c4b85429e7ead111c7f0014309637425520a9a/deprecated-1.3.1-py2.py3-none-any.whl", hash = "sha256:597bfef186b6f60181535a29fbe44865ce137a5079f295b479886c82729d5f3f", size = 11298, upload-time = "2025-10-30T08:19:00.758Z" },
 ]
 
+[[package]]
+name = "dnspython"
+version = "2.8.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/8c/8b/57666417c0f90f08bcafa776861060426765fdb422eb10212086fb811d26/dnspython-2.8.0.tar.gz", hash = "sha256:181d3c6996452cb1189c4046c61599b84a5a86e099562ffde77d26984ff26d0f", size = 368251, upload-time = "2025-09-07T18:58:00.022Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/ba/5a/18ad964b0086c6e62e2e7500f7edc89e3faa45033c71c1893d34eed2b2de/dnspython-2.8.0-py3-none-any.whl", hash = "sha256:01d9bbc4a2d76bf0db7c1f729812ded6d912bd318d3b1cf81d30c0f845dbf3af", size = 331094, upload-time = "2025-09-07T18:57:58.071Z" },
+]
+
+[[package]]
+name = "email-validator"
+version = "2.3.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "dnspython" },
+    { name = "idna" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/f5/22/900cb125c76b7aaa450ce02fd727f452243f2e91a61af068b40adba60ea9/email_validator-2.3.0.tar.gz", hash = "sha256:9fc05c37f2f6cf439ff414f8fc46d917929974a82244c20eb10231ba60c54426", size = 51238, upload-time = "2025-08-26T13:09:06.831Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/de/15/545e2b6cf2e3be84bc1ed85613edd75b8aea69807a71c26f4ca6a9258e82/email_validator-2.3.0-py3-none-any.whl", hash = "sha256:80f13f623413e6b197ae73bb10bf4eb0908faf509ad8362c5edeb0be7fd450b4", size = 35604, upload-time = "2025-08-26T13:09:05.858Z" },
+]
+
 [[package]]
 name = "fastapi"
 version = "0.136.3"
@@ -263,7 +285,8 @@ dependencies = [
     { name = "fastapi" },
     { name = "greenlet" },
     { name = "holidays" },
-    { name = "pydantic" },
+    { name = "playwright" },
+    { name = "pydantic", extra = ["email"] },
     { name = "pydantic-settings" },
     { name = "pyjwt" },
     { name = "python-dateutil" },
@@ -294,7 +317,9 @@ requires-dist = [
     { name = "fastapi", specifier = ">=0.115" },
     { name = "greenlet", specifier = ">=3.1" },
     { name = "holidays", specifier = ">=0.62" },
+    { name = "playwright", specifier = ">=1.47" },
     { name = "pydantic", specifier = ">=2.9" },
+    { name = "pydantic", extras = ["email"], specifier = ">=2.9" },
     { name = "pydantic-settings", specifier = ">=2.5" },
     { name = "pyjwt", specifier = ">=2.9" },
     { name = "python-dateutil", specifier = ">=2.9" },
@@ -513,6 +538,25 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/df/b2/87e62e8c3e2f4b32e5fe99e0b86d576da1312593b39f47d8ceef365e95ed/packaging-26.2-py3-none-any.whl", hash = "sha256:5fc45236b9446107ff2415ce77c807cee2862cb6fac22b8a73826d0693b0980e", size = 100195, upload-time = "2026-04-24T20:15:22.081Z" },
 ]
 
+[[package]]
+name = "playwright"
+version = "1.60.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "greenlet" },
+    { name = "pyee" },
+]
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/21/f0/832bd9677194908da118064eef20082f2791e3d18215cc6d9391ee2c5a67/playwright-1.60.0-py3-none-macosx_10_13_x86_64.whl", hash = "sha256:6a8cd0fec171fb3089e95e898c8bc8a6f35dea0b78b399e12fcc19427e91b1d7", size = 43474635, upload-time = "2026-05-18T12:00:31.969Z" },
+    { url = "https://files.pythonhosted.org/packages/59/7b/e1d32ae8a3ed937ec2be3721c5f728b13d731a0b7c6442e0b3bec5094ac0/playwright-1.60.0-py3-none-macosx_11_0_arm64.whl", hash = "sha256:39b5420ba6145045b69ced4c5c47d4d9fe5bddfc8ff816c518913afcb25ec7a5", size = 42261327, upload-time = "2026-05-18T12:00:35.638Z" },
+    { url = "https://files.pythonhosted.org/packages/d7/bc/23de499ded6411c188a20c5a0dea6f0cd4ed5d2b3cc6042a5dbd3ed609aa/playwright-1.60.0-py3-none-macosx_11_0_universal2.whl", hash = "sha256:2581d0e6a3392c71f91b27460c7fd093356818dc430f48153896c8aeeaef7705", size = 43474636, upload-time = "2026-05-18T12:00:39.294Z" },
+    { url = "https://files.pythonhosted.org/packages/22/7b/1d679f4fced4ea94efadd17103856d8c565384f68382a1681264e46f5925/playwright-1.60.0-py3-none-manylinux1_x86_64.whl", hash = "sha256:1c2bfae7884fb3fb05b853290eab8f343d524e5016f2f1def702acbbdf14c93e", size = 47467220, upload-time = "2026-05-18T12:00:43.179Z" },
+    { url = "https://files.pythonhosted.org/packages/84/c2/1528d267d4442bd2c6b8eaeab819dd52c2030bf80e89293f0ba1f687473b/playwright-1.60.0-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:43e66564125ee31b07a58cefb21e256d62d67d8d1713e6858df7a3019d8ed353", size = 47154856, upload-time = "2026-05-18T12:00:46.715Z" },
+    { url = "https://files.pythonhosted.org/packages/bb/4e/b008b6440a7a1624378041da94829956d4b8f7ab9ef5aad22d0dc3f2e26d/playwright-1.60.0-py3-none-win32.whl", hash = "sha256:ec94e416ea320711e0ad4bf185dcbf41833672961e90773e1885255d7db7b7e7", size = 37902157, upload-time = "2026-05-18T12:00:50.374Z" },
+    { url = "https://files.pythonhosted.org/packages/55/f0/0541524133104f9cc20bf900870ff4a736b76a23483f3a55295ddfa58409/playwright-1.60.0-py3-none-win_amd64.whl", hash = "sha256:9566821ce6030a1f9e7146a24e19355ab0d98805fd0f9be50bb3d8fef1750c02", size = 37902159, upload-time = "2026-05-18T12:00:53.728Z" },
+    { url = "https://files.pythonhosted.org/packages/80/c8/210f282d278e4709cdd71b12a31af45a30a22ab3207b387e29b37e478713/playwright-1.60.0-py3-none-win_arm64.whl", hash = "sha256:6e4f6700a4c2250efff8e690a81d66e3855754fb587b6b87cf5c784014f91537", size = 34037981, upload-time = "2026-05-18T12:00:57.584Z" },
+]
+
 [[package]]
 name = "pluggy"
 version = "1.6.0"
@@ -546,6 +590,11 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/fd/7b/122376b1fd3c62c1ed9dc80c931ace4844b3c55407b6fb2d199377c9736f/pydantic-2.13.4-py3-none-any.whl", hash = "sha256:45a282cde31d808236fd7ea9d919b128653c8b38b393d1c4ab335c62924d9aba", size = 472262, upload-time = "2026-05-06T13:43:02.641Z" },
 ]
 
+[package.optional-dependencies]
+email = [
+    { name = "email-validator" },
+]
+
 [[package]]
 name = "pydantic-core"
 version = "2.46.4"
@@ -601,6 +650,18 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/ae/8d/f1af3832f5e6eb13ba94ee809e72b8ecb5eef226d27ee0bef7d963d943c7/pydantic_settings-2.14.1-py3-none-any.whl", hash = "sha256:6e3c7edfd8277687cdc598f56e5cff0e9bfff0910a3749deaa8d4401c3a2b9de", size = 60964, upload-time = "2026-05-08T13:40:04.958Z" },
 ]
 
+[[package]]
+name = "pyee"
+version = "13.0.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "typing-extensions" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/8b/04/e7c1fe4dc78a6fdbfd6c337b1c3732ff543b8a397683ab38378447baa331/pyee-13.0.1.tar.gz", hash = "sha256:0b931f7c14535667ed4c7e0d531716368715e860b988770fc7eb8578d1f67fc8", size = 31655, upload-time = "2026-02-14T21:12:28.044Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/a0/c4/b4d4827c93ef43c01f599ef31453ccc1c132b353284fc6c87d535c233129/pyee-13.0.1-py3-none-any.whl", hash = "sha256:af2f8fede4171ef667dfded53f96e2ed0d6e6bd7ee3bb46437f77e3b57689228", size = 15659, upload-time = "2026-02-14T21:12:26.263Z" },
+]
+
 [[package]]
 name = "pygments"
 version = "2.20.0"
diff --git a/data_refresh_plan.md b/data_refresh_plan.md
new file mode 100644
index 0000000..989bdd2
--- /dev/null
+++ b/data_refresh_plan.md
@@ -0,0 +1,268 @@
+# Data Refresh Plan — Försäkringskassan BankID Scraper + `login` Test Harness
+
+**Owner:** Senior developer
+**Status:** Ready to implement
+**Last updated:** 2026-06-12
+
+This plan covers the **data-acquisition (scraping) part only**: a headless browser that logs into Försäkringskassan via BankID (QR code), shows the QR to the user so they can scan it, then navigates and pulls the parental-leave figures. It also covers a local **`login` test harness** (a dev web page with a "Refresh" button → QR → fetched data) so we can iterate without ceremony.
+
+It deliberately slots into the existing architecture rather than inventing new contracts. The interfaces, entities, and endpoint stubs already exist — this plan fills in the real implementation behind them.
+
+---
+
+## 0. Decisions locked for this work
+
+These were confirmed with the product owner; do not re-litigate without checking back.
+
+1. **Scraper runtime = Playwright for Python, inside the existing backend.** The implementation lives in `backend/app/scrapers/fk_scraper.py` behind the existing `FetchDataService` / `FKScraperService` contract. We do **not** spin up a separate Node scraper service. `npm run login` is a thin dev convenience wrapper, not a second implementation.
+2. **QR handling = relay Försäkringskassan's own rendered QR.** FK controls the BankID session; its login page renders the animated QR itself. We screenshot / extract that QR element and stream it to our page. We do **not** integrate with the BankID API directly, start our own BankID order, or handle order references / certificates. This keeps us out of the BankID protocol entirely.
+3. **Page captures from product owner = HTML + PNG per page**, plus a one-line note of which element to click and the URL/hash at that step. See §6 for the exact capture protocol.
+4. **Legal gate still applies.** Scraping ships disabled (`settings.scraper_enabled = False`) until the legal/ToS + BankID-automation review in ARCHITECTURE §2.3 clears. This plan builds the capability; it does not flip the switch for public launch. Local/dev testing runs with the flag on in a dev profile only.
+
+---
+
+## 1. Where this fits in the existing codebase
+
+The scaffolding is already in place — read these before writing code:
+
+| File | What's there now | What this plan adds |
+|---|---|---|
+| `backend/app/scrapers/fk_scraper.py` | `FKScraperService` stub: `start_bankid_session`, `poll_session`, `cancel_session`, `get_latest`, `list_history` all raise `NotImplementedError` behind a legal-gate message. | Real Playwright implementation of the session lifecycle + extraction. |
+| `backend/app/services/fetch_data_service.py` | `FetchDataService` ABC + `ManualFetchService` (the always-works fallback). | No change to the contract. `FKScraperService` must satisfy the same ABC so the rest of the app stays decoupled from FK's DOM. |
+| `backend/app/routers/fetch_data.py` | `/api/fetch-data/start|poll|cancel` return **501** when `scraper_enabled` is false. Manual endpoints are live. | Wire these three to the real `FKScraperService`; keep the 501 guard for when the flag is off. |
+| `backend/app/entities/parental_leave.py` | `ParentalLeaveFetch` + `TierData` — the **stable contract** the scraper must produce. | Scraper outputs this exact shape with `source='scraped'`. |
+| `backend/app/config.py` | `scraper_enabled: bool = False`. | Add the scraper config block in §7 (timeouts, headless flag, dev profile). |
+| `backend/app/models/parental_leave.py` | Pydantic request/response schemas incl. field bounds (`total_days` 0–480, `dubbeldagar_left` 0–60, etc.). | Reuse for validating scraped output before persisting. |
+
+**Golden rule (from ARCHITECTURE §2.3):** every FK-specific selector and flow detail lives *only* inside `fk_scraper.py`. The rest of the app depends on `ParentalLeaveFetch`, never on FK's markup. If FK changes their site, exactly one file should need editing.
+
+---
+
+## 2. The data we must extract (target contract)
+
+The scraper's job is to populate a `ParentalLeaveFetch` (see `entities/parental_leave.py`). These are the fields and where they come from on FK's "Ansök och planera föräldrapenning" pages. Use the captures (§6) to confirm exact Swedish labels and the page each lives on.
+
+| Field | Meaning | Notes |
+|---|---|---|
+| `total_days` | Total föräldrapenning days for the child | Per parent; whole days only (no fractional). |
+| `days_used` | Days already taken | |
+| `days_left` | Derived = `total_days - days_used` | Don't trust a displayed "left" blindly — recompute and cross-check; flag mismatch. |
+| `reserved_days_total` | Reserved (non-transferable) days, default 90 | |
+| `reserved_days_left` | Reserved days remaining | Must be ≤ `reserved_days_total`. |
+| `transferable_days_left` | Transferable days remaining | |
+| `dubbeldagar_left` | Double-days remaining, max 60 (first 15 months only) | |
+| `tier_data.sjukpenning_total/used/left` | Sjukpenningnivå tier (the ~390 income-based days) | `left = total - used`. |
+| `tier_data.lagsta_niva_total/used/left` | Lägstanivå tier (the 90 flat-rate days) | `left = total - used`. |
+| `source` | `'scraped'` | Set by scraper. Manual entry uses `'manual'`. |
+| `fetched_at` | Timestamp of this fetch | |
+
+**Validation before persisting:** reuse the bounds in `ManualFetchRequest` and the invariants `ManualFetchService.save_manual_entry` already enforces (`days_left >= 0`, `reserved_days_left <= reserved_days_total`). If FK's numbers violate an invariant, do **not** silently persist — return an `error` status with a clear message so we can fix the parser. Scraping a wrong number into the planner is worse than failing loudly.
+
+---
+
+## 3. Session lifecycle / state machine
+
+Because FK owns the BankID session, our flow is a long-lived, polled session that mirrors what FK shows. One headless browser context per session.
+
+```
+start ──▶ launching ──▶ awaiting_scan ──▶ authenticating ──▶ fetching ──▶ done
+                              │                  │                │
+                              └──────────────────┴────────────────┴────▶ error / cancelled / timeout
+```
+
+**Statuses returned to the client (`poll`):**
+
+- `launching` — browser starting, navigating to the login URL.
+- `awaiting_scan` — QR is being shown. `poll` returns the **current** QR image (base64 PNG). The QR animates (BankID refreshes it roughly once per second), so each `poll` re-captures it.
+- `authenticating` — user scanned; BankID/FK is completing auth.
+- `fetching` — authenticated; scraper is navigating FK pages and reading values.
+- `done` — `result` contains the `ParentalLeaveFetchResponse`. Browser context is torn down and cookies/session discarded.
+- `error` — `message` explains what broke (selector miss, timeout, validation failure). Browser torn down.
+- `cancelled` — user/cancel endpoint stopped it. Browser torn down.
+
+**Endpoint contracts** (already stubbed in `routers/fetch_data.py`):
+
+```
+POST /api/fetch-data/start
+  body: { workspace_id, personal_data_uuid, child_id }
+  → 200 { session_id, status: "launching" }
+  → 501 if scraper_enabled is false
+
+GET  /api/fetch-data/poll?session_id=...
+  → 200 { status, qr_data?: base64png, result?: ParentalLeaveFetchResponse, message?: string }
+
+POST /api/fetch-data/cancel
+  body: { session_id }
+  → 200 { status: "cancelled" }
+```
+
+**Session store:** in-memory dict `session_id -> SessionState` (Playwright context handle + status + latest QR bytes + result + created_at). This is fine because the scraper runs in a single sandboxed worker and sessions are ephemeral. **Never persist** the context, cookies, or QR to disk or DB.
+
+**Timeouts:** auto-cancel any session that sits in `awaiting_scan`/`authenticating` longer than a configurable TTL (default 180s) and tear down the browser. Belt-and-suspenders against orphaned headless Chromiums.
+
+**Concurrency for v1:** one active scrape session at a time is acceptable for the test harness. Note it as a known limitation; a session pool/queue is a later concern.
+
+---
+
+## 4. Playwright login + navigation flow
+
+Implement in `fk_scraper.py`. Pseudocode of the happy path — exact selectors come from the §6 captures.
+
+```python
+# 1. Launch
+browser = await playwright.chromium.launch(headless=settings.scraper_headless)
+context = await browser.new_context(locale="sv-SE")   # Swedish UI for stable labels
+page = await context.new_page()
+
+# 2. Go to login, choose BankID med QR-kod
+await page.goto(LOGIN_URL, wait_until="networkidle")   # the goto= deep link from §5
+await page.get_by_role("button", name="BankID med QR-kod").click()   # confirm via capture
+
+# 3. Relay the QR (loop while status == awaiting_scan)
+qr = page.locator(QR_SELECTOR)            # the <img>/<canvas> FK renders — confirm via capture
+png = await qr.screenshot()               # re-capture each poll; QR animates
+session.qr_data = base64(png)
+
+# 4. Detect auth success — wait for the post-login landing element to appear
+await page.wait_for_selector(POST_LOGIN_MARKER, timeout=...)   # transitions us to "fetching"
+
+# 5. Navigate to the parental-leave figures and read them
+#    (FK is a SPA using hash routing — prefer in-app nav/clicks over raw goto where possible,
+#     and wait_for_selector on the data element, not arbitrary sleeps)
+data = await extract_parental_leave(page)   # returns dict mapped to ParentalLeaveFetch
+
+# 6. Tear down — always, even on error
+await context.close(); await browser.close()
+```
+
+**SPA notes (important):** the login URL uses hash routing (`.../logga-in#/?goto=...`), so FK is a single-page app (React/Angular-style). Two consequences:
+- Don't rely on full-page loads between steps. Use `wait_for_selector` / `expect(...).to_be_visible()` on the specific element you need, never `sleep(n)`.
+- Re-navigation by changing the hash may not trigger what you expect; prefer clicking the in-app navigation elements the user identifies in the captures.
+
+**QR selector:** confirm from the capture whether FK renders the QR as an `<img src="data:image/png;base64,...">`, a `<canvas>`, or an `<svg>`. Screenshotting the element handles all three uniformly and is the most robust (decision §0.2), so default to `locator.screenshot()` rather than reading the src.
+
+---
+
+## 5. The login URL
+
+Target deep link (from product owner):
+
+```
+https://www.forsakringskassan.se/privatperson/logga-in#/?goto=%2Fprivatperson%2Fmina-sidor%2Falla-e-tjanster%2Fansok-och-planera-foraldrapenning
+```
+
+The `goto` param routes the user, after BankID auth, straight to "Ansök och planera föräldrapenning." Keep this URL as a single constant at the top of `fk_scraper.py`. If FK changes the routing, this plus the selectors are the only things to update.
+
+---
+
+## 6. What I need from you (page-capture protocol)
+
+This is the highest-leverage thing you can give me to make the scraper succeed first try. For **each page in the flow**, capture all three of:
+
+1. **HTML** — the full rendered DOM at that moment. Best method: open DevTools → Elements → right-click `<html>` (or the relevant container) → **Copy → Copy outerHTML**, paste into a `.html` file. (Plain "Save page as → Webpage, Complete" also works but DevTools outerHTML reflects the live SPA state better.) This is what I write selectors from — **prefer pages where I can see `data-testid`, `id`, `name`, or `aria-label` attributes**.
+2. **PNG** — a screenshot of the same page (full page if possible).
+3. **A one-line note** with: (a) the **URL/hash** in the address bar, (b) **which element to click** to get to the next step (describe it: visible text + roughly where), and (c) anything conditional ("this dialog only appears the first time").
+
+**Naming convention** so I can order them:
+
+```
+captures/
+  01_login_landing.html / .png
+  02_after_bankid_qr_button.html / .png   ← the QR screen
+  03_after_bankid_qr_scanned.html / .png
+  04_post_login_landing.html / .png ← where total/used/left live including sjukpenningnivå vs lägstanivå
+  05_foraldrapenning_overview.html / .png ← where total/used/left live including sjukpenningnivå vs lägstanivå including for user vs total for child (to know what the user has vs the partner has)
+```
+
+**Pages I specifically need** (map to the data in §2): the login landing (so I find the "BankID med QR-kod" button), the QR screen (so I find the QR element), the post-login landing (so I know auth succeeded), and every page that shows: total/used/remaining days, the reserved-vs-transferable split, dubbeldagar remaining, and the sjukpenningnivå-vs-lägstanivå tier breakdown.
+
+**Privacy when capturing:** these are *your own* real pages, so **redact before sharing** — black out / overwrite your personnummer, name, and the child's identifiers in both the PNG and HTML. I only need the **structure and the Swedish labels**, not your actual values. (If it's easier, replace digits with `0`s — keep the surrounding markup intact.) Do not commit captures with real personal data to git; keep `captures/` git-ignored.
+
+---
+
+## 7. The `login` test harness (`npm run login`)
+
+Goal: one command spins up everything, you open a dev page, click **Refresh**, the **QR appears**, you scan, and the **fetched data renders**. Used for iterating on the scraper, not a shipped feature.
+
+**Command** (in `frontend/package.json`):
+
+```jsonc
+"scripts": {
+  "login": "concurrently -k -n backend,web \"npm:login:backend\" \"npm:login:web\"",
+  "login:backend": "cd ../backend && SCRAPER_ENABLED=true SCRAPER_HEADLESS=true uv run uvicorn app.main:app --reload --port 8000",
+  "login:web": "vite --open /dev/fetch"
+}
+```
+
+Add `concurrently` to frontend devDependencies. (If you'd rather not add it, a tiny `scripts/login.mjs` that spawns both processes works too — implementer's choice.)
+
+**Dev-only page `/dev/fetch`:**
+- A single route, mounted **only when `import.meta.env.DEV`** (never bundled into production builds).
+- A **Refresh** button → `POST /api/fetch-data/start` → then polls `GET /api/fetch-data/poll?session_id=...` every ~1s.
+- Renders by status: `awaiting_scan` → show `<img src="data:image/png;base64,{qr_data}">` (refreshes each poll as the QR animates); `authenticating`/`fetching` → spinner + status text; `done` → pretty-print the `ParentalLeaveFetchResponse` JSON in a `<pre>`; `error` → show `message`.
+- A **Cancel** button → `POST /api/fetch-data/cancel`.
+- Keep it dumb and dependency-free — it's a harness. This is also the seed for the eventual real `QRCodeModal.tsx` (referenced in ARCHITECTURE §UI), but don't gold-plate it yet.
+
+**Dev profile note:** `SCRAPER_ENABLED=true` here only flips the local dev backend. The committed default in `config.py` stays `False`. Document in the harness page header that this is running the *real* FK scraper against the *real* site with *your* BankID — so only run it intentionally.
+
+**Auth:** the scraper endpoints require `CurrentUserDep`. The dev page needs a logged-in app session (the app's own auth, not BankID) to call them. Either log in through the normal app flow first, or add a dev-only token shortcut — note which you chose.
+
+---
+
+## 8. Security & legal guardrails (non-negotiable, from §2.3)
+
+- **Never store BankID credentials or the FK session.** No cookies, tokens, or QR payloads to disk or DB. The browser context is discarded the moment the fetch completes or fails.
+- **Act only on the authenticated user's own data, with active consent each session.** No background/scheduled scraping. A session starts only from an explicit user action.
+- **Sandbox the browser.** Run Playwright/Chromium in a dedicated, locked-down container in any non-local environment (own network egress rules, no access to other services, ephemeral filesystem). Document the container setup as part of this work.
+- **Log no personal data.** Logs may record status transitions and timings, never names, personnummer, day counts, or page content. Scrub before logging.
+- **Keep the flag off for public launch** until the legal/ToS + BankID-automation review clears (§2.3, open question §1372 in ARCHITECTURE). This work delivers the *capability*; the go/no-go is a separate product+legal decision.
+- **Manual fallback stays first-class.** The planner must remain fully usable with `ManualFetchService` alone if scraping is disabled, blocked, or broken. Don't introduce any hard dependency on the scraper.
+
+---
+
+## 9. Robustness & maintainability
+
+- **One file owns FK's DOM.** All selectors/flow in `fk_scraper.py`. Consider a small `_selectors.py` constant block at the top so a site change is a one-place edit.
+- **Selector priority:** role/label/test-id > stable `id`/`name` > structural CSS/XPath. Avoid brittle nth-child chains and auto-generated class hashes.
+- **No fixed sleeps.** Always `wait_for_selector` / `expect().to_be_visible()` with sane timeouts.
+- **Fail loud, fail clean.** On any selector miss or invariant violation, set status `error` with a specific message and tear down. Never persist partial/guessed data.
+- **Swedish locale** on the context so labels match the captures.
+- **Idempotent teardown** — closing the context/browser must run in a `finally` so a crash never leaks a Chromium process.
+
+---
+
+## 10. Testing strategy
+
+- **Unit-test the extractor against saved HTML fixtures.** Take the captured `.html` files (redacted), load them into a Playwright page via `set_content` (or parse with the same selectors), and assert the extractor produces the right `ParentalLeaveFetch`. This is the test that protects us from FK markup changes and runs in CI with **no network and no BankID**.
+- **Unit-test the validation layer** — feed out-of-bounds / inconsistent numbers, assert it raises rather than persists.
+- **Unit-test the session state machine** — transitions, timeout auto-cancel, double-cancel safety — with the browser mocked.
+- **Manual E2E via `npm run login`** — the only step that needs a real BankID; done by hand, not in CI.
+- Keep the existing `ManualFetchService` tests green; the contract must not change.
+
+---
+
+## 11. Build order / milestones
+
+1. **Add config** (`scraper_headless`, `scraper_session_ttl_seconds`, dev profile) to `config.py`; add Playwright to `backend/pyproject.toml` dev deps and document `playwright install chromium`.
+2. **Session state machine + endpoints** wired to `FKScraperService`, with the QR-relay and poll contract — using a **mocked/stub page** first so the harness works end-to-end before real FK selectors exist.
+3. **`npm run login` harness + `/dev/fetch` page** — prove the start→poll→QR→result loop against the stub.
+4. **Receive captures (§6)** → implement the real login + QR-relay against FK.
+5. **Implement the extractor** for each data field (§2) → fixture tests from the captures.
+6. **Real E2E** via the harness with a live BankID scan; iterate on selectors.
+7. **Security/sandbox container** setup + the §8 review checklist; confirm flag stays off for prod.
+
+Milestones 2–3 are unblocked **today** (they don't need the captures). Milestones 4–6 are blocked on the §6 captures — that's the critical path, so prioritise producing those.
+
+---
+
+## 12. Open questions to resolve as we go
+
+- Exact Swedish labels and which page each datapoint sits on — answered by the captures.
+- Does FK gate "Ansök och planera föräldrapenning" behind an extra consent/child-selection step? If so, capture that page too (likely `03b_...`).
+- Multiple children: does the overview list per-child, requiring a child selection that we map to `child_id`? Capture the selector if so.
+- Whether the QR is `<img>`/`<canvas>`/`<svg>` — we default to element screenshot regardless, but good to know.
+
+---
+
+### TL;DR for the implementer
+Build the real `FKScraperService` with Playwright-Python behind the existing `FetchDataService` contract, driving FK's own BankID-QR login and **relaying FK's rendered QR** (no BankID API). Expose it through the already-stubbed `start/poll/cancel` endpoints as a polled session state machine. Add a dev-only `npm run login` harness (`/dev/fetch` page: Refresh → QR → JSON result) so we can iterate. Keep every FK selector in one file, never persist credentials/session, fail loud on bad data, and keep the manual fallback first-class. Ships disabled until legal sign-off. Milestones 2–3 start now; 4–6 wait on the page captures (§6) — that's the critical path.
diff --git a/frontend/eslint.config.js b/frontend/eslint.config.js
index 7e00c5e..4a992da 100644
--- a/frontend/eslint.config.js
+++ b/frontend/eslint.config.js
@@ -33,7 +33,7 @@ export default [
     },
   },
   {
-    files: ['src/**/*.test.ts', 'src/**/*.test.tsx', 'src/pages/**/*.tsx'],
+    files: ['src/**/*.test.ts', 'src/**/*.test.tsx'],
     rules: {
       '@typescript-eslint/no-explicit-any': 'off',
     },
diff --git a/frontend/package.json b/frontend/package.json
index 0d3600e..3528929 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -4,13 +4,18 @@
   "private": true,
   "type": "module",
   "scripts": {
-    "dev": "vite",
+    "dev": "concurrently -k -n backend,web \"npm:dev:backend\" \"npm:dev:web\"",
+    "dev:backend": "cd ../backend && uv run uvicorn app.main:app --reload --port 8000",
+    "dev:web": "vite",
     "build": "tsc && vite build",
     "preview": "vite preview",
     "lint": "eslint src tests --ext ts,tsx --max-warnings 0",
     "test": "vitest run",
     "test:watch": "vitest",
-    "coverage": "vitest run --coverage"
+    "coverage": "vitest run --coverage",
+    "login": "concurrently -k -n backend,web \"npm:login:backend\" \"npm:login:web\"",
+    "login:backend": "cd ../backend && APP_SCRAPER_ENABLED=true APP_SCRAPER_HEADLESS=true uv run uvicorn app.main:app --reload --port 8000",
+    "login:web": "vite --open /dev/fetch"
   },
   "dependencies": {
     "react": "^18.3.1",
@@ -27,6 +32,7 @@
     "@typescript-eslint/parser": "^8.15.0",
     "@vitejs/plugin-react": "^4.3.3",
     "@vitest/coverage-v8": "^2.1.6",
+    "concurrently": "^9.2.1",
     "eslint": "^9.15.0",
     "eslint-plugin-react": "^7.37.2",
     "eslint-plugin-react-hooks": "^5.0.0",
diff --git a/frontend/src/App.tsx b/frontend/src/App.tsx
index 3de4890..76dd89e 100644
--- a/frontend/src/App.tsx
+++ b/frontend/src/App.tsx
@@ -6,6 +6,7 @@ import { Calendar } from '@/pages/Calendar'
 import { Dashboard } from '@/pages/Dashboard'
 import { Settings } from '@/pages/Settings'
 import { Tips } from '@/pages/Tips'
+import { DevFetch } from '@/pages/DevFetch'
 
 function RequireAuth({ children }: { children: React.ReactNode }) {
   const { isAuthenticated, isLoading } = useAuth()
@@ -50,6 +51,9 @@ function AppRoutes() {
           </RequireAuth>
         }
       />
+      {import.meta.env.DEV && (
+        <Route path="/dev/fetch" element={<DevFetch />} />
+      )}
       <Route path="*" element={<Navigate to="/" replace />} />
     </Routes>
   )
diff --git a/frontend/src/components/dashboard/ParentalLeaveBreakdown.test.tsx b/frontend/src/components/dashboard/ParentalLeaveBreakdown.test.tsx
new file mode 100644
index 0000000..29992f8
--- /dev/null
+++ b/frontend/src/components/dashboard/ParentalLeaveBreakdown.test.tsx
@@ -0,0 +1,89 @@
+import { describe, it, expect } from 'vitest'
+import { render, screen } from '@testing-library/react'
+import { ParentalLeaveBreakdown } from './ParentalLeaveBreakdown'
+import type { ParentalLeaveFetch } from '@/types'
+
+describe('ParentalLeaveBreakdown', () => {
+  const mockData: ParentalLeaveFetch = {
+    id: 'pf1',
+    personalDataUuid: 'pd1',
+    workspaceId: 'ws1',
+    childId: 'c1',
+    source: 'scraped',
+    fetchedAt: '2026-06-13T10:00:00Z',
+    totalDays: 300,
+    daysUsed: 50,
+    daysLeft: 250,
+    reservedDaysTotal: 90,
+    reservedDaysLeft: 80,
+    transferableDaysLeft: 50,
+    dubbeldagarLeft: 60,
+    tierData: {
+      sjukpenningTotal: 100,
+      sjukpenningUsed: 20,
+      sjukpenningLeft: 80,
+      lagstaNivaTotal: 200,
+      lagstaNivaUsed: 30,
+      lagstaNivaLeft: 170,
+    },
+    createdAt: '2026-06-13T10:00:00Z',
+    updatedAt: '2026-06-13T10:00:00Z',
+  }
+
+  it('renders empty state when data is null', () => {
+    render(<ParentalLeaveBreakdown data={null} />)
+    expect(screen.getByText(/Ingen data hämtad ännu/)).toBeInTheDocument()
+  })
+
+  it('renders breakdown table with data', () => {
+    render(<ParentalLeaveBreakdown data={mockData} />)
+    expect(screen.getByTestId('parental-leave-breakdown')).toBeInTheDocument()
+    expect(screen.getByText(/Reserverade dagar/)).toBeInTheDocument()
+  })
+
+  it('displays reserved days', () => {
+    render(<ParentalLeaveBreakdown data={mockData} />)
+    const row = screen.getByTestId('breakdown-reserved')
+    expect(row).toHaveTextContent('80')
+    expect(row).toHaveTextContent('90')
+  })
+
+  it('displays transferable days', () => {
+    render(<ParentalLeaveBreakdown data={mockData} />)
+    const row = screen.getByTestId('breakdown-transferable')
+    expect(row).toHaveTextContent('50')
+  })
+
+  it('displays dubbeldagar left', () => {
+    render(<ParentalLeaveBreakdown data={mockData} />)
+    const row = screen.getByTestId('breakdown-dubbeldagar')
+    expect(row).toHaveTextContent('60')
+  })
+
+  it('displays tier data', () => {
+    render(<ParentalLeaveBreakdown data={mockData} />)
+    const sjukRow = screen.getByTestId('breakdown-sjukpenning')
+    expect(sjukRow).toHaveTextContent('80')
+    expect(sjukRow).toHaveTextContent('100')
+
+    const lagstaRow = screen.getByTestId('breakdown-lagsta-niva')
+    expect(lagstaRow).toHaveTextContent('170')
+    expect(lagstaRow).toHaveTextContent('200')
+  })
+
+  it('displays scraped source label', () => {
+    render(<ParentalLeaveBreakdown data={mockData} />)
+    expect(screen.getByText(/Hämtad från Försäkringskassan/)).toBeInTheDocument()
+  })
+
+  it('displays manual source label', () => {
+    const manualData = { ...mockData, source: 'manual' as const }
+    render(<ParentalLeaveBreakdown data={manualData} />)
+    expect(screen.getByText(/Manuellt angiven/)).toBeInTheDocument()
+  })
+
+  it('displays formatted date', () => {
+    render(<ParentalLeaveBreakdown data={mockData} />)
+    expect(screen.getByText(/2026-06-13/)).toBeInTheDocument()
+  })
+})
diff --git a/frontend/src/components/dashboard/ParentalLeaveBreakdown.tsx b/frontend/src/components/dashboard/ParentalLeaveBreakdown.tsx
new file mode 100644
index 0000000..2108ff9
--- /dev/null
+++ b/frontend/src/components/dashboard/ParentalLeaveBreakdown.tsx
@@ -0,0 +1,77 @@
+import { ReactNode } from 'react'
+import type { ParentalLeaveFetch } from '@/types'
+
+export interface ParentalLeaveBreakdownProps {
+  data: ParentalLeaveFetch | null
+}
+
+export function ParentalLeaveBreakdown({ data }: ParentalLeaveBreakdownProps): ReactNode {
+  if (!data) {
+    return (
+      <div data-testid="parental-leave-breakdown" className="parental-leave-breakdown">
+        <p className="parental-leave-breakdown__empty">
+          Ingen data hämtad ännu — tryck på Hämta från Försäkringskassan.
+        </p>
+      </div>
+    )
+  }
+
+  const formatDate = (dateString: string) => {
+    return new Date(dateString).toLocaleDateString('sv-SE')
+  }
+
+  const sourceLabel = data.source === 'scraped' ? 'Hämtad från Försäkringskassan' : 'Manuellt angiven'
+
+  return (
+    <div data-testid="parental-leave-breakdown" className="parental-leave-breakdown">
+      <div className="parental-leave-breakdown__section">
+        <table className="parental-leave-breakdown__table">
+          <thead>
+            <tr>
+              <th>Typ</th>
+              <th>Återstående</th>
+              <th>Totalt</th>
+            </tr>
+          </thead>
+          <tbody>
+            <tr data-testid="breakdown-reserved">
+              <td>Reserverade dagar</td>
+              <td>{data.reservedDaysLeft}</td>
+              <td>{data.reservedDaysTotal}</td>
+            </tr>
+            <tr data-testid="breakdown-transferable">
+              <td>Övergripbara dagar</td>
+              <td>{data.transferableDaysLeft}</td>
+              <td>—</td>
+            </tr>
+            <tr data-testid="breakdown-dubbeldagar">
+              <td>Dubbeldagar kvar</td>
+              <td>{data.dubbeldagarLeft}</td>
+              <td>—</td>
+            </tr>
+            {data.tierData && (
+              <>
+                <tr data-testid="breakdown-sjukpenning">
+                  <td>Sjukpenning</td>
+                  <td>{data.tierData.sjukpenningLeft}</td>
+                  <td>{data.tierData.sjukpenningTotal}</td>
+                </tr>
+                <tr data-testid="breakdown-lagsta-niva">
+                  <td>Lägsta nivå</td>
+                  <td>{data.tierData.lagstaNivaLeft}</td>
+                  <td>{data.tierData.lagstaNivaTotal}</td>
+                </tr>
+              </>
+            )}
+          </tbody>
+        </table>
+      </div>
+
+      <div className="parental-leave-breakdown__provenance">
+        <small>
+          {sourceLabel} {formatDate(data.fetchedAt)}
+        </small>
+      </div>
+    </div>
+  )
+}
diff --git a/frontend/src/components/layout/Header.test.tsx b/frontend/src/components/layout/Header.test.tsx
index 37a72a2..fb547d6 100644
--- a/frontend/src/components/layout/Header.test.tsx
+++ b/frontend/src/components/layout/Header.test.tsx
@@ -1,51 +1,77 @@
 import { describe, it, expect, vi } from 'vitest'
 import { render, screen } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
+import { BrowserRouter } from 'react-router-dom'
 import { Header } from './Header'
 
+const renderWithRouter = (element: React.ReactElement) => {
+  return render(
+    <BrowserRouter>
+      {element}
+    </BrowserRouter>,
+  )
+}
+
 describe('Header', () => {
   it('renders header with default title', () => {
-    render(<Header />)
+    renderWithRouter(<Header />)
     expect(screen.getByTestId('header-title')).toHaveTextContent('Föräldraledigplannerare')
   })
 
-  it('renders header with custom title', () => {
-    render(<Header title="Custom Title" />)
-    expect(screen.getByTestId('header-title')).toHaveTextContent('Custom Title')
+  it('renders parent name when provided', () => {
+    renderWithRouter(<Header parentName="Elin" />)
+    expect(screen.getByTestId('parent-name')).toHaveTextContent('Elin')
+  })
+
+  it('renders child select when children provided', () => {
+    const childrenList = [
+      { id: '1', name: 'Emma' },
+      { id: '2', name: 'Oscar' },
+    ]
+    renderWithRouter(<Header childrenList={childrenList} selectedChildId="1" />)
+    expect(screen.getByTestId('child-select')).toBeInTheDocument()
+    expect(screen.getByDisplayValue('Emma')).toBeInTheDocument()
+  })
+
+  it('calls onChildSelect when child selection changes', async () => {
+    const onChildSelect = vi.fn()
+    const childrenList = [
+      { id: '1', name: 'Emma' },
+      { id: '2', name: 'Oscar' },
+    ]
+    renderWithRouter(
+      <Header childrenList={childrenList} selectedChildId="1" onChildSelect={onChildSelect} />,
+    )
+    const select = screen.getByTestId('child-select') as HTMLSelectElement
+    await userEvent.selectOptions(select, '2')
+    expect(onChildSelect).toHaveBeenCalledWith('2')
+  })
+
+  it('renders navigation links', () => {
+    renderWithRouter(<Header />)
+    expect(screen.getByText('Översikt')).toBeInTheDocument()
+    expect(screen.getByText('Kalender')).toBeInTheDocument()
+    expect(screen.getByText('Tips')).toBeInTheDocument()
+    expect(screen.getByText('Inställningar')).toBeInTheDocument()
   })
 
   it('renders logout button when onLogout provided', () => {
     const onLogout = vi.fn()
-    render(<Header onLogout={onLogout} />)
+    renderWithRouter(<Header onLogout={onLogout} />)
     const button = screen.getByTestId('logout-button')
     expect(button).toBeInTheDocument()
   })
 
   it('calls onLogout when logout button clicked', async () => {
     const onLogout = vi.fn()
-    render(<Header onLogout={onLogout} />)
+    renderWithRouter(<Header onLogout={onLogout} />)
     const button = screen.getByTestId('logout-button')
     await userEvent.click(button)
     expect(onLogout).toHaveBeenCalled()
   })
 
-  it('renders workspace selector button when onWorkspaceSelect provided', () => {
-    const onWorkspaceSelect = vi.fn()
-    render(<Header onWorkspaceSelect={onWorkspaceSelect} />)
-    expect(screen.getByTestId('workspace-selector')).toBeInTheDocument()
-  })
-
-  it('calls onWorkspaceSelect when workspace button clicked', async () => {
-    const onWorkspaceSelect = vi.fn()
-    render(<Header onWorkspaceSelect={onWorkspaceSelect} />)
-    const button = screen.getByTestId('workspace-selector')
-    await userEvent.click(button)
-    expect(onWorkspaceSelect).toHaveBeenCalled()
-  })
-
-  it('does not render buttons when no handlers provided', () => {
-    render(<Header />)
+  it('does not render logout button when not provided', () => {
+    renderWithRouter(<Header />)
     expect(screen.queryByTestId('logout-button')).not.toBeInTheDocument()
-    expect(screen.queryByTestId('workspace-selector')).not.toBeInTheDocument()
   })
 })
diff --git a/frontend/src/components/layout/Header.tsx b/frontend/src/components/layout/Header.tsx
index 07425d1..bcc9a44 100644
--- a/frontend/src/components/layout/Header.tsx
+++ b/frontend/src/components/layout/Header.tsx
@@ -1,32 +1,91 @@
 import { ReactNode } from 'react'
+import { NavLink } from 'react-router-dom'
+import './header.css'
 
 export interface HeaderProps {
-  title?: string
-  onLogout?: () => void
-  onWorkspaceSelect?: () => void
+  parentName?: string | undefined
+  selectedChildName?: string | undefined
+  childrenList?: Array<{ id: string; name: string }> | undefined
+  selectedChildId?: string | null | undefined
+  onChildSelect?: ((childId: string) => void) | undefined
+  onLogout?: (() => void) | undefined
 }
 
-export function Header({ title = 'Föräldraledigplannerare', onLogout, onWorkspaceSelect }: HeaderProps): ReactNode {
+export function Header({
+  parentName,
+  selectedChildName,
+  childrenList,
+  selectedChildId,
+  onChildSelect,
+  onLogout,
+}: HeaderProps): ReactNode {
   return (
-    <header role="banner" data-testid="header">
-      <div data-testid="header-title">{title}</div>
-      <nav role="navigation" data-testid="header-nav">
-        {onWorkspaceSelect && (
-          <button
-            data-testid="workspace-selector"
-            onClick={onWorkspaceSelect}
-            aria-label="Select workspace"
-          >
-            Select Workspace
-          </button>
-        )}
+    <header className="header" role="banner" data-testid="header">
+      <div className="header__top">
+        <div className="header__title" data-testid="header-title">
+          Föräldraledigplannerare
+        </div>
+        <div className="header__identity">
+          {parentName && (
+            <span className="header__parent-name" data-testid="parent-name">
+              {parentName}
+            </span>
+          )}
+          {childrenList && childrenList.length > 0 && (
+            <select
+              className="header__child-select"
+              value={selectedChildId ?? ''}
+              onChange={(e) => onChildSelect?.(e.target.value)}
+              data-testid="child-select"
+              aria-label="Select child"
+            >
+              {childrenList.map((child) => (
+                <option key={child.id} value={child.id}>
+                  {child.name}
+                </option>
+              ))}
+            </select>
+          )}
+          {selectedChildName && childrenList && childrenList.length === 1 && (
+            <span className="header__child-name" data-testid="child-name">
+              {selectedChildName}
+            </span>
+          )}
+        </div>
+      </div>
+      <nav className="header__nav" role="navigation" data-testid="header-nav">
+        <NavLink
+          to="/"
+          className={({ isActive }) => `header__nav-link ${isActive ? 'header__nav-link--active' : ''}`}
+        >
+          Översikt
+        </NavLink>
+        <NavLink
+          to="/calendar"
+          className={({ isActive }) => `header__nav-link ${isActive ? 'header__nav-link--active' : ''}`}
+        >
+          Kalender
+        </NavLink>
+        <NavLink
+          to="/tips"
+          className={({ isActive }) => `header__nav-link ${isActive ? 'header__nav-link--active' : ''}`}
+        >
+          Tips
+        </NavLink>
+        <NavLink
+          to="/settings"
+          className={({ isActive }) => `header__nav-link ${isActive ? 'header__nav-link--active' : ''}`}
+        >
+          Inställningar
+        </NavLink>
         {onLogout && (
           <button
-            data-testid="logout-button"
+            className="header__logout-button"
             onClick={onLogout}
+            data-testid="logout-button"
             aria-label="Log out"
           >
-            Logout
+            Logga ut
           </button>
         )}
       </nav>
diff --git a/frontend/src/components/layout/Layout.tsx b/frontend/src/components/layout/Layout.tsx
index 92113b0..4a264a7 100644
--- a/frontend/src/components/layout/Layout.tsx
+++ b/frontend/src/components/layout/Layout.tsx
@@ -1,4 +1,7 @@
-import { ReactNode } from 'react'
+import { ReactNode, useCallback } from 'react'
+import { useNavigate } from 'react-router-dom'
+import { useAuth } from '@/context/AuthContext'
+import { useWorkspace } from '@/context/WorkspaceContext'
 import { Header, HeaderProps } from './Header'
 import { Footer } from './Footer'
 
@@ -8,9 +11,30 @@ interface LayoutProps {
 }
 
 export function Layout({ children, header }: LayoutProps): ReactNode {
+  const navigate = useNavigate()
+  const { logout } = useAuth()
+  const { parentName, children: childrenList, selectedChildId, selectChild } = useWorkspace()
+
+  const selectedChild = childrenList.find((c) => c.id === selectedChildId)
+
+  const handleLogout = useCallback(async () => {
+    await logout()
+    navigate('/auth', { replace: true })
+  }, [logout, navigate])
+
+  const headerProps: HeaderProps = {
+    ...header,
+    parentName: parentName ?? undefined,
+    selectedChildName: selectedChild?.name,
+    childrenList,
+    selectedChildId,
+    onChildSelect: selectChild,
+    onLogout: handleLogout,
+  }
+
   return (
     <div role="main" data-testid="layout">
-      <Header {...(header || {})} />
+      <Header {...headerProps} />
       <main data-testid="layout-main">{children}</main>
       <Footer />
     </div>
diff --git a/frontend/src/components/layout/header.css b/frontend/src/components/layout/header.css
new file mode 100644
index 0000000..94386f4
--- /dev/null
+++ b/frontend/src/components/layout/header.css
@@ -0,0 +1,83 @@
+.header {
+  background-color: #f5f5f5;
+  border-bottom: 1px solid #e0e0e0;
+  padding: 16px 20px;
+}
+
+.header__top {
+  display: flex;
+  justify-content: space-between;
+  align-items: center;
+  margin-bottom: 16px;
+}
+
+.header__title {
+  font-size: 18px;
+  font-weight: 600;
+  color: #333;
+}
+
+.header__identity {
+  display: flex;
+  align-items: center;
+  gap: 12px;
+}
+
+.header__parent-name {
+  font-size: 14px;
+  color: #666;
+  font-weight: 500;
+}
+
+.header__child-select {
+  padding: 6px 10px;
+  border: 1px solid #d0d0d0;
+  border-radius: 4px;
+  font-size: 14px;
+  background-color: #fff;
+  cursor: pointer;
+}
+
+.header__child-name {
+  font-size: 14px;
+  color: #0066cc;
+  font-weight: 500;
+}
+
+.header__nav {
+  display: flex;
+  gap: 8px;
+  flex-wrap: wrap;
+}
+
+.header__nav-link {
+  padding: 8px 14px;
+  font-size: 14px;
+  text-decoration: none;
+  color: #333;
+  border-radius: 4px;
+  transition: background-color 0.2s;
+}
+
+.header__nav-link:hover {
+  background-color: #e8e8e8;
+}
+
+.header__nav-link--active {
+  background-color: #0066cc;
+  color: #fff;
+}
+
+.header__logout-button {
+  padding: 8px 14px;
+  font-size: 14px;
+  background-color: #f8f8f8;
+  border: 1px solid #d0d0d0;
+  border-radius: 4px;
+  cursor: pointer;
+  transition: background-color 0.2s;
+}
+
+.header__logout-button:hover {
+  background-color: #e8e8e8;
+}
diff --git a/frontend/src/components/modals/QRCodeModal.test.tsx b/frontend/src/components/modals/QRCodeModal.test.tsx
new file mode 100644
index 0000000..42fefb6
--- /dev/null
+++ b/frontend/src/components/modals/QRCodeModal.test.tsx
@@ -0,0 +1,223 @@
+import { describe, it, expect, vi } from 'vitest'
+import { render, screen } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { QRCodeModal } from './QRCodeModal'
+
+describe('QRCodeModal', () => {
+  const mockHandlers = {
+    onClose: vi.fn(),
+    onDone: vi.fn(),
+    onCancel: vi.fn(),
+  }
+
+  it('does not render when isOpen is false', () => {
+    render(
+      <QRCodeModal
+        isOpen={false}
+        onClose={mockHandlers.onClose}
+        onDone={mockHandlers.onDone}
+        status={null}
+        isRunning={false}
+        onCancel={mockHandlers.onCancel}
+      />
+    )
+    expect(screen.queryByText(/Hämta från Försäkringskassan/)).not.toBeInTheDocument()
+  })
+
+  it('renders when isOpen is true', () => {
+    render(
+      <QRCodeModal
+        isOpen={true}
+        onClose={mockHandlers.onClose}
+        onDone={mockHandlers.onDone}
+        status="launching"
+        isRunning={true}
+        onCancel={mockHandlers.onCancel}
+      />
+    )
+    expect(screen.getByText(/Hämta från Försäkringskassan/)).toBeInTheDocument()
+  })
+
+  it('displays QR code when status is awaiting_scan', () => {
+    render(
+      <QRCodeModal
+        isOpen={true}
+        onClose={mockHandlers.onClose}
+        onDone={mockHandlers.onDone}
+        status="awaiting_scan"
+        qrData="iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg=="
+        isRunning={true}
+        onCancel={mockHandlers.onCancel}
+      />
+    )
+    expect(screen.getByText(/Öppna BankID-appen/)).toBeInTheDocument()
+    expect(screen.getByAltText(/BankID QR-kod/)).toBeInTheDocument()
+  })
+
+  it('displays loading text during authenticating', () => {
+    render(
+      <QRCodeModal
+        isOpen={true}
+        onClose={mockHandlers.onClose}
+        onDone={mockHandlers.onDone}
+        status="authenticating"
+        isRunning={true}
+        onCancel={mockHandlers.onCancel}
+      />
+    )
+    expect(screen.getByText(/Autentiserar/)).toBeInTheDocument()
+  })
+
+  it('displays loading text during fetching', () => {
+    render(
+      <QRCodeModal
+        isOpen={true}
+        onClose={mockHandlers.onClose}
+        onDone={mockHandlers.onDone}
+        status="fetching"
+        isRunning={true}
+        onCancel={mockHandlers.onCancel}
+      />
+    )
+    expect(screen.getByText(/Hämtar data från FK/)).toBeInTheDocument()
+  })
+
+  it('displays done message and close button on success', () => {
+    render(
+      <QRCodeModal
+        isOpen={true}
+        onClose={mockHandlers.onClose}
+        onDone={mockHandlers.onDone}
+        status="done"
+        result={{ data: 'fetched' }}
+        isRunning={false}
+        onCancel={mockHandlers.onCancel}
+      />
+    )
+    expect(screen.getByText(/Klar/)).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: /Stäng/ })).toBeInTheDocument()
+  })
+
+  it('displays cancel button when running', () => {
+    render(
+      <QRCodeModal
+        isOpen={true}
+        onClose={mockHandlers.onClose}
+        onDone={mockHandlers.onDone}
+        status="awaiting_scan"
+        isRunning={true}
+        onCancel={mockHandlers.onCancel}
+      />
+    )
+    expect(screen.getByRole('button', { name: /Avbryt/ })).toBeInTheDocument()
+  })
+
+  it('displays error message when error prop is set', () => {
+    render(
+      <QRCodeModal
+        isOpen={true}
+        onClose={mockHandlers.onClose}
+        onDone={mockHandlers.onDone}
+        status="error"
+        error="Authentication failed"
+        isRunning={false}
+        onCancel={mockHandlers.onCancel}
+      />
+    )
+    expect(screen.getByText(/Authentication failed/)).toBeInTheDocument()
+  })
+
+  it('displays cancelled message on cancel', () => {
+    render(
+      <QRCodeModal
+        isOpen={true}
+        onClose={mockHandlers.onClose}
+        onDone={mockHandlers.onDone}
+        status="cancelled"
+        isRunning={false}
+        onCancel={mockHandlers.onCancel}
+      />
+    )
+    expect(screen.getByText(/Sessionen avbröts/)).toBeInTheDocument()
+  })
+
+  it('disables close button when running', () => {
+    render(
+      <QRCodeModal
+        isOpen={true}
+        onClose={mockHandlers.onClose}
+        onDone={mockHandlers.onDone}
+        status="fetching"
+        isRunning={true}
+        onCancel={mockHandlers.onCancel}
+      />
+    )
+    const closeButton = screen.getByRole('button', { name: '×' })
+    expect(closeButton).toBeDisabled()
+  })
+
+  it('calls onClose when close button clicked and not running', async () => {
+    const user = userEvent.setup()
+    render(
+      <QRCodeModal
+        isOpen={true}
+        onClose={mockHandlers.onClose}
+        onDone={mockHandlers.onDone}
+        status="launching"
+        isRunning={false}
+        onCancel={mockHandlers.onCancel}
+      />
+    )
+    await user.click(screen.getByRole('button', { name: '×' }))
+    expect(mockHandlers.onClose).toHaveBeenCalled()
+  })
+
+  it('calls onDone when done button clicked', async () => {
+    const user = userEvent.setup()
+    render(
+      <QRCodeModal
+        isOpen={true}
+        onClose={mockHandlers.onClose}
+        onDone={mockHandlers.onDone}
+        status="done"
+        result={{ data: 'fetched' }}
+        isRunning={false}
+        onCancel={mockHandlers.onCancel}
+      />
+    )
+    await user.click(screen.getByRole('button', { name: /Stäng/ }))
+    expect(mockHandlers.onDone).toHaveBeenCalled()
+  })
+
+  it('calls onCancel when cancel button clicked', async () => {
+    const user = userEvent.setup()
+    render(
+      <QRCodeModal
+        isOpen={true}
+        onClose={mockHandlers.onClose}
+        onDone={mockHandlers.onDone}
+        status="awaiting_scan"
+        isRunning={true}
+        onCancel={mockHandlers.onCancel}
+      />
+    )
+    await user.click(screen.getByRole('button', { name: /Avbryt/ }))
+    expect(mockHandlers.onCancel).toHaveBeenCalled()
+  })
+
+  it('displays status text with message', () => {
+    render(
+      <QRCodeModal
+        isOpen={true}
+        onClose={mockHandlers.onClose}
+        onDone={mockHandlers.onDone}
+        status="fetching"
+        message="In progress"
+        isRunning={true}
+        onCancel={mockHandlers.onCancel}
+      />
+    )
+    expect(screen.getByText(/fetching/)).toBeInTheDocument()
+    expect(screen.getByText(/In progress/)).toBeInTheDocument()
+  })
+})
diff --git a/frontend/src/components/modals/QRCodeModal.tsx b/frontend/src/components/modals/QRCodeModal.tsx
new file mode 100644
index 0000000..7a5f301
--- /dev/null
+++ b/frontend/src/components/modals/QRCodeModal.tsx
@@ -0,0 +1,139 @@
+import { ReactNode } from 'react'
+import type { ScraperStatus } from '@/hooks/useScraperFetch'
+
+interface QRCodeModalProps {
+  isOpen: boolean
+  onClose: () => void
+  onDone: () => void
+  status: ScraperStatus | null
+  qrData?: string | undefined
+  result?: Record<string, unknown> | undefined
+  message?: string | undefined
+  error?: string | null
+  isRunning: boolean
+  onCancel: () => Promise<void>
+}
+
+export function QRCodeModal({
+  isOpen,
+  onClose,
+  onDone,
+  status,
+  qrData,
+  result,
+  message,
+  error,
+  isRunning,
+  onCancel,
+}: QRCodeModalProps): ReactNode {
+  if (!isOpen) return null
+
+  const handleClose = () => {
+    if (isRunning) return
+    onClose()
+  }
+
+  return (
+    <div style={{ position: 'fixed', inset: 0, background: 'rgba(0,0,0,0.5)', display: 'flex', alignItems: 'center', justifyContent: 'center', zIndex: 1000 }}>
+      <div style={{ background: 'white', borderRadius: 8, padding: '2rem', maxWidth: 500, width: '90%', boxShadow: '0 2px 8px rgba(0,0,0,0.2)' }}>
+        <div style={{ display: 'flex', justifyContent: 'space-between', alignItems: 'center', marginBottom: '1.5rem' }}>
+          <h2 style={{ margin: 0, fontSize: '1.2rem' }}>Hämta från Försäkringskassan</h2>
+          <button
+            onClick={handleClose}
+            disabled={isRunning}
+            style={{
+              background: 'none',
+              border: 'none',
+              fontSize: '1.5rem',
+              cursor: isRunning ? 'not-allowed' : 'pointer',
+              opacity: isRunning ? 0.5 : 1,
+            }}
+          >
+            ×
+          </button>
+        </div>
+
+        {status && (
+          <div>
+            <div style={{ marginBottom: '1rem' }}>
+              <strong>Status:</strong>{' '}
+              <span style={{ color: status === 'done' ? 'green' : status === 'error' ? 'red' : 'inherit' }}>
+                {status}
+              </span>
+              {message && <span style={{ color: '#888', marginLeft: '0.5rem' }}>— {message}</span>}
+            </div>
+
+            {status === 'awaiting_scan' && qrData && (
+              <div style={{ marginBottom: '1rem', textAlign: 'center' }}>
+                <p style={{ margin: '0 0 0.5rem', fontSize: '0.9rem' }}>Öppna BankID-appen och skanna QR-koden:</p>
+                <img
+                  src={`data:image/png;base64,${qrData}`}
+                  alt="BankID QR-kod"
+                  style={{ width: 220, height: 220, imageRendering: 'pixelated', border: '1px solid #ccc' }}
+                />
+              </div>
+            )}
+
+            {(status === 'authenticating' || status === 'fetching') && (
+              <p style={{ color: '#555', textAlign: 'center' }}>
+                ⏳ {status === 'authenticating' ? 'Autentiserar…' : 'Hämtar data från FK…'}
+              </p>
+            )}
+
+            {status === 'done' && result && (
+              <div>
+                <p style={{ color: 'green', marginBottom: '0.5rem' }}>✅ Klar! Data hämtad från Försäkringskassan.</p>
+              </div>
+            )}
+
+            {status === 'cancelled' && (
+              <p style={{ color: '#888' }}>Sessionen avbröts.</p>
+            )}
+
+            {status === 'done' && (
+              <button
+                onClick={onDone}
+                style={{
+                  width: '100%',
+                  padding: '0.5rem 1rem',
+                  background: '#4CAF50',
+                  color: 'white',
+                  border: 'none',
+                  borderRadius: 4,
+                  cursor: 'pointer',
+                  marginTop: '1rem',
+                }}
+              >
+                Stäng
+              </button>
+            )}
+
+            {isRunning && (
+              <button
+                onClick={onCancel}
+                style={{
+                  width: '100%',
+                  padding: '0.5rem 1rem',
+                  background: '#f44336',
+                  color: 'white',
+                  border: 'none',
+                  borderRadius: 4,
+                  cursor: 'pointer',
+                  marginTop: '1rem',
+                }}
+              >
+                Avbryt
+              </button>
+            )}
+          </div>
+        )}
+
+        {error && (
+          <div style={{ background: '#fee', border: '1px solid #f88', padding: '0.75rem', borderRadius: 4, color: '#c00' }}>
+            <strong>Fel:</strong> {error}
+          </div>
+        )}
+      </div>
+    </div>
+  )
+}
diff --git a/frontend/src/context/AuthContext.tsx b/frontend/src/context/AuthContext.tsx
index d030653..d42107f 100644
--- a/frontend/src/context/AuthContext.tsx
+++ b/frontend/src/context/AuthContext.tsx
@@ -29,8 +29,8 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
     api
       .refreshToken()
       .then((res: TokenResponse) => {
-        api.setAccessToken(res.accessToken)
-        setState({ accessToken: res.accessToken, isAuthenticated: true, isLoading: false })
+        api.setAccessToken(res.access_token)
+        setState({ accessToken: res.access_token, isAuthenticated: true, isLoading: false })
       })
       .catch((err: unknown) => {
         if (isUnauthorized(err)) {
@@ -43,8 +43,8 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
   }, [])
 
   const handleTokenResponse = useCallback((res: TokenResponse) => {
-    api.setAccessToken(res.accessToken)
-    setState({ accessToken: res.accessToken, isAuthenticated: true, isLoading: false })
+    api.setAccessToken(res.access_token)
+    setState({ accessToken: res.access_token, isAuthenticated: true, isLoading: false })
   }, [])
 
   const login = useCallback(
diff --git a/frontend/src/context/WorkspaceContext.tsx b/frontend/src/context/WorkspaceContext.tsx
index 5a6f90f..18eb764 100644
--- a/frontend/src/context/WorkspaceContext.tsx
+++ b/frontend/src/context/WorkspaceContext.tsx
@@ -3,17 +3,30 @@ import * as api from '@/services/api'
 import { useAuth } from '@/context/AuthContext'
 import type { Workspace } from '@/types'
 
+interface Child {
+  id: string
+  name: string
+  birth_date: string
+}
+
 interface WorkspaceContextValue {
   workspace: Workspace | null
   isLoading: boolean
   error: string | null
+  workspaceId: string | null
   setWorkspaceId: (id: string) => void
   refetch: () => void
+  children: Child[]
+  selectedChildId: string | null
+  selectChild: (id: string) => void
+  personalDataUuid: string | null
+  parentName: string | null
+  refreshContext: () => Promise<void>
 }
 
 const WorkspaceContext = createContext<WorkspaceContextValue | null>(null)
 
-export function WorkspaceProvider({ children }: { children: React.ReactNode }) {
+export function WorkspaceProvider({ children: childrenProp }: { children: React.ReactNode }) {
   const { isAuthenticated } = useAuth()
   const [workspaceId, setWorkspaceId] = useState<string | null>(
     () => localStorage.getItem('workspaceId'),
@@ -21,6 +34,10 @@ export function WorkspaceProvider({ children }: { children: React.ReactNode }) {
   const [workspace, setWorkspace] = useState<Workspace | null>(null)
   const [isLoading, setIsLoading] = useState(false)
   const [error, setError] = useState<string | null>(null)
+  const [children, setChildren] = useState<Child[]>([])
+  const [selectedChildId, setSelectedChildId] = useState<string | null>(null)
+  const [personalDataUuid, setPersonalDataUuid] = useState<string | null>(null)
+  const [parentName, setParentName] = useState<string | null>(null)
 
   const fetchWorkspace = useCallback(async (id: string) => {
     setIsLoading(true)
@@ -36,28 +53,72 @@ export function WorkspaceProvider({ children }: { children: React.ReactNode }) {
     }
   }, [])
 
+  const refreshContext = useCallback(async () => {
+    setIsLoading(true)
+    try {
+      const context = await api.getUserContext()
+      localStorage.setItem('workspaceId', context.workspace_id)
+      setWorkspaceId(context.workspace_id)
+      setPersonalDataUuid(context.personal_data_uuid)
+      setParentName(context.parent_name)
+      const childrenList = context.children || []
+      setChildren(childrenList)
+      if (childrenList.length > 0 && childrenList[0]) {
+        setSelectedChildId(childrenList[0].id)
+      }
+      try {
+        const ws = await api.getWorkspace(context.workspace_id)
+        setWorkspace(ws)
+      } catch (err: unknown) {
+        setError(err instanceof Error ? err.message : 'Failed to load workspace')
+        setWorkspace(null)
+      }
+    } catch (err: unknown) {
+      setError(err instanceof Error ? err.message : 'Failed to load user context')
+    } finally {
+      setIsLoading(false)
+    }
+  }, [])
+
   useEffect(() => {
-    if (isAuthenticated && workspaceId) {
+    if (isAuthenticated && (!workspaceId || children.length === 0)) {
+      void refreshContext()
+    }
+  }, [isAuthenticated, workspaceId, children.length, refreshContext])
+
+  useEffect(() => {
+    if (isAuthenticated && workspaceId && !workspace) {
       void fetchWorkspace(workspaceId)
     }
-  }, [isAuthenticated, workspaceId, fetchWorkspace])
+  }, [isAuthenticated, workspaceId, workspace, fetchWorkspace])
 
   const handleSetWorkspaceId = useCallback((id: string) => {
     localStorage.setItem('workspaceId', id)
     setWorkspaceId(id)
   }, [])
 
+  const handleSelectChild = useCallback((id: string) => {
+    setSelectedChildId(id)
+  }, [])
+
   return (
     <WorkspaceContext.Provider
       value={{
         workspace,
         isLoading,
         error,
+        workspaceId,
         setWorkspaceId: handleSetWorkspaceId,
         refetch: () => { if (workspaceId) void fetchWorkspace(workspaceId) },
+        children,
+        selectedChildId,
+        selectChild: handleSelectChild,
+        personalDataUuid,
+        parentName,
+        refreshContext,
       }}
     >
-      {children}
+      {childrenProp}
     </WorkspaceContext.Provider>
   )
 }
diff --git a/frontend/src/hooks/index.ts b/frontend/src/hooks/index.ts
index 29f8002..f836fbb 100644
--- a/frontend/src/hooks/index.ts
+++ b/frontend/src/hooks/index.ts
@@ -4,3 +4,4 @@ export { useOptimizationTips } from './useOptimizationTips'
 export { useParentalLeave } from './useParentalLeave'
 export { usePlannedDays } from './usePlannedDays'
 export { useVacationDays } from './useVacationDays'
+export { useScraperFetch } from './useScraperFetch'
diff --git a/frontend/src/hooks/useParentalLeave.test.ts b/frontend/src/hooks/useParentalLeave.test.ts
index e839c2e..ebf091a 100644
--- a/frontend/src/hooks/useParentalLeave.test.ts
+++ b/frontend/src/hooks/useParentalLeave.test.ts
@@ -11,7 +11,7 @@ describe('useParentalLeave', () => {
   })
 
   it('initializes with null data', () => {
-    const { result } = renderHook(() => useParentalLeave(null))
+    const { result } = renderHook(() => useParentalLeave(null, null))
     expect(result.current.data).toBeNull()
     expect(result.current.isLoading).toBe(false)
   })
@@ -38,19 +38,19 @@ describe('useParentalLeave', () => {
 
     vi.mocked(api.getParentalLeave).mockResolvedValue(mockData as any)
 
-    renderHook(() => useParentalLeave('ws1'))
+    renderHook(() => useParentalLeave('pd1', 'child1'))
 
     await act(async () => {
       await new Promise((resolve) => setTimeout(resolve, 0))
     })
 
-    expect(api.getParentalLeave).toHaveBeenCalledWith('ws1')
+    expect(api.getParentalLeave).toHaveBeenCalledWith('pd1', 'child1')
   })
 
   it('handles fetch errors', async () => {
     vi.mocked(api.getParentalLeave).mockRejectedValue(new Error('Fetch failed'))
 
-    const { result } = renderHook(() => useParentalLeave('ws1'))
+    const { result } = renderHook(() => useParentalLeave('pd1', 'child1'))
 
     await act(async () => {
       await new Promise((resolve) => setTimeout(resolve, 0))
@@ -59,10 +59,10 @@ describe('useParentalLeave', () => {
     expect(result.current.error).toContain('Fetch failed')
   })
 
-  it('does not fetch when workspaceId is null', () => {
+  it('does not fetch when personalDataUuid or childId is null', () => {
     vi.mocked(api.getParentalLeave).mockResolvedValue({} as any)
 
-    renderHook(() => useParentalLeave(null))
+    renderHook(() => useParentalLeave(null, null))
 
     expect(api.getParentalLeave).not.toHaveBeenCalled()
   })
@@ -70,7 +70,7 @@ describe('useParentalLeave', () => {
   it('provides refresh function', async () => {
     vi.mocked(api.getParentalLeave).mockResolvedValue({} as any)
 
-    const { result } = renderHook(() => useParentalLeave('ws1'))
+    const { result } = renderHook(() => useParentalLeave('pd1', 'child1'))
 
     await act(async () => {
       await result.current.refresh()
diff --git a/frontend/src/hooks/useParentalLeave.ts b/frontend/src/hooks/useParentalLeave.ts
index 5c74e72..d8a3e38 100644
--- a/frontend/src/hooks/useParentalLeave.ts
+++ b/frontend/src/hooks/useParentalLeave.ts
@@ -9,17 +9,20 @@ interface UseParentalLeaveResult {
   refresh: () => Promise<void>
 }
 
-export function useParentalLeave(workspaceId: string | null): UseParentalLeaveResult {
+export function useParentalLeave(
+  personalDataUuid: string | null,
+  childId: string | null,
+): UseParentalLeaveResult {
   const [data, setData] = useState<ParentalLeaveFetch | null>(null)
   const [isLoading, setIsLoading] = useState(false)
   const [error, setError] = useState<string | null>(null)
 
   const fetch = useCallback(async () => {
-    if (!workspaceId) return
+    if (!personalDataUuid || !childId) return
     setIsLoading(true)
     setError(null)
     try {
-      const response = await api.getParentalLeave(workspaceId)
+      const response = await api.getParentalLeave(personalDataUuid, childId)
       setData(response)
     } catch (err) {
       setError(err instanceof Error ? err.message : 'Failed to fetch parental leave data')
@@ -27,7 +30,7 @@ export function useParentalLeave(workspaceId: string | null): UseParentalLeaveRe
     } finally {
       setIsLoading(false)
     }
-  }, [workspaceId])
+  }, [personalDataUuid, childId])
 
   useEffect(() => {
     fetch()
diff --git a/frontend/src/hooks/usePlannedDays.test.ts b/frontend/src/hooks/usePlannedDays.test.ts
index 67b9a7e..ff1716f 100644
--- a/frontend/src/hooks/usePlannedDays.test.ts
+++ b/frontend/src/hooks/usePlannedDays.test.ts
@@ -11,12 +11,12 @@ describe('usePlannedDays', () => {
   })
 
   it('initializes with null data', () => {
-    const { result } = renderHook(() => usePlannedDays(null))
+    const { result } = renderHook(() => usePlannedDays())
     expect(result.current.data).toBeNull()
     expect(result.current.isLoading).toBe(false)
   })
 
-  it('fetches planned days when both ids provided', async () => {
+  it('fetches planned days when childId provided', async () => {
     const mockData = [
       {
         id: '1',
@@ -33,19 +33,19 @@ describe('usePlannedDays', () => {
 
     vi.mocked(api.getPlannedDays).mockResolvedValue(mockData as any)
 
-    renderHook(() => usePlannedDays('ws1', 'child1'))
+    renderHook(() => usePlannedDays('child1'))
 
     await act(async () => {
       await new Promise((resolve) => setTimeout(resolve, 0))
     })
 
-    expect(api.getPlannedDays).toHaveBeenCalledWith('ws1', 'child1')
+    expect(api.getPlannedDays).toHaveBeenCalledWith('child1')
   })
 
   it('does not fetch without childId', () => {
     vi.mocked(api.getPlannedDays).mockResolvedValue([])
 
-    renderHook(() => usePlannedDays('ws1'))
+    renderHook(() => usePlannedDays())
 
     expect(api.getPlannedDays).not.toHaveBeenCalled()
   })
@@ -66,7 +66,7 @@ describe('usePlannedDays', () => {
     vi.mocked(api.createPlannedDay).mockResolvedValue(mockAdded as any)
     vi.mocked(api.getPlannedDays).mockResolvedValue([mockAdded])
 
-    renderHook(() => usePlannedDays('ws1', 'child1'))
+    renderHook(() => usePlannedDays('child1'))
 
     await act(async () => {
       // just test that add can be called; mocks handle the result
@@ -79,7 +79,7 @@ describe('usePlannedDays', () => {
     vi.mocked(api.deletePlannedDay).mockResolvedValue(undefined)
     vi.mocked(api.getPlannedDays).mockResolvedValue([])
 
-    const { result } = renderHook(() => usePlannedDays('ws1', 'child1'))
+    const { result } = renderHook(() => usePlannedDays('child1'))
 
     await act(async () => {
       await result.current.remove('pd1')
diff --git a/frontend/src/hooks/usePlannedDays.ts b/frontend/src/hooks/usePlannedDays.ts
index e9b5965..fbc5628 100644
--- a/frontend/src/hooks/usePlannedDays.ts
+++ b/frontend/src/hooks/usePlannedDays.ts
@@ -11,17 +11,17 @@ interface UsePlannedDaysResult {
   remove: (id: string) => Promise<void>
 }
 
-export function usePlannedDays(workspaceId: string | null, childId?: string): UsePlannedDaysResult {
+export function usePlannedDays(childId?: string): UsePlannedDaysResult {
   const [data, setData] = useState<PlannedLeaveDay[] | null>(null)
   const [isLoading, setIsLoading] = useState(false)
   const [error, setError] = useState<string | null>(null)
 
   const fetch = useCallback(async () => {
-    if (!workspaceId || !childId) return
+    if (!childId) return
     setIsLoading(true)
     setError(null)
     try {
-      const response = await api.getPlannedDays(workspaceId, childId)
+      const response = await api.getPlannedDays(childId)
       setData(response)
     } catch (err) {
       setError(err instanceof Error ? err.message : 'Failed to fetch planned days')
@@ -29,19 +29,18 @@ export function usePlannedDays(workspaceId: string | null, childId?: string): Us
     } finally {
       setIsLoading(false)
     }
-  }, [workspaceId, childId])
+  }, [childId])
 
   const add = useCallback(
     async (date: string, childId: string, leaveType: string) => {
-      if (!workspaceId) throw new Error('Workspace not selected')
-      const result = await api.createPlannedDay(workspaceId, childId, {
+      const result = await api.createPlannedDay(childId, {
         date,
         leaveType,
       })
       await fetch()
       return result
     },
-    [workspaceId, fetch]
+    [fetch]
   )
 
   const remove = useCallback(
diff --git a/frontend/src/hooks/useScraperFetch.test.ts b/frontend/src/hooks/useScraperFetch.test.ts
new file mode 100644
index 0000000..c931bc9
--- /dev/null
+++ b/frontend/src/hooks/useScraperFetch.test.ts
@@ -0,0 +1,172 @@
+import { describe, it, expect, beforeEach, vi, afterEach } from 'vitest'
+import { renderHook, act } from '@testing-library/react'
+import { useScraperFetch } from './useScraperFetch'
+import * as api from '@/services/api'
+import * as errors from '@/services/errors'
+
+vi.mock('@/services/api')
+vi.mock('@/services/errors')
+
+describe('useScraperFetch', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    vi.useFakeTimers()
+  })
+
+  afterEach(() => {
+    vi.useRealTimers()
+  })
+
+  it('initializes with null state', () => {
+    const { result } = renderHook(() => useScraperFetch())
+    expect(result.current.sessionId).toBeNull()
+    expect(result.current.pollData).toBeNull()
+    expect(result.current.error).toBeNull()
+    expect(result.current.isRunning).toBe(false)
+    expect(result.current.isTerminal).toBe(false)
+  })
+
+  it('starts scraping session', async () => {
+    vi.mocked(api.startScraperSession).mockResolvedValue({
+      session_id: 'sess-123',
+      workspace_id: 'ws-1',
+      personal_data_uuid: 'pd-1',
+      child_id: 'c-1',
+    } as any)
+
+    const { result } = renderHook(() => useScraperFetch())
+
+    await act(async () => {
+      await result.current.start('child-1')
+    })
+
+    expect(result.current.sessionId).toBe('sess-123')
+    expect(result.current.pollData?.status).toBe('launching')
+    expect(api.startScraperSession).toHaveBeenCalledWith({ child_id: 'child-1' })
+  })
+
+  it('transitions through polling states', async () => {
+    vi.mocked(api.startScraperSession).mockResolvedValue({
+      session_id: 'sess-123',
+      workspace_id: 'ws-1',
+      personal_data_uuid: 'pd-1',
+      child_id: 'c-1',
+    } as any)
+
+    vi.mocked(api.pollScraperSession)
+      .mockResolvedValueOnce({ status: 'awaiting_scan', qr_data: 'qr-123' } as any)
+      .mockResolvedValueOnce({ status: 'authenticating' } as any)
+      .mockResolvedValueOnce({ status: 'fetching' } as any)
+      .mockResolvedValueOnce({ status: 'done', result: { data: 'fetched' } } as any)
+
+    const { result } = renderHook(() => useScraperFetch())
+
+    await act(async () => {
+      await result.current.start()
+    })
+
+    // First poll
+    await act(async () => {
+      vi.advanceTimersByTime(1000)
+    })
+    expect(result.current.pollData?.status).toBe('awaiting_scan')
+    expect(result.current.isRunning).toBe(true)
+
+    // Second poll
+    await act(async () => {
+      vi.advanceTimersByTime(1000)
+    })
+    expect(result.current.pollData?.status).toBe('authenticating')
+
+    // Third poll
+    await act(async () => {
+      vi.advanceTimersByTime(1000)
+    })
+    expect(result.current.pollData?.status).toBe('fetching')
+
+    // Fourth poll - terminal status
+    await act(async () => {
+      vi.advanceTimersByTime(1000)
+    })
+    expect(result.current.pollData?.status).toBe('done')
+    expect(result.current.isRunning).toBe(false)
+    expect(result.current.isTerminal).toBe(true)
+  })
+
+  it('cancels scraping session', async () => {
+    vi.mocked(api.startScraperSession).mockResolvedValue({
+      session_id: 'sess-123',
+      workspace_id: 'ws-1',
+      personal_data_uuid: 'pd-1',
+      child_id: 'c-1',
+    } as any)
+
+    vi.mocked(api.pollScraperSession).mockResolvedValue({ status: 'awaiting_scan' } as any)
+    vi.mocked(api.cancelScraperSession).mockResolvedValue(undefined)
+
+    const { result } = renderHook(() => useScraperFetch())
+
+    await act(async () => {
+      await result.current.start()
+    })
+
+    await act(async () => {
+      await result.current.cancel()
+    })
+
+    expect(api.cancelScraperSession).toHaveBeenCalledWith('sess-123')
+    expect(result.current.pollData?.status).toBe('cancelled')
+    expect(result.current.sessionId).toBeNull()
+  })
+
+  it('handles start error', async () => {
+    vi.mocked(api.startScraperSession).mockRejectedValue(new Error('Start failed'))
+    vi.mocked(errors.isUnauthorized).mockReturnValue(false)
+
+    const { result } = renderHook(() => useScraperFetch())
+
+    await act(async () => {
+      await result.current.start()
+    })
+
+    expect(result.current.error).toContain('Start failed')
+    expect(result.current.sessionId).toBeNull()
+  })
+
+  it('handles unauthorized error on start', async () => {
+    vi.mocked(api.startScraperSession).mockRejectedValue(new Error('Unauthorized'))
+    vi.mocked(errors.isUnauthorized).mockReturnValue(true)
+
+    const { result } = renderHook(() => useScraperFetch())
+
+    await act(async () => {
+      await result.current.start()
+    })
+
+    expect(result.current.isUnauthorized).toBe(true)
+    expect(result.current.error).toBe('Not authenticated')
+  })
+
+  it('handles poll error', async () => {
+    vi.mocked(api.startScraperSession).mockResolvedValue({
+      session_id: 'sess-123',
+      workspace_id: 'ws-1',
+      personal_data_uuid: 'pd-1',
+      child_id: 'c-1',
+    } as any)
+
+    vi.mocked(api.pollScraperSession).mockRejectedValue(new Error('Poll failed'))
+
+    const { result } = renderHook(() => useScraperFetch())
+
+    await act(async () => {
+      await result.current.start()
+    })
+
+    await act(async () => {
+      vi.advanceTimersByTime(1000)
+    })
+
+    expect(result.current.error).toContain('Poll failed')
+  })
+})
diff --git a/frontend/src/hooks/useScraperFetch.ts b/frontend/src/hooks/useScraperFetch.ts
new file mode 100644
index 0000000..b5e4e81
--- /dev/null
+++ b/frontend/src/hooks/useScraperFetch.ts
@@ -0,0 +1,132 @@
+import { useState, useRef, useCallback } from 'react'
+import * as api from '@/services/api'
+import { isUnauthorized } from '@/services/errors'
+
+export type ScraperStatus = 'idle' | 'launching' | 'awaiting_scan' | 'authenticating' | 'fetching' | 'done' | 'error' | 'cancelled'
+
+interface PollResponse {
+  status: ScraperStatus
+  qr_data?: string
+  result?: Record<string, unknown>
+  message?: string
+}
+
+interface ResolvedIds {
+  workspace_id: string
+  personal_data_uuid: string
+  child_id: string
+}
+
+const POLL_INTERVAL_MS = 1000
+
+interface UseScraperFetchResult {
+  sessionId: string | null
+  pollData: PollResponse | null
+  resolvedIds: ResolvedIds | null
+  error: string | null
+  isUnauthorized: boolean
+  start: (childId?: string) => Promise<void>
+  cancel: () => Promise<void>
+  isRunning: boolean
+  isTerminal: boolean
+}
+
+export function useScraperFetch(): UseScraperFetchResult {
+  const [sessionId, setSessionId] = useState<string | null>(null)
+  const [pollData, setPollData] = useState<PollResponse | null>(null)
+  const [resolvedIds, setResolvedIds] = useState<ResolvedIds | null>(null)
+  const [error, setError] = useState<string | null>(null)
+  const [unauthorizedError, setUnauthorizedError] = useState(false)
+
+  const intervalRef = useRef<ReturnType<typeof setInterval> | null>(null)
+
+  const stopPolling = useCallback(() => {
+    if (intervalRef.current) {
+      clearInterval(intervalRef.current)
+      intervalRef.current = null
+    }
+  }, [])
+
+  const isTerminalStatus = (s: ScraperStatus) =>
+    s === 'done' || s === 'error' || s === 'cancelled'
+
+  const startPolling = useCallback((sid: string) => {
+    stopPolling()
+    intervalRef.current = setInterval(async () => {
+      try {
+        const data = await api.pollScraperSession(sid)
+        setPollData(data as PollResponse)
+        if (isTerminalStatus((data as PollResponse).status)) {
+          stopPolling()
+        }
+      } catch (err) {
+        setError(err instanceof Error ? err.message : 'Poll error')
+        stopPolling()
+      }
+    }, POLL_INTERVAL_MS)
+  }, [stopPolling])
+
+  const start = useCallback(
+    async (childId?: string) => {
+      if (sessionId && pollData && !isTerminalStatus(pollData.status)) {
+        stopPolling()
+        try {
+          await api.cancelScraperSession(sessionId)
+        } catch { /* ignore */ }
+      }
+
+      setError(null)
+      setUnauthorizedError(false)
+      setPollData(null)
+      setSessionId(null)
+      setResolvedIds(null)
+
+      try {
+        const payload = childId ? { child_id: childId } : {}
+        const resp = await api.startScraperSession(payload)
+        setSessionId(resp.session_id)
+        setResolvedIds({
+          workspace_id: resp.workspace_id,
+          personal_data_uuid: resp.personal_data_uuid,
+          child_id: resp.child_id,
+        })
+        setPollData({ status: 'launching' })
+        startPolling(resp.session_id)
+      } catch (err) {
+        if (isUnauthorized(err)) {
+          setUnauthorizedError(true)
+          setError('Not authenticated')
+        } else {
+          setError(err instanceof Error ? err.message : 'Start error')
+        }
+      }
+    },
+    [sessionId, pollData, stopPolling, startPolling],
+  )
+
+  const cancel = useCallback(async () => {
+    stopPolling()
+    if (sessionId) {
+      try {
+        await api.cancelScraperSession(sessionId)
+      } catch { /* ignore */ }
+    }
+    setPollData({ status: 'cancelled' })
+    setSessionId(null)
+  }, [sessionId, stopPolling])
+
+  const isRunning = sessionId !== null && pollData !== null && !isTerminalStatus(pollData.status)
+  const isTerminal = pollData !== null && isTerminalStatus(pollData.status)
+
+  return {
+    sessionId,
+    pollData,
+    resolvedIds,
+    error,
+    isUnauthorized: unauthorizedError,
+    start,
+    cancel,
+    isRunning,
+    isTerminal,
+  }
+}
diff --git a/frontend/src/pages/Auth.tsx b/frontend/src/pages/Auth.tsx
index af4b83a..9180ccf 100644
--- a/frontend/src/pages/Auth.tsx
+++ b/frontend/src/pages/Auth.tsx
@@ -1,22 +1,34 @@
-import { useState } from 'react'
+import { useEffect, useState } from 'react'
+import { useNavigate } from 'react-router-dom'
 import { useAuth } from '@/context/AuthContext'
+import { useWorkspace } from '@/context/WorkspaceContext'
 
 export function Auth() {
-  const { login, register } = useAuth()
+  const { login, register, isAuthenticated } = useAuth()
+  const { isLoading: wsLoading } = useWorkspace()
+  const navigate = useNavigate()
   const [isRegister, setIsRegister] = useState(false)
   const [email, setEmail] = useState('')
   const [password, setPassword] = useState('')
   const [displayName, setDisplayName] = useState('')
   const [error, setError] = useState<string | null>(null)
 
+  useEffect(() => {
+    if (isAuthenticated && !wsLoading) {
+      navigate('/', { replace: true })
+    }
+  }, [isAuthenticated, wsLoading, navigate])
+
   const handleSubmit = async (e: React.FormEvent) => {
     e.preventDefault()
     setError(null)
     try {
       if (isRegister) {
         await register({ email, password, displayName })
+        navigate('/', { replace: true })
       } else {
         await login({ email, password })
+        navigate('/', { replace: true })
       }
     } catch (err: unknown) {
       setError(err instanceof Error ? err.message : 'Något gick fel')
diff --git a/frontend/src/pages/Calendar.tsx b/frontend/src/pages/Calendar.tsx
index 3cedfad..25e567b 100644
--- a/frontend/src/pages/Calendar.tsx
+++ b/frontend/src/pages/Calendar.tsx
@@ -1,14 +1,15 @@
 import { ReactNode, useState } from 'react'
 import { useWorkspace } from '@/context'
 import { usePlannedDays } from '@/hooks'
+import type { PlannedLeaveDay } from '@/types'
 import { Layout } from '@/components/layout/Layout'
 import { LoadingSpinner } from '@/components/common/LoadingSpinner'
 import { CalendarDay } from '@/components/common/CalendarDay'
 import { CalendarEvent } from '@/components/common/CalendarEvent'
 
 export function Calendar(): ReactNode {
-  const { workspace, isLoading: wsLoading } = useWorkspace()
-  const { data: plannedDays, isLoading: pdLoading } = usePlannedDays(workspace?.id ?? null)
+  const { isLoading: wsLoading, selectedChildId } = useWorkspace()
+  const { data: plannedDays, isLoading: pdLoading } = usePlannedDays(selectedChildId ?? undefined)
   const [currentMonth, setCurrentMonth] = useState(new Date(2026, 5))
 
   const isLoading = wsLoading || pdLoading
@@ -49,8 +50,8 @@ export function Calendar(): ReactNode {
 
   const getEventsForDate = (date: string) => {
     return (plannedDays ?? [])
-      .filter((pd: any) => pd.date === date)
-      .map((pd: any) => ({
+      .filter((pd: PlannedLeaveDay) => pd.date === date)
+      .map((pd: PlannedLeaveDay) => ({
         type: pd.dayType,
         color: getColorForType(pd.dayType),
         title: pd.dayType,
@@ -66,7 +67,7 @@ export function Calendar(): ReactNode {
   }
 
   return (
-    <Layout header={{ title: 'Kalender' }}>
+    <Layout>
       <div data-testid="calendar" className="calendar">
         <div className="calendar__header">
           <button onClick={handlePrevMonth} aria-label="Previous month">
diff --git a/frontend/src/pages/Dashboard.test.tsx b/frontend/src/pages/Dashboard.test.tsx
new file mode 100644
index 0000000..3271f98
--- /dev/null
+++ b/frontend/src/pages/Dashboard.test.tsx
@@ -0,0 +1,265 @@
+import { describe, it, expect, beforeEach, vi } from 'vitest'
+import { render, screen } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { BrowserRouter } from 'react-router-dom'
+import { Dashboard } from './Dashboard'
+import * as hooks from '@/hooks'
+import { useWorkspace, useAuth } from '@/context'
+
+vi.mock('@/hooks')
+vi.mock('@/context')
+vi.mock('@/services/api')
+
+const renderWithRouter = (component: React.ReactElement) => {
+  return render(<BrowserRouter>{component}</BrowserRouter>)
+}
+
+describe('Dashboard', () => {
+  const mockWorkspaceContext = {
+    workspace: { id: 'ws-1', name: 'Test Workspace', planningGoal: 'balanced' as const, createdAt: '2026-01-01' },
+    isLoading: false,
+    error: null,
+    workspaceId: 'ws-1',
+    setWorkspaceId: vi.fn(),
+    refetch: vi.fn(),
+    children: [{ id: 'c-1', name: 'Child 1', birth_date: '2022-01-01' }],
+    selectedChildId: 'c-1',
+    selectChild: vi.fn(),
+    personalDataUuid: 'pd-1',
+    parentName: 'Test Parent',
+    refreshContext: vi.fn(),
+  }
+
+  const mockAnalyticsData = {
+    workspaceId: 'ws-1',
+    childId: 'c-1',
+    parentProjections: [],
+    combinedDaysUsed: 30,
+    combinedDaysLeft: 270,
+    combinedExpiringAtB4: 100,
+  }
+
+  const mockParentalLeaveData = {
+    id: 'pf-1',
+    personalDataUuid: 'pd-1',
+    workspaceId: 'ws-1',
+    childId: 'c-1',
+    source: 'scraped' as const,
+    fetchedAt: '2026-06-13T10:00:00Z',
+    totalDays: 300,
+    daysUsed: 30,
+    daysLeft: 270,
+    reservedDaysTotal: 90,
+    reservedDaysLeft: 80,
+    transferableDaysLeft: 50,
+    dubbeldagarLeft: 60,
+    tierData: {
+      sjukpenningTotal: 100,
+      sjukpenningUsed: 10,
+      sjukpenningLeft: 90,
+      lagstaNivaTotal: 200,
+      lagstaNivaUsed: 20,
+      lagstaNivaLeft: 180,
+    },
+    createdAt: '2026-06-13T10:00:00Z',
+    updatedAt: '2026-06-13T10:00:00Z',
+  }
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+    vi.mocked(useAuth).mockReturnValue({
+      accessToken: 'token',
+      isAuthenticated: true,
+      isLoading: false,
+      login: vi.fn(),
+      register: vi.fn(),
+      logout: vi.fn(),
+    } as any)
+    vi.mocked(useWorkspace).mockReturnValue(mockWorkspaceContext as any)
+    vi.mocked(hooks.useAnalytics).mockReturnValue({
+      data: mockAnalyticsData,
+      isLoading: false,
+      error: null,
+      refresh: vi.fn(),
+    } as any)
+    vi.mocked(hooks.useParentalLeave).mockReturnValue({
+      data: mockParentalLeaveData,
+      isLoading: false,
+      error: null,
+      refresh: vi.fn(),
+    } as any)
+    vi.mocked(hooks.usePlannedDays).mockReturnValue({
+      data: [
+        { id: '1', workspaceId: 'ws-1', childId: 'c-1', parentPersonalDataUuid: 'pd-1', date: '2026-06-15', dayType: 'vacation', isDubbeldag: false, createdAt: '', updatedAt: '' },
+        { id: '2', workspaceId: 'ws-1', childId: 'c-1', parentPersonalDataUuid: 'pd-1', date: '2026-06-16', dayType: 'sjukpenning', isDubbeldag: false, createdAt: '', updatedAt: '' },
+      ],
+      isLoading: false,
+      error: null,
+      add: vi.fn(),
+      remove: vi.fn(),
+    } as any)
+    vi.mocked(hooks.useBreakPeriods).mockReturnValue({
+      data: [],
+      isLoading: false,
+      error: null,
+      add: vi.fn(),
+      remove: vi.fn(),
+    } as any)
+    vi.mocked(hooks.useScraperFetch).mockReturnValue({
+      sessionId: null,
+      pollData: null,
+      resolvedIds: null,
+      error: null,
+      isUnauthorized: false,
+      start: vi.fn(),
+      cancel: vi.fn(),
+      isRunning: false,
+      isTerminal: false,
+    } as any)
+  })
+
+  it('renders loading spinner initially', () => {
+    vi.mocked(useWorkspace).mockReturnValue({
+      ...mockWorkspaceContext,
+      isLoading: true,
+    } as any)
+    renderWithRouter(<Dashboard />)
+    expect(screen.getByText(/Loading dashboard/)).toBeInTheDocument()
+  })
+
+  it('shows add child form when no children', () => {
+    vi.mocked(useWorkspace).mockReturnValue({
+      ...mockWorkspaceContext,
+      children: [],
+      selectedChildId: null,
+    } as any)
+    renderWithRouter(<Dashboard />)
+    expect(screen.getByText(/Du har inga barn registrerade ännu/)).toBeInTheDocument()
+    expect(screen.getByLabelText(/Barnets namn/)).toBeInTheDocument()
+  })
+
+  it('shows overview metrics when children exist', () => {
+    renderWithRouter(<Dashboard />)
+    expect(screen.getByTestId('overview-metrics')).toBeInTheDocument()
+    expect(screen.getByText(/Days Used/)).toBeInTheDocument()
+  })
+
+  it('shows parental leave breakdown when data exists', () => {
+    renderWithRouter(<Dashboard />)
+    expect(screen.getByTestId('parental-leave-breakdown')).toBeInTheDocument()
+    expect(screen.getByText(/Reserverade dagar/)).toBeInTheDocument()
+  })
+
+  it('renders FK fetch button', () => {
+    renderWithRouter(<Dashboard />)
+    expect(screen.getByRole('button', { name: /Hämta från Försäkringskassan/ })).toBeInTheDocument()
+  })
+
+  it('disables FK fetch button when no child selected', () => {
+    vi.mocked(useWorkspace).mockReturnValue({
+      ...mockWorkspaceContext,
+      selectedChildId: null,
+    } as any)
+    renderWithRouter(<Dashboard />)
+    const button = screen.getByRole('button', { name: /Hämta från Försäkringskassan/ })
+    expect(button).toBeDisabled()
+  })
+
+  it('enables FK fetch button when child selected', () => {
+    renderWithRouter(<Dashboard />)
+    const button = screen.getByRole('button', { name: /Hämta från Försäkringskassan/ })
+    expect(button).not.toBeDisabled()
+  })
+
+  it('shows planned days breakdown', () => {
+    renderWithRouter(<Dashboard />)
+    expect(screen.getByTestId('days-breakdown')).toBeInTheDocument()
+  })
+
+  it('shows progress chart with real data', () => {
+    renderWithRouter(<Dashboard />)
+    expect(screen.getByTestId('progress-chart')).toBeInTheDocument()
+  })
+
+  it('shows Swedish section headings', () => {
+    renderWithRouter(<Dashboard />)
+    expect(screen.getByTestId('metrics-title')).toHaveTextContent(/Översikt/)
+    expect(screen.getAllByText(/Planerade dagar/)[0]).toBeInTheDocument()
+    expect(screen.getByText(/Återstående till 4 års ålder/)).toBeInTheDocument()
+  })
+
+  it('shows break periods section when periods exist', () => {
+    vi.mocked(hooks.useBreakPeriods).mockReturnValue({
+      data: [
+        {
+          id: 'bp-1',
+          workspaceId: 'ws-1',
+          name: 'Summer Break',
+          startDate: '2026-06-20',
+          endDate: '2026-08-31',
+          targetWeeks: 8,
+          createdAt: '2026-06-13T10:00:00Z',
+          updatedAt: '2026-06-13T10:00:00Z',
+        },
+      ],
+      isLoading: false,
+      error: null,
+      add: vi.fn(),
+      remove: vi.fn(),
+    } as any)
+    renderWithRouter(<Dashboard />)
+    expect(screen.getByText(/Break Periods/)).toBeInTheDocument()
+    expect(screen.getByText(/Summer Break/)).toBeInTheDocument()
+  })
+
+  it('displays error message if analytics fails', () => {
+    vi.mocked(hooks.useAnalytics).mockReturnValue({
+      data: null,
+      isLoading: false,
+      error: 'Failed to load analytics',
+      refresh: vi.fn(),
+    } as any)
+    renderWithRouter(<Dashboard />)
+    expect(screen.getByText(/Failed to load analytics/)).toBeInTheDocument()
+  })
+
+  it('shows empty state for parental leave when data is null', () => {
+    vi.mocked(hooks.useParentalLeave).mockReturnValue({
+      data: null,
+      isLoading: false,
+      error: null,
+      refresh: vi.fn(),
+    } as any)
+    renderWithRouter(<Dashboard />)
+    expect(screen.getByText(/Ingen data hämtad ännu/)).toBeInTheDocument()
+  })
+
+  it('opens QR code modal on FK fetch button click', async () => {
+    const user = userEvent.setup()
+    const mockStart = vi.fn()
+    vi.mocked(hooks.useScraperFetch).mockReturnValue({
+      sessionId: null,
+      pollData: null,
+      resolvedIds: null,
+      error: null,
+      isUnauthorized: false,
+      start: mockStart,
+      cancel: vi.fn(),
+      isRunning: false,
+      isTerminal: false,
+    } as any)
+
+    renderWithRouter(<Dashboard />)
+    const button = screen.getByRole('button', { name: /Hämta från Försäkringskassan/ })
+    await user.click(button)
+
+    expect(mockStart).toHaveBeenCalledWith('c-1')
+  })
+
+  it('shows FK button is not disabled by default with child selected', () => {
+    renderWithRouter(<Dashboard />)
+    const button = screen.getByRole('button', { name: /Hämta från Försäkringskassan/ })
+    expect(button).toBeInTheDocument()
+    expect(button).not.toBeDisabled()
+  })
+})
diff --git a/frontend/src/pages/Dashboard.tsx b/frontend/src/pages/Dashboard.tsx
index 8131216..9ca782b 100644
--- a/frontend/src/pages/Dashboard.tsx
+++ b/frontend/src/pages/Dashboard.tsx
@@ -1,20 +1,33 @@
-import { ReactNode } from 'react'
+import { ReactNode, useState } from 'react'
 import { useWorkspace } from '@/context'
-import { useAnalytics, usePlannedDays, useBreakPeriods } from '@/hooks'
+import { useAnalytics, usePlannedDays, useBreakPeriods, useScraperFetch, useParentalLeave } from '@/hooks'
+import type { PlannedLeaveDay, BreakPeriod } from '@/types'
+import * as api from '@/services/api'
 import { Layout } from '@/components/layout/Layout'
 import { LoadingSpinner } from '@/components/common/LoadingSpinner'
 import { OverviewMetrics } from '@/components/dashboard/OverviewMetrics'
 import { DaysBreakdown } from '@/components/dashboard/DaysBreakdown'
 import { ProgressChart } from '@/components/dashboard/ProgressChart'
+import { ParentalLeaveBreakdown } from '@/components/dashboard/ParentalLeaveBreakdown'
+import { ChildBirthdayInput } from '@/components/inputs/ChildBirthdayInput'
+import { QRCodeModal } from '@/components/modals/QRCodeModal'
 
 export function Dashboard(): ReactNode {
-  const { workspace, isLoading: wsLoading } = useWorkspace()
-  const { data: analytics, isLoading: analyticsLoading, error: analyticsError } = useAnalytics(
+  const { workspace, isLoading: wsLoading, selectedChildId, children, personalDataUuid, refreshContext } = useWorkspace()
+  const { data: analytics, isLoading: analyticsLoading, error: analyticsError, refresh: refreshAnalytics } = useAnalytics(
     workspace?.id ?? null,
-    '' // placeholder child ID; in real app would come from workspace context
+    selectedChildId ?? ''
   )
-  const { data: plannedDays, isLoading: pdLoading } = usePlannedDays(workspace?.id ?? null)
+  const { data: plannedDays, isLoading: pdLoading } = usePlannedDays(selectedChildId ?? undefined)
   const { data: breakPeriods, isLoading: bpLoading } = useBreakPeriods(workspace?.id ?? null)
+  const { data: parentalLeave, refresh: refreshParentalLeave } = useParentalLeave(personalDataUuid, selectedChildId ?? null)
+  const scraper = useScraperFetch()
+
+  const [childName, setChildName] = useState('')
+  const [childBirthDate, setChildBirthDate] = useState('')
+  const [isSubmitting, setIsSubmitting] = useState(false)
+  const [submitError, setSubmitError] = useState<string | null>(null)
+  const [showModal, setShowModal] = useState(false)
 
   const isLoading = wsLoading || analyticsLoading || pdLoading || bpLoading
 
@@ -22,16 +35,98 @@ export function Dashboard(): ReactNode {
     return <LoadingSpinner message="Loading dashboard..." />
   }
 
+  const handleAddChild = async (e: React.FormEvent) => {
+    e.preventDefault()
+    setSubmitError(null)
+    if (!workspace || !childName || !childBirthDate) {
+      setSubmitError('Please fill in all fields')
+      return
+    }
+    setIsSubmitting(true)
+    try {
+      await api.createChild({
+        workspace_id: workspace.id,
+        name: childName,
+        birth_date: childBirthDate,
+      })
+      setChildName('')
+      setChildBirthDate('')
+      await refreshContext()
+    } catch (err: unknown) {
+      setSubmitError(err instanceof Error ? err.message : 'Failed to create child')
+    } finally {
+      setIsSubmitting(false)
+    }
+  }
+
+  const handleFetchFK = async () => {
+    setShowModal(true)
+    await scraper.start(selectedChildId ?? undefined)
+  }
+
+  const handleModalClose = () => {
+    if (scraper.isRunning) return
+    setShowModal(false)
+  }
+
+  const handleFetchDone = async () => {
+    setShowModal(false)
+    await Promise.all([refreshAnalytics(), refreshParentalLeave()])
+  }
+
   const breakdown = [
-    { type: 'Vacation', count: plannedDays?.filter((d: any) => d.dayType === 'vacation').length ?? 0 },
-    { type: 'Sick Leave', count: plannedDays?.filter((d: any) => d.dayType === 'sjukpenning').length ?? 0 },
-    { type: 'Parental', count: plannedDays?.filter((d: any) => d.dayType === 'lagsta').length ?? 0 },
+    { type: 'Vacation', count: plannedDays?.filter((d: PlannedLeaveDay) => d.dayType === 'vacation').length ?? 0 },
+    { type: 'Sick Leave', count: plannedDays?.filter((d: PlannedLeaveDay) => d.dayType === 'sjukpenning').length ?? 0 },
+    { type: 'Parental', count: plannedDays?.filter((d: PlannedLeaveDay) => d.dayType === 'lagsta').length ?? 0 },
   ]
 
-  const totalPlanned = breakdown.reduce((sum, item) => sum + item.count, 0)
+  const currentWeeks = Math.floor((analytics?.combinedDaysUsed ?? 0) / 5)
+  const targetWeeks = Math.floor(((analytics?.combinedDaysUsed ?? 0) + (analytics?.combinedDaysLeft ?? 0)) / 5)
+
+  if (children.length === 0) {
+    return (
+      <Layout>
+        <div data-testid="dashboard" className="dashboard">
+          <section className="dashboard__section">
+            <h2>Lägg till barn</h2>
+            <p>Du har inga barn registrerade ännu. Lägg till ditt första barn för att börja.</p>
+            <form onSubmit={(e) => void handleAddChild(e)}>
+              <div className="form-group">
+                <label htmlFor="child-name">Barnets namn</label>
+                <input
+                  id="child-name"
+                  type="text"
+                  placeholder="Namn"
+                  value={childName}
+                  onChange={(e) => setChildName(e.target.value)}
+                  disabled={isSubmitting}
+                  required
+                />
+              </div>
+              <div className="form-group">
+                <ChildBirthdayInput
+                  birthDate={childBirthDate}
+                  onBirthDateChange={setChildBirthDate}
+                  label="Födelsedag"
+                />
+              </div>
+              {submitError && (
+                <div role="alert" className="error-message">
+                  {submitError}
+                </div>
+              )}
+              <button type="submit" disabled={isSubmitting}>
+                {isSubmitting ? 'Lägger till...' : 'Lägg till barn'}
+              </button>
+            </form>
+          </section>
+        </div>
+      </Layout>
+    )
+  }
 
   return (
-    <Layout header={{ title: 'Översikt' }}>
+    <Layout>
       <div data-testid="dashboard" className="dashboard">
         {analyticsError && (
           <div className="dashboard__error" data-testid="error-banner" role="alert">
@@ -40,9 +135,19 @@ export function Dashboard(): ReactNode {
         )}
 
         <section className="dashboard__section">
-          <h2>Overview</h2>
+          <button
+            onClick={handleFetchFK}
+            disabled={!selectedChildId}
+            style={{ padding: '0.5rem 1rem', cursor: selectedChildId ? 'pointer' : 'not-allowed' }}
+          >
+            Hämta från Försäkringskassan
+          </button>
+        </section>
+
+        <section className="dashboard__section">
           {analytics && (
             <OverviewMetrics
+              title="Översikt"
               metrics={[
                 { label: 'Days Used', value: analytics.combinedDaysUsed },
                 { label: 'Days Left', value: analytics.combinedDaysLeft },
@@ -50,18 +155,19 @@ export function Dashboard(): ReactNode {
               ]}
             />
           )}
+          <ParentalLeaveBreakdown data={parentalLeave} />
         </section>
 
         <section className="dashboard__section">
-          <h2>Planned Days</h2>
+          <h2>Planerade dagar</h2>
           <DaysBreakdown breakdown={breakdown} />
         </section>
 
         <section className="dashboard__section">
-          <h2>Progress Toward Age 4</h2>
+          <h2>Återstående till 4 års ålder</h2>
           <ProgressChart
-            currentWeeks={Math.floor(totalPlanned / 5)}
-            targetWeeks={50}
+            currentWeeks={currentWeeks}
+            targetWeeks={targetWeeks}
           />
         </section>
 
@@ -69,7 +175,7 @@ export function Dashboard(): ReactNode {
           <section className="dashboard__section">
             <h2>Break Periods ({breakPeriods.length})</h2>
             <ul className="dashboard__break-list">
-              {breakPeriods.map((period: any) => (
+              {breakPeriods.map((period: BreakPeriod) => (
                 <li key={period.id} className="dashboard__break-item">
                   <strong>{period.name}</strong>
                   <small>
@@ -80,6 +186,19 @@ export function Dashboard(): ReactNode {
             </ul>
           </section>
         )}
+
+        <QRCodeModal
+          isOpen={showModal}
+          onClose={handleModalClose}
+          onDone={handleFetchDone}
+          status={scraper.pollData?.status ?? null}
+          qrData={scraper.pollData?.qr_data}
+          result={scraper.pollData?.result}
+          message={scraper.pollData?.message}
+          error={scraper.error}
+          isRunning={scraper.isRunning}
+          onCancel={scraper.cancel}
+        />
       </div>
     </Layout>
   )
diff --git a/frontend/src/pages/DevFetch.tsx b/frontend/src/pages/DevFetch.tsx
new file mode 100644
index 0000000..5f1d1a9
--- /dev/null
+++ b/frontend/src/pages/DevFetch.tsx
@@ -0,0 +1,219 @@
+/**
+ * Dev-only scraper test harness — /dev/fetch
+ *
+ * ⚠️  This page is mounted ONLY in DEV mode (import.meta.env.DEV).
+ *     It is never included in production builds.
+ *
+ * Usage:
+ *   1. Run `npm run login` in the frontend directory.
+ *   2. Log in through the normal app flow first (the scraper endpoints require auth).
+ *   3. Click "Refresh" — the backend resolves your IDs automatically.
+ *   4. Scan the QR with BankID and watch status transitions until data appears.
+ *
+ * This runs the REAL FK scraper against the REAL Försäkringskassan site with YOUR BankID.
+ * Only run it intentionally. SCRAPER_ENABLED=true is set by npm run login:backend.
+ */
+
+import { useState, useEffect } from 'react'
+import * as api from '@/services/api'
+import { useScraperFetch } from '@/hooks'
+import { isUnauthorized } from '@/services/errors'
+
+export function DevFetch() {
+  const [context, setContext] = useState<api.UserContext | null>(null)
+  const [contextError, setContextError] = useState<string | null>(null)
+  const [childName, setChildName] = useState('')
+  const [childBirth, setChildBirth] = useState('')
+  const [creatingChild, setCreatingChild] = useState(false)
+
+  const scraper = useScraperFetch()
+
+  const loadContext = async () => {
+    try {
+      const ctx = await api.getUserContext()
+      setContext(ctx)
+      setContextError(null)
+    } catch (err) {
+      if (isUnauthorized(err)) {
+        setContextError('Not authenticated')
+      } else {
+        setContextError(err instanceof Error ? err.message : 'Failed to load context')
+      }
+    }
+  }
+
+  useEffect(() => {
+    loadContext()
+  }, [])
+
+  const handleRefresh = async () => {
+    await scraper.start()
+  }
+
+  const handleCreateChild = async () => {
+    if (!context || !childName || !childBirth) return
+    setCreatingChild(true)
+    try {
+      await api.createChild({
+        workspace_id: context.workspace_id,
+        name: childName,
+        birth_date: childBirth,
+      })
+      await loadContext()
+      setChildName('')
+      setChildBirth('')
+    } catch (err) {
+      setContextError(err instanceof Error ? err.message : 'Failed to create child')
+    } finally {
+      setCreatingChild(false)
+    }
+  }
+
+  const hasChildren = context && context.children.length > 0
+
+  return (
+    <div style={{ fontFamily: 'monospace', maxWidth: 700, margin: '2rem auto', padding: '1rem' }}>
+      <h1 style={{ fontSize: '1.2rem', marginBottom: 4 }}>🔧 FK Scraper Test Harness</h1>
+      <p style={{ color: '#888', fontSize: '0.85rem', marginBottom: '1.5rem' }}>
+        Dev-only. Runs the real FK scraper against Försäkringskassan with your BankID.
+        <br />
+        Log in through the normal app first — these endpoints require an app session.
+      </p>
+
+      {contextError && (
+        <div style={{ background: '#fee', border: '1px solid #f88', padding: '0.75rem', marginBottom: '1rem' }}>
+          <strong>Setup-fel:</strong> {contextError}
+          {scraper.isUnauthorized && (
+            <div style={{ marginTop: '0.5rem' }}>
+              <a href="/auth" style={{ color: '#0066cc', textDecoration: 'underline' }}>
+                Logga in först
+              </a>
+            </div>
+          )}
+        </div>
+      )}
+
+      {context && (
+        <div style={{ background: '#f6f8fa', border: '1px solid #ddd', padding: '0.75rem', marginBottom: '1rem', fontSize: '0.8rem' }}>
+          <div style={{ marginBottom: 4 }}>
+            <strong>Workspace:</strong> {context.workspace_id}
+          </div>
+          <div style={{ marginBottom: 4 }}>
+            <strong>PersonalData:</strong> {context.personal_data_uuid}
+          </div>
+          <div>
+            <strong>Barn:</strong>{' '}
+            {context.children.length === 0
+              ? <span style={{ color: '#c00' }}>Inga barn registrerade</span>
+              : context.children.map(c => `${c.name} (${c.birth_date})`).join(', ')}
+          </div>
+        </div>
+      )}
+
+      {context && !hasChildren && (
+        <div style={{ background: '#fffbe6', border: '1px solid #ffe58f', padding: '0.75rem', marginBottom: '1rem' }}>
+          <div style={{ marginBottom: '0.5rem', fontWeight: 'bold', fontSize: '0.9rem' }}>Registrera ett barn för att kunna köra scrapern</div>
+          <div style={{ display: 'flex', gap: '0.5rem', flexWrap: 'wrap', alignItems: 'center' }}>
+            <input
+              placeholder="Barnets namn"
+              value={childName}
+              onChange={e => setChildName(e.target.value)}
+              style={{ padding: '0.4rem', fontFamily: 'monospace', fontSize: '0.85rem' }}
+            />
+            <input
+              type="date"
+              placeholder="Födelsedatum"
+              value={childBirth}
+              onChange={e => setChildBirth(e.target.value)}
+              style={{ padding: '0.4rem', fontFamily: 'monospace', fontSize: '0.85rem' }}
+            />
+            <button
+              onClick={handleCreateChild}
+              disabled={creatingChild || !childName || !childBirth}
+              style={{ padding: '0.4rem 1rem', cursor: 'pointer' }}
+            >
+              {creatingChild ? 'Skapar…' : 'Skapa barn'}
+            </button>
+          </div>
+        </div>
+      )}
+
+      <div style={{ marginBottom: '1.5rem' }}>
+        <button
+          onClick={handleRefresh}
+          disabled={!hasChildren}
+          style={{ padding: '0.5rem 1.5rem', cursor: hasChildren ? 'pointer' : 'not-allowed', fontWeight: 'bold', opacity: hasChildren ? 1 : 0.5 }}
+        >
+          Refresh
+        </button>
+      </div>
+
+      {scraper.resolvedIds && (
+        <div style={{ color: '#aaa', fontSize: '0.75rem', marginBottom: '1rem', lineHeight: 1.6 }}>
+          <div>workspace_id: {scraper.resolvedIds.workspace_id}</div>
+          <div>personal_data_uuid: {scraper.resolvedIds.personal_data_uuid}</div>
+          <div>child_id: {scraper.resolvedIds.child_id}</div>
+        </div>
+      )}
+
+      {scraper.error && (
+        <div style={{ background: '#fee', border: '1px solid #f88', padding: '0.75rem', marginBottom: '1rem' }}>
+          <strong>Fel:</strong> {scraper.error}
+        </div>
+      )}
+
+      {scraper.pollData && (
+        <div>
+          <div style={{ marginBottom: '0.75rem' }}>
+            <strong>Status:</strong>{' '}
+            <span style={{ color: scraper.pollData.status === 'done' ? 'green' : scraper.pollData.status === 'error' ? 'red' : 'inherit' }}>
+              {scraper.pollData.status}
+            </span>
+            {scraper.pollData.message && (
+              <span style={{ color: '#888', marginLeft: '0.5rem' }}>— {scraper.pollData.message}</span>
+            )}
+          </div>
+
+          {scraper.pollData.status === 'awaiting_scan' && scraper.pollData.qr_data && (
+            <div style={{ marginBottom: '1rem' }}>
+              <p style={{ margin: '0 0 0.5rem', fontSize: '0.9rem' }}>
+                Öppna BankID-appen och skanna QR-koden (uppdateras automatiskt):
+              </p>
+              <img
+                src={`data:image/png;base64,${scraper.pollData.qr_data}`}
+                alt="BankID QR-kod"
+                style={{ width: 220, height: 220, imageRendering: 'pixelated', border: '1px solid #ccc' }}
+              />
+            </div>
+          )}
+
+          {(scraper.pollData.status === 'authenticating' || scraper.pollData.status === 'fetching') && (
+            <p style={{ color: '#555' }}>⏳ {scraper.pollData.status === 'authenticating' ? 'Autentiserar…' : 'Hämtar data från FK…'}</p>
+          )}
+
+          {scraper.pollData.status === 'done' && scraper.pollData.result && (
+            <div>
+              <p style={{ color: 'green', marginBottom: '0.5rem' }}>✅ Klar! Hämtad data:</p>
+              <pre style={{ background: '#f6f8fa', padding: '1rem', overflow: 'auto', fontSize: '0.8rem', border: '1px solid #ddd' }}>
+                {JSON.stringify(scraper.pollData.result, null, 2)}
+              </pre>
+            </div>
+          )}
+
+          {scraper.pollData.status === 'cancelled' && (
+            <p style={{ color: '#888' }}>Sessionen avbröts.</p>
+          )}
+
+          {scraper.isRunning && (
+            <button
+              onClick={scraper.cancel}
+              style={{ marginTop: '0.5rem', padding: '0.4rem 0.8rem', cursor: 'pointer', background: '#fee', border: '1px solid #faa' }}
+            >
+              Avbryt
+            </button>
+          )}
+        </div>
+      )}
+    </div>
+  )
+}
diff --git a/frontend/src/pages/Settings.tsx b/frontend/src/pages/Settings.tsx
index 57492bf..253dbd4 100644
--- a/frontend/src/pages/Settings.tsx
+++ b/frontend/src/pages/Settings.tsx
@@ -1,6 +1,7 @@
-import { ReactNode, useState } from 'react'
+import { ReactNode, useState, useEffect } from 'react'
 import { useWorkspace } from '@/context'
 import { useVacationDays, useBreakPeriods } from '@/hooks'
+import * as api from '@/services/api'
 import { Layout } from '@/components/layout/Layout'
 import { LoadingSpinner } from '@/components/common/LoadingSpinner'
 import { ChildBirthdayInput } from '@/components/inputs/ChildBirthdayInput'
@@ -10,7 +11,7 @@ import { VacationDaysInput } from '@/components/inputs/VacationDaysInput'
 import { BreakPeriodsInput } from '@/components/inputs/BreakPeriodsInput'
 
 export function Settings(): ReactNode {
-  const { workspace, isLoading: wsLoading } = useWorkspace()
+  const { workspace, isLoading: wsLoading, selectedChildId, children, personalDataUuid, refreshContext } = useWorkspace()
   const { data: vacDays, isLoading: vacLoading, upsert } = useVacationDays(workspace?.id ?? '')
   const { data: breakPeriods, isLoading: bpLoading, add: addBreakPeriod, remove: removeBreakPeriod } = useBreakPeriods(
     workspace?.id ?? null
@@ -19,20 +20,38 @@ export function Settings(): ReactNode {
   const [childBirthDate, setChildBirthDate] = useState('')
   const [parentData, setParentData] = useState({ salaryType: '', employmentStatus: '' })
   const [vacationDaysValue, setVacationDaysValue] = useState(vacDays?.[0]?.totalDays ?? 25)
-  const [planningGoal, setPlanningGoal] = useState(workspace?.planningGoal ?? 'balance')
+  const [planningGoal, setPlanningGoal] = useState<'max_time' | 'max_money' | 'balanced'>(
+    (workspace?.planningGoal as 'max_time' | 'max_money' | 'balanced') ?? 'balanced',
+  )
   const [saveMessage, setSaveMessage] = useState<{ type: 'success' | 'error'; text: string } | null>(null)
+  const [isSaving, setIsSaving] = useState(false)
 
   const isLoading = wsLoading || vacLoading || bpLoading
 
+  useEffect(() => {
+    if (vacDays?.[0]?.totalDays) {
+      setVacationDaysValue(vacDays[0].totalDays)
+    }
+  }, [vacDays])
+
+  useEffect(() => {
+    if (workspace?.planningGoal) {
+      setPlanningGoal(workspace.planningGoal)
+    }
+  }, [workspace?.planningGoal])
+
   if (isLoading) {
     return <LoadingSpinner message="Loading settings..." />
   }
 
+  const selectedChild = children.find((c) => c.id === selectedChildId)
+
   const handleSaveVacationDays = async () => {
     try {
-      if (workspace?.id) {
+      if (workspace?.id && personalDataUuid) {
+        setIsSaving(true)
         await upsert({
-          personalDataUuid: 'current-user',
+          personalDataUuid,
           workspaceId: workspace.id,
           year: new Date().getFullYear(),
           totalDays: vacationDaysValue,
@@ -40,30 +59,112 @@ export function Settings(): ReactNode {
         setSaveMessage({ type: 'success', text: 'Vacation days saved!' })
         setTimeout(() => setSaveMessage(null), 3000)
       }
-    } catch {
-      setSaveMessage({ type: 'error', text: 'Failed to save vacation days' })
+    } catch (err) {
+      setSaveMessage({
+        type: 'error',
+        text: err instanceof Error ? err.message : 'Failed to save vacation days',
+      })
+    } finally {
+      setIsSaving(false)
     }
   }
 
-  const handleAddBreakPeriod = async (period: any) => {
+  const handleSaveParentProfile = async () => {
+    try {
+      if (personalDataUuid) {
+        setIsSaving(true)
+        await api.updateParentSettings(personalDataUuid, {
+          salary_type: parentData.salaryType || undefined,
+          employment_status: parentData.employmentStatus || undefined,
+        })
+        setSaveMessage({ type: 'success', text: 'Parent profile saved!' })
+        setTimeout(() => setSaveMessage(null), 3000)
+      }
+    } catch (err) {
+      setSaveMessage({
+        type: 'error',
+        text: err instanceof Error ? err.message : 'Failed to save parent profile',
+      })
+    } finally {
+      setIsSaving(false)
+    }
+  }
+
+  const handleSavePlanningGoal = async () => {
     try {
       if (workspace?.id) {
-        await addBreakPeriod(
-          period.startDate,
-          period.endDate,
-          period.name,
-          period.targetWeeks
-        )
+        setIsSaving(true)
+        await api.updateWorkspace(workspace.id, {
+          planningGoal: planningGoal as 'max_time' | 'max_money' | 'balanced',
+        })
+        await refreshContext()
+        setSaveMessage({ type: 'success', text: 'Planning goal saved!' })
+        setTimeout(() => setSaveMessage(null), 3000)
+      }
+    } catch (err) {
+      setSaveMessage({
+        type: 'error',
+        text: err instanceof Error ? err.message : 'Failed to save planning goal',
+      })
+    } finally {
+      setIsSaving(false)
+    }
+  }
+
+  const handleSaveChildBirthDate = async () => {
+    try {
+      if (selectedChildId && childBirthDate) {
+        setIsSaving(true)
+        await api.updateChildSettings(selectedChildId, { birth_date: childBirthDate })
+        setSaveMessage({ type: 'success', text: 'Child birth date saved!' })
+        setTimeout(() => setSaveMessage(null), 3000)
+      }
+    } catch (err) {
+      setSaveMessage({
+        type: 'error',
+        text: err instanceof Error ? err.message : 'Failed to save child birth date',
+      })
+    } finally {
+      setIsSaving(false)
+    }
+  }
+
+  const handleAddBreakPeriod = async (period: { name: string; startDate: string; endDate: string; targetWeeks: number }) => {
+    try {
+      if (workspace?.id) {
+        setIsSaving(true)
+        await addBreakPeriod(period.startDate, period.endDate, period.name, period.targetWeeks)
         setSaveMessage({ type: 'success', text: 'Break period added!' })
         setTimeout(() => setSaveMessage(null), 3000)
       }
-    } catch {
-      setSaveMessage({ type: 'error', text: 'Failed to add break period' })
+    } catch (err) {
+      setSaveMessage({
+        type: 'error',
+        text: err instanceof Error ? err.message : 'Failed to add break period',
+      })
+    } finally {
+      setIsSaving(false)
+    }
+  }
+
+  const handleRemoveBreakPeriod = async (id: string) => {
+    try {
+      setIsSaving(true)
+      await removeBreakPeriod(id)
+      setSaveMessage({ type: 'success', text: 'Break period removed!' })
+      setTimeout(() => setSaveMessage(null), 3000)
+    } catch (err) {
+      setSaveMessage({
+        type: 'error',
+        text: err instanceof Error ? err.message : 'Failed to remove break period',
+      })
+    } finally {
+      setIsSaving(false)
     }
   }
 
   return (
-    <Layout header={{ title: 'Inställningar' }}>
+    <Layout>
       <div data-testid="settings-page" className="settings-page">
         <h1>Settings</h1>
 
@@ -79,10 +180,23 @@ export function Settings(): ReactNode {
 
         <section className="settings-page__section">
           <h2>Child Information</h2>
-          <ChildBirthdayInput
-            birthDate={childBirthDate}
-            onBirthDateChange={setChildBirthDate}
-          />
+          {selectedChild && (
+            <>
+              <p>Selected child: <strong>{selectedChild.name}</strong></p>
+              <ChildBirthdayInput
+                birthDate={childBirthDate}
+                onBirthDateChange={setChildBirthDate}
+              />
+              <button
+                onClick={handleSaveChildBirthDate}
+                className="settings-page__button"
+                disabled={isSaving}
+                data-testid="save-child-button"
+              >
+                {isSaving ? 'Saving...' : 'Save Child Birth Date'}
+              </button>
+            </>
+          )}
         </section>
 
         <section className="settings-page__section">
@@ -91,14 +205,30 @@ export function Settings(): ReactNode {
             parent={parentData}
             onChange={(field, val) => setParentData({ ...parentData, [field]: val })}
           />
+          <button
+            onClick={handleSaveParentProfile}
+            className="settings-page__button"
+            disabled={isSaving}
+            data-testid="save-parent-button"
+          >
+            {isSaving ? 'Saving...' : 'Save Parent Profile'}
+          </button>
         </section>
 
         <section className="settings-page__section">
           <h2>Workspace Settings</h2>
           <PlanningGoalSelector
             value={planningGoal}
-            onChange={(goal) => setPlanningGoal(goal)}
+            onChange={(goal) => setPlanningGoal(goal as 'max_time' | 'max_money' | 'balanced')}
           />
+          <button
+            onClick={handleSavePlanningGoal}
+            className="settings-page__button"
+            disabled={isSaving}
+            data-testid="save-planning-goal-button"
+          >
+            {isSaving ? 'Saving...' : 'Save Planning Goal'}
+          </button>
         </section>
 
         <section className="settings-page__section">
@@ -113,9 +243,10 @@ export function Settings(): ReactNode {
           <button
             onClick={handleSaveVacationDays}
             className="settings-page__button"
+            disabled={isSaving}
             data-testid="save-vacation-button"
           >
-            Save Vacation Days
+            {isSaving ? 'Saving...' : 'Save Vacation Days'}
           </button>
         </section>
 
@@ -124,7 +255,7 @@ export function Settings(): ReactNode {
           <BreakPeriodsInput
             periods={breakPeriods ?? []}
             onAdd={handleAddBreakPeriod}
-            onRemove={removeBreakPeriod}
+            onRemove={handleRemoveBreakPeriod}
           />
         </section>
       </div>
diff --git a/frontend/src/pages/Tips.tsx b/frontend/src/pages/Tips.tsx
index e642e04..b10af1e 100644
--- a/frontend/src/pages/Tips.tsx
+++ b/frontend/src/pages/Tips.tsx
@@ -18,7 +18,7 @@ export function Tips(): ReactNode {
   }
 
   return (
-    <Layout header={{ title: 'Tips' }}>
+    <Layout>
       <div data-testid="tips-page" className="tips-page">
         <h1>Optimization Tips</h1>
 
diff --git a/frontend/src/services/api.ts b/frontend/src/services/api.ts
index 80b90ca..72958d3 100644
--- a/frontend/src/services/api.ts
+++ b/frontend/src/services/api.ts
@@ -17,6 +17,7 @@ import type {
   VacationDays,
   VacationDaysCreateRequest,
   WorkspaceCreateRequest,
+  WorkspaceUpdateRequest,
   WorkspaceOverview,
 } from '@/types'
 import type { Workspace, BreakPeriod, Tip, PlannedLeaveDay } from '@/types'
@@ -47,10 +48,17 @@ async function apiFetch<T>(
       message: response.statusText,
     }
     try {
-      const body = (await response.json()) as { detail?: string; code?: string; message?: string }
+      const body = (await response.json()) as {
+        detail?: string | Array<{ msg?: string }>
+        code?: string
+        message?: string
+      }
+      const detail = Array.isArray(body.detail)
+        ? body.detail.map((e) => e.msg ?? JSON.stringify(e)).join('; ')
+        : body.detail
       error = {
         code: body.code ?? String(response.status),
-        message: body.detail ?? body.message ?? response.statusText,
+        message: detail ?? body.message ?? response.statusText,
       }
     } catch {
       // response body wasn't JSON — use status text
@@ -91,6 +99,30 @@ export async function refreshToken(): Promise<TokenResponse> {
   return apiFetch('/auth/refresh', { method: 'POST' })
 }
 
+export interface UserContext {
+  personal_data_uuid: string
+  workspace_id: string
+  parent_name: string
+  children: Array<{ id: string; name: string; birth_date: string }>
+}
+
+export async function getUserContext(): Promise<UserContext> {
+  return apiFetch('/auth/context')
+}
+
+export interface CreateChildRequest {
+  workspace_id: string
+  name: string
+  birth_date: string
+}
+
+export async function createChild(req: CreateChildRequest): Promise<{ id: string; name: string }> {
+  return apiFetch('/children', {
+    method: 'POST',
+    body: JSON.stringify(req),
+  })
+}
+
 // ---------------------------------------------------------------------------
 // Workspace
 // ---------------------------------------------------------------------------
@@ -103,6 +135,19 @@ export async function getWorkspace(workspaceId: string): Promise<Workspace> {
   return apiFetch(`/workspace/${workspaceId}`)
 }
 
+export async function updateWorkspace(
+  workspaceId: string,
+  req: WorkspaceUpdateRequest,
+): Promise<Workspace> {
+  return apiFetch(`/workspace/${workspaceId}`, {
+    method: 'PUT',
+    body: JSON.stringify({
+      name: req.name,
+      planning_goal: req.planningGoal,
+    }),
+  })
+}
+
 // ---------------------------------------------------------------------------
 // Vacation days (reference endpoint group — mirror this pattern for others)
 // ---------------------------------------------------------------------------
@@ -160,21 +205,55 @@ export async function getWorkspaceOverview(
   return apiFetch(`/analytics/${workspaceId}/overview?child_id=${childId}`)
 }
 
+// ---------------------------------------------------------------------------
+// Settings
+// ---------------------------------------------------------------------------
+
+interface ParentSettingsUpdate {
+  salary_type?: string | undefined
+  employment_status?: string | undefined
+}
+
+export async function updateParentSettings(
+  personalDataUuid: string,
+  payload: ParentSettingsUpdate,
+): Promise<{ uuid: string; name: string; salary_type: string; employment_status: string }> {
+  return apiFetch(`/settings/parent/${personalDataUuid}`, {
+    method: 'PUT',
+    body: JSON.stringify(payload),
+  })
+}
+
+interface ChildSettingsUpdate {
+  birth_date?: string
+  preschool_start_date?: string
+}
+
+export async function updateChildSettings(
+  childId: string,
+  payload: ChildSettingsUpdate,
+): Promise<{ id: string; name: string; birth_date: string }> {
+  return apiFetch(`/settings/child/${childId}`, {
+    method: 'PUT',
+    body: JSON.stringify(payload),
+  })
+}
+
 // ---------------------------------------------------------------------------
 // Break Periods
 // ---------------------------------------------------------------------------
 
 export async function getBreakPeriods(workspaceId: string): Promise<BreakPeriod[]> {
-  return apiFetch(`/workspaces/${workspaceId}/break-periods`)
+  return apiFetch(`/break-periods/${workspaceId}`)
 }
 
 export async function createBreakPeriod(
   workspaceId: string,
   payload: { startDate: string; endDate: string; name: string; targetWeeks: number },
 ): Promise<BreakPeriod> {
-  return apiFetch(`/workspaces/${workspaceId}/break-periods`, {
+  return apiFetch(`/break-periods`, {
     method: 'POST',
-    body: JSON.stringify(payload),
+    body: JSON.stringify({ ...payload, workspace_id: workspaceId }),
   })
 }
 
@@ -187,40 +266,74 @@ export async function deleteBreakPeriod(id: string): Promise<void> {
 // ---------------------------------------------------------------------------
 
 export async function getTips(workspaceId: string): Promise<Tip[]> {
-  return apiFetch(`/workspaces/${workspaceId}/tips`)
+  return apiFetch(`/tips/${workspaceId}`)
 }
 
 // ---------------------------------------------------------------------------
 // Parental Leave Fetch
 // ---------------------------------------------------------------------------
 
-export async function getParentalLeave(workspaceId: string): Promise<ParentalLeaveFetch> {
-  return apiFetch(`/workspaces/${workspaceId}/parental-leave`)
+export async function getParentalLeave(
+  personalDataUuid: string,
+  childId: string,
+): Promise<ParentalLeaveFetch> {
+  return apiFetch(`/parental-leave/${personalDataUuid}/${childId}`)
 }
 
 // ---------------------------------------------------------------------------
 // Planned Days
 // ---------------------------------------------------------------------------
 
-export async function getPlannedDays(
-  workspaceId: string,
-  childId?: string,
-): Promise<PlannedLeaveDay[]> {
-  const query = childId ? `?childId=${childId}` : ''
-  return apiFetch(`/workspaces/${workspaceId}/planned-days${query}`)
+export async function getPlannedDays(childId?: string): Promise<PlannedLeaveDay[]> {
+  const query = childId ? `?child_id=${childId}` : ''
+  return apiFetch(`/planned-days${query}`)
 }
 
 export async function createPlannedDay(
-  workspaceId: string,
   childId: string,
   payload: { date: string; leaveType: string },
 ): Promise<PlannedLeaveDay> {
-  return apiFetch(`/workspaces/${workspaceId}/planned-days`, {
+  return apiFetch(`/planned-days`, {
     method: 'POST',
-    body: JSON.stringify({ ...payload, childId }),
+    body: JSON.stringify({ ...payload, child_id: childId }),
   })
 }
 
 export async function deletePlannedDay(id: string): Promise<void> {
   return apiFetch(`/planned-days/${id}`, { method: 'DELETE' })
 }
+
+// ---------------------------------------------------------------------------
+// FK Scraper (dev / authenticated users only — requires scraper_enabled=true)
+// ---------------------------------------------------------------------------
+
+interface ScraperStartRequest {
+  workspace_id?: string
+  personal_data_uuid?: string
+  child_id?: string
+}
+
+interface ScraperStartResponse {
+  session_id: string
+  status: string
+  workspace_id: string
+  personal_data_uuid: string
+  child_id: string
+}
+
+export async function startScraperSession(
+  payload: ScraperStartRequest,
+): Promise<ScraperStartResponse> {
+  return apiFetch('/fetch-data/start', { method: 'POST', body: JSON.stringify(payload) })
+}
+
+export async function pollScraperSession(sessionId: string): Promise<unknown> {
+  return apiFetch(`/fetch-data/poll?session_id=${encodeURIComponent(sessionId)}`)
+}
+
+export async function cancelScraperSession(sessionId: string): Promise<void> {
+  return apiFetch('/fetch-data/cancel', {
+    method: 'POST',
+    body: JSON.stringify({ session_id: sessionId }),
+  })
+}
diff --git a/frontend/src/types/api.ts b/frontend/src/types/api.ts
index dd34bfa..e1acc16 100644
--- a/frontend/src/types/api.ts
+++ b/frontend/src/types/api.ts
@@ -19,9 +19,9 @@ export interface LoginRequest {
 }
 
 export interface TokenResponse {
-  accessToken: string
-  tokenType: string
-  expiresIn: number
+  access_token: string
+  token_type: string
+  expires_in: number
 }
 
 // Vacation days
diff --git a/frontend_mvp_complete.md b/frontend_mvp_complete.md
new file mode 100644
index 0000000..ccefa7e
--- /dev/null
+++ b/frontend_mvp_complete.md
@@ -0,0 +1,110 @@
+# Junior Developer — Frontend MVP Completion TODO
+
+**Owner:** Junior developer
+**Status:** Ready to implement (tackle **after** `frontend_polish.md`)
+**Goal:** Close the gap between the bare happy path and the app described in `ARCHITECTURE.md` — a usable shell with navigation, a working settings page, calendar planning, the manual-data fallback, and partner planning.
+
+> **Why this plan exists:** the current dashboard has no header nav, no logged-in user, no child indicator, no logout, and no reachable settings — so features that already exist in code (Calendar, Tips, Settings, manual entry) are stranded. The backend endpoints for all of this already exist; this is almost entirely **frontend wiring**.
+>
+> Work in tiers, top to bottom. **Tier 1 is the highest value** (it's what makes the app feel like an app). Keep `tsc`/lint/tests green per task. CSS stays optional — structure and function over looks.
+
+---
+
+## TIER 1 — App shell: navigation, identity, working settings
+
+### T1.1 — Real header (user, current child + switcher, nav, logout)
+
+**Problem:** `components/layout/Header.tsx` already accepts `onLogout` / `onWorkspaceSelect`, but pages only pass `{ title }`, so the nav is empty. There's no way to log out, switch pages, or see who/which child you're viewing.
+
+**Do — extend `Header` and wire it via `Layout` on every page:**
+- **Logged-in identity:** show the current parent's name. ⚠️ `GET /api/auth/context` does **not** currently return the parent's display name (only `personal_data_uuid`, `workspace_id`, `children`). Either show the email from `GET /api/auth/me`, or **ask the senior to add `name` to the `/auth/context` payload** (small, preferred). Don't hardcode.
+- **Current child + switcher:** `useWorkspace()` exposes `children`, `selectedChildId`, `selectChild()`. Render a `<select>` of children; changing it calls `selectChild(id)`. Show the selected child's name in the header. (If only one child, a static label is fine.)
+- **Nav links:** Översikt (`/`), Kalender (`/calendar`), Tips (`/tips`), Inställningar (`/settings`) using `react-router` `<Link>`/`NavLink`. These routes already exist in `App.tsx`.
+- **Logout:** a "Logga ut" button → `useAuth().logout()` then `navigate('/auth', { replace: true })`.
+- Apply the header consistently: pass the nav/user/logout props through `Layout` so every page gets the same shell (Dashboard, Calendar, Tips, Settings).
+
+**Acceptance:** Every authenticated page shows a header with the parent's name, a child selector reflecting/affecting `selectedChildId`, working nav links to all four pages, and a logout button that returns you to `/auth`.
+
+---
+
+### T1.2 — Make Settings reachable and actually save
+
+**Problem:** `pages/Settings.tsx` renders the right inputs but most saves are no-ops or broken. Notably `handleSaveVacationDays` sends `personalDataUuid: 'current-user'` (a hardcoded string, not a UUID); the **parent profile** (salary_type / employment_status) and **planning goal** have no save handlers at all; child birth/preschool date in settings doesn't persist. The page is also unreachable (fixed by T1.1 nav).
+
+**Do — wire each section to its real endpoint** (all exist; use the IDs from `useWorkspace()` context — `personalDataUuid`, `workspace.id`, `selectedChildId`):
+
+| Setting | Endpoint | Notes |
+|---|---|---|
+| Parent profile (salary_type, employment_status) | `PUT /api/settings/parent/{personal_data_uuid}` | Drives the salary-gated tips (§6). Add a save handler — currently local state only. |
+| Planning goal (max_time / max_money / balanced) | `PUT /api/workspace/{workspace_id}` | Add a save handler. Note the value strings the backend expects (check `WorkspaceUpdate` schema) — the page currently defaults to `'balance'`, confirm it's `'balanced'`. |
+| Vacation days / year | `POST /api/vacation-days` | **Fix the `'current-user'` bug** → pass the real `personalDataUuid`. |
+| Child birth date + **preschool start date** | `PUT /api/settings/child/{child_id}` | Preschool date powers the studiedagar tip. |
+| Break periods | `POST/PUT/DELETE /api/break-periods` | Mostly wired already — verify add/remove persist and reload. |
+
+- Load current values into the form (don't always default to 25 vacation days / `'balance'` — read from the fetched workspace/parent/vacation data).
+- Give each section its own save button + success/error message, and re-fetch after save so the UI reflects persisted state.
+
+**Acceptance:** From Inställningar you can set salary type, employment status, planning goal, annual vacation days, and the child's birth/preschool dates; each persists (survives reload) and shows a success message. No `'current-user'` placeholder.
+
+---
+
+## TIER 2 — Planning & data entry
+
+### T2.1 — Calendar: add / edit / delete planned days
+
+**Problem:** `pages/Calendar.tsx` renders a month grid but day clicks do nothing (per the round-3 report). Planning days is the core of the app.
+
+**Do:**
+- Clicking a day opens a small day-planner (reuse/extend the existing inputs): choose **day type** (sjukpenning / lägstanivå / vacation), and for two-parent workspaces, which parent + whether it's a dubbeldag.
+- Persist via `POST /api/planned-days`; allow delete via `DELETE /api/planned-days/{id}`; edit via the PUT route.
+- **Validate against remaining days** before saving (ARCHITECTURE feature): don't let planned FP exceed `days_left` from the latest snapshot; surface the analytics/validation error (the backend has dubbeldagar validation — show its message).
+- Refresh the calendar + the dashboard breakdown after changes.
+
+**Acceptance:** You can add, edit, and delete planned days from the calendar; the day shows its type; over-planning is blocked with a clear message; the dashboard's "Planerade dagar" reflects changes.
+
+---
+
+### T2.2 — Manual data-entry fallback
+
+**Problem:** ARCHITECTURE §2.3 mandates a manual-entry path that *always works* even if scraping is unavailable. The backend has it (`POST /api/parental-leave/manual`, `api.saveManualFetch`), but there's no UI — the only way to get data in is the scraper.
+
+**Do:**
+- Add a "Ange uppgifter manuellt" form (near the FK fetch button or in Settings) collecting the same fields the user sees on FK: `total_days`, `days_used`, reserved total/left, transferable left, dubbeldagar left, and the tier breakdown. Use the field bounds from the backend schema (`total_days` 0–480, `dubbeldagar_left` 0–60, etc.).
+- Save via `api.saveManualFetch` (`source='manual'`), then refresh the overview. The provenance line from P1 will then show "Manuellt angiven …".
+
+**Acceptance:** A user can enter their FK numbers by hand and see the overview populate, with no scraper involved.
+
+---
+
+## TIER 3 — Partner planning & tips (rounds it out)
+
+### T3.1 — Add a partner (solo planning path)
+
+**Problem:** The product premise is planning *with a partner*, but there's no UI to add a second parent. The backend supports the no-login "solo planning" path: `POST /api/workspace/{workspace_id}/parents` adds a placeholder parent profile (just a name).
+
+**Do:**
+- In Settings, add "Lägg till partner" → creates a placeholder `PersonalData` via that endpoint, then re-fetch context so the second parent appears.
+- Let per-parent settings (T1.2) and calendar planning (T2.1) target either parent.
+- **Optional / stretch:** collaborative planning via invitations (`POST /api/workspace/{id}/invitations`, `POST /api/invitations/redeem`) — list it but defer unless time allows.
+
+**Acceptance:** A user can add a partner profile and plan/configure days for both parents in one workspace.
+
+### T3.2 — Verify Tips end-to-end
+
+**Problem:** `pages/Tips.tsx` + `TipCard` exist and the backend tips engine is implemented, but the page was unreachable.
+
+**Do:** Now reachable via T1.1 nav — verify it loads tips for the selected workspace/child (`GET /api/tips/{workspace_id}`), renders severity badges, and that the salary-/goal-gated tips actually appear once T1.2 lets users set salary type and planning goal. Fix any contract mismatches you find.
+
+**Acceptance:** Tips page shows real tips driven by the user's configured settings.
+
+---
+
+## Suggested order & notes
+1. **T1.1 → T1.2** first: navigation + working settings unlock everything else and deliver the most visible improvement.
+2. Then **T2.1 (calendar)** — the biggest single chunk; budget accordingly.
+3. **T2.2 (manual fallback)** is small and satisfies an architectural must-have — good quick win.
+4. **Tier 3** rounds out the partner story; invitations are optional.
+
+**One backend dependency to flag to the senior:** the parent display name isn't in `GET /api/auth/context` (T1.1). Everything else uses endpoints that already exist — read each router's actual `@router` decorator and request/response schema before wiring, and don't invent paths (see the path-mismatch lesson from the last round).
+
+**Out of scope:** real CSS/visual design, responsive/mobile, accessibility audit, real-time updates — separate passes once the functionality is complete.
diff --git a/frontend_polish.md b/frontend_polish.md
new file mode 100644
index 0000000..3e468ef
--- /dev/null
+++ b/frontend_polish.md
@@ -0,0 +1,71 @@
+# Junior Developer — Frontend Polish TODO
+
+**Owner:** Junior developer
+**Status:** Ready to implement
+**Goal:** Clean up the rough edges left after the MVP happy path — surface the data we already fetch, fix placeholder math, kill the duplicate heading, drop the `any` casts, and backfill tests for the new code.
+**Do this first**, then move on to `frontend_mvp_complete.md`.
+
+> Keep `npx tsc --noEmit`, `npm run lint`, and `npm test` green after every task. Don't redesign anything — this is tidy-up, not new features. CSS is still out of scope (MVP can look plain).
+
+---
+
+## P1 — Show the richer FK breakdown on the overview
+
+**Problem:** The scraper fetches and persists a lot more than we display. The overview only shows three combined analytics numbers (Days Used / Days Left / Expiring at Age 4). The persisted `ParentalLeaveFetch` also has reserved vs. transferable days, dubbeldagar left, and the sjukpenning/lägstanivå tier split — all currently invisible.
+
+**Do:**
+- In `Dashboard.tsx`, use the existing `useParentalLeave(personalDataUuid, selectedChildId)` hook (both IDs come from `useWorkspace()` context) to load the latest snapshot for the selected child.
+- Render a section showing: `reserved_days_left` / `reserved_days_total`, `transferable_days_left`, `dubbeldagar_left`, and the tier breakdown (`sjukpenning_left`, `lagsta_niva_left`). Reuse `DaysBreakdown` or a simple list — no new styling needed.
+- Show data provenance + freshness per ARCHITECTURE §2.3: "Hämtad från Försäkringskassan {fetched_at}" vs "Manuellt angiven {fetched_at}" based on `source`.
+- Handle the empty case gracefully: if there's no snapshot yet (new child, never fetched), show "Ingen data hämtad ännu — tryck på Hämta från Försäkringskassan." rather than blanks.
+- After a successful FK fetch, refresh this too (the modal's `onDone` currently calls `refreshAnalytics()` — also call the parental-leave hook's `refresh()`).
+
+**Acceptance:** After a fetch, the overview shows reserved/transferable/dubbeldagar/tier numbers and a "fetched on" line; before any fetch it shows a clear empty message.
+
+---
+
+## P2 — Remove the duplicate "Overview" heading
+
+**Problem:** The dashboard renders `<h2>Overview</h2>` and then `OverviewMetrics` renders its *own* `<h2>Overview</h2>` (visible as two stacked "Overview" headings in the capture).
+
+**Do:** Remove the redundant wrapper `<h2>` in `Dashboard.tsx` (keep the one inside `OverviewMetrics`, or pass a meaningful title). While you're there, make the section headings Swedish to match the rest of the app ("Översikt", "Planerade dagar", "Återstående till 4 års ålder") — small consistency win, the header already says "Översikt".
+
+**Acceptance:** Exactly one "Översikt" heading for that section; headings are consistently Swedish.
+
+---
+
+## P3 — Fix the ProgressChart math (currently placeholder)
+
+**Problem:** `Dashboard.tsx` feeds `ProgressChart` placeholder values: `currentWeeks={Math.floor(totalPlanned / 5)}` against a hardcoded `targetWeeks={50}`. That's not a real progress metric.
+
+**Do:** Drive it from real data. The intent (per ARCHITECTURE) is progress toward the age-4 deadline. Use the analytics projection — e.g. days used (or planned) vs. total entitlement (`combinedDaysUsed` / `combinedDaysUsed + combinedDaysLeft`), or days elapsed vs. days until the child turns 4. Pick the interpretation that matches what `OverviewMetrics` already shows and label it honestly. Remove the hardcoded `50`.
+
+**Acceptance:** The progress bar reflects a real ratio from analytics data; no hardcoded target weeks.
+
+---
+
+## P4 — Drop the `any` casts
+
+**Problem:** `Dashboard.tsx` (and `Settings.tsx`) use `(d: any)` / `(period: any)` casts and an ESLint exception was added for pages. These hide type errors.
+
+**Do:** Replace the casts with the real types from `@/types` (`PlannedLeaveDay`, `BreakPeriod`, etc.). Fix the field-name access to match the typed shape. Once the casts are gone, remove the temporary `@typescript-eslint/no-explicit-any` exception for `pages/` from `eslint.config.js` (keep the test-file exception if still needed).
+
+**Acceptance:** No `any` in `pages/`; the pages-level ESLint exception is removed; `tsc`/lint green.
+
+---
+
+## P5 — Backfill tests for the new code
+
+**Problem:** The happy-path round added real code with no new tests — the count stayed at 167 (`useScraperFetch`, `QRCodeModal`, the Dashboard empty-state add-child form, and the FK-fetch button are untested).
+
+**Do:** Add focused tests following the existing patterns:
+- `useScraperFetch` — start → poll transitions → done/error/cancel; timers mocked.
+- `QRCodeModal` — renders QR when `awaiting_scan`, spinner on `authenticating`/`fetching`, result on `done`, message on `error`; close disabled while running.
+- `Dashboard` — empty state (no children) shows the add-child form; populated state shows metrics + the FK button (disabled when no child selected).
+
+**Acceptance:** New tests cover the above; full suite green and the test count goes up.
+
+---
+
+### Definition of done
+Overview shows the full FK breakdown with a freshness line; one clean Swedish heading; a real progress metric; zero `any` in pages; new tests for the scraper hook/modal/dashboard. `tsc` + lint + tests all green.
diff --git a/junior_mvp_report.md b/junior_mvp_report.md
new file mode 100644
index 0000000..57da0ce
--- /dev/null
+++ b/junior_mvp_report.md
@@ -0,0 +1,55 @@
+Summary
+
+I've successfully executed the entire Junior MVP TODO plan, completing all 6 tasks:
+
+✅ J1 — Redirect after login & register
+
+- Added useNavigate() to Auth.tsx to redirect to / after successful login/register
+- Added early redirect guard to send already-authenticated users away from /auth
+- Fixed the #1 visible bug: users are now properly navigated after authenticating
+
+✅ J2 — Bootstrap workspace after auth
+
+- Enhanced WorkspaceContext to fetch getUserContext() on auth
+- Exposed children, selectedChildId, selectChild(), personalDataUuid, and refreshContext()
+- Auto-selects the first child if any exist
+- Dashboard now loads the user's workspace and children automatically
+
+✅ J3 — Fix broken API client paths
+
+- Corrected all mismatched /workspaces/{id}/… paths in api.ts:
+- getBreakPeriods: /break-periods/{workspace_id}
+- getTips: /tips/{workspace_id}
+- getParentalLeave: /parental-leave/{personal_data_uuid}/{child_id} (new signature)
+- getPlannedDays: /planned-days (removed workspace_id requirement)
+- Updated useParentalLeave and usePlannedDays hooks to match new API contracts
+- Fixed all callers in pages and tests
+
+✅ J4 — Child registration on overview
+
+- Added empty-state UI to Dashboard when no children exist
+- Form collects name + birth date using ChildBirthdayInput component
+- On submit: calls createChild(), refreshes context, auto-selects new child
+- Show/hide form based on children existence
+
+✅ J5 — "Hämta från Försäkringskassan" on overview
+
+- Extracted scraper session logic into reusable useScraperFetch hook
+- Created QRCodeModal component for displaying QR codes and statuses
+- Added "Hämta från Försäkringskassan" button to Dashboard
+- Modal shows live QR, status transitions, and refreshes analytics on done
+- Updated DevFetch to use the new hook (eliminated duplication)
+
+✅ J6 — Dev-harness auth fix
+
+- When getUserContext() returns 401, DevFetch now shows friendly "Logga in först" link
+- Uses isUnauthorized() helper to detect auth errors
+- Users aren't greeted with raw error anymore
+
+✅ Tests & Linting
+
+- All 167 tests pass
+- npm run lint clean
+- npx tsc --noEmit green
+
+The happy path now works end-to-end: register → redirect to dashboard → add child → see overview → fetch FK data → refresh analytics. 🎉
\ No newline at end of file
diff --git a/refine_login.md b/refine_login.md
new file mode 100644
index 0000000..4ed6bc6
--- /dev/null
+++ b/refine_login.md
@@ -0,0 +1,131 @@
+# Refine the `login` Test Harness — one-click "Refresh", no manual ID entry
+
+**Owner:** Senior developer
+**Status:** Ready to implement
+**Last updated:** 2026-06-12
+**Builds on:** `data_refresh_plan.md` (§7 = the harness)
+
+---
+
+## The problem
+
+The current `/dev/fetch` harness makes me type three IDs (`workspace_id`, `personal_data_uuid`, `child_id`) into text fields, and the start button stays **disabled** until I do. That's friction I shouldn't have to deal with — I'm already logged into the app, so the app knows who I am and can figure those out itself.
+
+**What I want:** a single **Refresh** button. I click it, and the app does everything — resolves the IDs on its own, starts the BankID session, and shows me the QR code, then the fetched data. No fields to fill in.
+
+---
+
+## Clarifying the two different "buttons" (this trips people up)
+
+There are **two** separate buttons in play. Don't confuse them:
+
+1. **The harness "Refresh" button** — lives in *our* `/dev/fetch` page. This is the one *I* click. After this refinement it's the only control on the page.
+2. **Försäkringskassan's "BankID med QR-kod" link** — lives on *forsakringskassan.se*. The **backend scraper clicks this automatically** as part of starting the session. I should never see or touch it; it's the captured element in `captures/01_login_landing.*`.
+
+So "the app should itself initiate the BankID login by clicking the button I captured" means: when I press **Refresh**, the backend (Playwright) navigates to FK and clicks that captured **"BankID med QR-kod"** link for me — I don't navigate there myself.
+
+---
+
+## Goal (end state)
+
+The `/dev/fetch` page contains essentially one button: **Refresh**. Pressing it:
+
+1. Auto-resolves the IDs from my authenticated app session (no input fields).
+2. Calls `POST /api/fetch-data/start` → gets a `session_id`.
+3. Polls `GET /api/fetch-data/poll` and renders by status: QR image while `awaiting_scan` → spinner while `authenticating`/`fetching` → the fetched `ParentalLeaveFetchResponse` JSON when `done` → the error `message` on `error`.
+
+Pressing **Refresh** again cancels any in-flight session and starts a fresh one (so the button is also my "retry").
+
+---
+
+## Part A — Frontend (`/dev/fetch` page)
+
+**Remove:**
+- The three `<input>` fields (`workspace_id`, `personal_data_uuid`, `child_id`) and their `<fieldset>`.
+- The "enter the IDs / button disabled until filled" logic.
+- Rename the action from "Starta BankID-hämtning" to **"Refresh"** (or "Uppdatera" — your call; keep it one obvious button).
+
+**Behaviour on click:**
+- Immediately call `start` (see Part B for how IDs get resolved — the page sends **no IDs**, or sends the ones it fetched from the dev-default endpoint; pick one approach from Part B and stay consistent).
+- Then poll every ~1s and render by status exactly as in `data_refresh_plan.md` §7. The QR is a base64 PNG in `qr_data` → `<img src="data:image/png;base64,...">`, re-rendered each poll because it animates (~1/sec).
+- If a session is already running when Refresh is pressed, call `POST /api/fetch-data/cancel` for the old `session_id` first, then start the new one.
+
+**Keep:**
+- The dev-only mount (`import.meta.env.DEV`) and the warning header ("runs the real FK scraper against the real site with your BankID").
+- The note that I must be logged into the app first (these endpoints need an app session). That requirement doesn't change — only the *manual ID entry* goes away.
+
+**Optional nicety:** show the resolved IDs **read-only** (small grey text) once known, purely so I can see what it picked. Not editable.
+
+---
+
+## Part B — Auto-resolving the IDs (backend, the important bit)
+
+I'm authenticated, so the IDs are all derivable from `CurrentUserDep`. The chain (verified against the entities):
+
+```
+CurrentUser.personal_data_uuid          → personal_data_uuid   (User is linked 1:1 to PersonalData)
+PersonalData(personal_data_uuid).workspace_id   → workspace_id
+ChildRepository.list_by_workspace(workspace_id)[0].id  → child_id   (first/only child)
+```
+
+(`User.personal_data_uuid` is the anchor — see `entities/user.py`. Workspace is always derived from PersonalData, never stored on User, per ARCHITECTURE §3.0.)
+
+**Recommended approach — derive server-side in `/start`:**
+- Make `workspace_id`, `personal_data_uuid`, `child_id` **optional** in the `start` request body.
+- When any are omitted, the endpoint resolves them from `CurrentUserDep` using the chain above, then proceeds exactly as before.
+- When they *are* provided, honor them (keeps the door open for future multi-child selection — don't break that contract).
+- The harness then sends an **empty body** and gets a fully auto-resolved session. This is the cleanest "just click Refresh" experience and keeps the logic in one place.
+
+**Edge cases to handle (return a clear `error`/4xx, don't crash):**
+- No `PersonalData` linked to the user → "No parent profile for this account."
+- Workspace has **no child** yet → "No child in workspace — add one before fetching." (For the harness this is the main gotcha; surface it as a readable message on the page.)
+- Workspace has **multiple children** → for v1, pick the first and note it; a child picker is a later concern, out of scope here.
+
+> Alternative if you'd rather not change the `/start` contract: add a dev-only `GET /api/dev/default-ids` (mounted only when `scraper_enabled`/dev) that returns the resolved trio; the page fetches it on load and passes the IDs into `start`. Either approach is fine — server-side derivation is simpler and needs no new endpoint. Don't do both.
+
+---
+
+## Part C — Backend scraper: what "initiate the login" actually does
+
+When `start` runs (per `data_refresh_plan.md` §3–§4), the Playwright flow must, using the **real captured selectors**:
+
+1. **Navigate** to the login deep link
+   `https://www.forsakringskassan.se/privatperson/logga-in#/?goto=%2Fprivatperson%2Fmina-sidor%2Falla-e-tjanster%2Fansok-och-planera-foraldrapenning`
+   (`captures/01_login_landing.txt` (a)).
+
+2. **Accept cookies the first time.** A consent dialog appears on first visit — click **"Ja, jag godkänner alla kakor"**. Make this conditional/optional (it won't appear once cookies are set), and don't fail if it's absent (`captures/01_login_landing.txt` (c)).
+
+3. **Click "BankID med QR-kod"** — this is the FK button the harness Refresh delegates to. From `captures/01_login_landing.txt` (b) the element is:
+   ```html
+   <div class="login-link" data-test="login-link">
+     <a class="button button--primary button--full-width" href="">BankID med QR-kod</a>
+   </div>
+   ```
+   Prefer a stable locator: `page.get_by_role("link", name="BankID med QR-kod")`, or scope via the `[data-test="login-link"]` container. Avoid the volatile `button--*` utility classes as the primary selector.
+
+4. **Relay the QR.** FK redirects to `https://idpx.forsakringskassan.se/external/authentication/internal/QRBID/login` and renders the QR as an **SVG** (not an `<img>`). From `captures/02_after_bankid_qr_button.txt` (b) the element is:
+   ```
+   svg  id="phx-mobile-auth-qr-code"  data-testid="mobile-auth-qr-code"   (inside button data-testid="mobile-auth-qr-code-button")
+   ```
+   Locate it with `page.locator('[data-testid="mobile-auth-qr-code"]')` and **screenshot the element** each poll (decision §0.2 — screenshot the SVG, don't try to parse the `data-code` path). The QR updates ~1/sec, so re-capture on every `poll` while status is `awaiting_scan`.
+
+5. **Detect scan/auth.** Per `captures/02...txt` (c) and `captures/03_after_bankid_qr_scanned.*`, once I scan, FK auto-redirects. `wait_for_selector` on the post-login landing marker (`captures/04_post_login_landing.*`) to transition `authenticating → fetching`, then extract from `captures/05_foraldrapenning_overview.*` (data fields per `data_refresh_plan.md` §2).
+
+Everything FK-specific (URLs + the four selectors above) stays in `fk_scraper.py` only.
+
+---
+
+## Acceptance criteria
+
+- [ ] `/dev/fetch` shows **one** primary button ("Refresh") and **no** ID input fields.
+- [ ] Clicking Refresh (while logged into the app) starts a session with **zero** manual input and shows the live QR within a few seconds.
+- [ ] The backend auto-clicks FK's "BankID med QR-kod" link and (first time) the cookie-consent button, using the captured selectors.
+- [ ] After I scan, the page shows the fetched `ParentalLeaveFetchResponse` JSON.
+- [ ] Clicking Refresh again cancels the previous session and starts fresh.
+- [ ] Missing-child / no-profile cases show a readable error on the page, not a stack trace.
+- [ ] Still dev-only (`import.meta.env.DEV`); committed `scraper_enabled` default stays `False`.
+
+---
+
+### TL;DR
+Strip the three ID inputs and the disabled button from `/dev/fetch`; leave a single **Refresh** button. On click, the backend derives `workspace_id`/`personal_data_uuid`/`child_id` from the logged-in user (make them optional in `/start`), launches Playwright, **auto-clicks FK's captured "BankID med QR-kod" link** (and the first-time cookie consent), relays the animated QR **SVG** via element screenshot, and returns the fetched data. One click, no typing.
diff --git a/refine_login_report.md b/refine_login_report.md
new file mode 100644
index 0000000..d36308c
--- /dev/null
+++ b/refine_login_report.md
@@ -0,0 +1,164 @@
+# refine_login — Implementation Report
+
+**Date:** 2026-06-13
+**Implements:** `refine_login.md` (all three parts: A, B, C)
+**Status:** Complete — Parts A and B fully implemented; Part C (Playwright selectors) was already present in `fk_scraper.py` from prior work and required no changes.
+
+---
+
+## 1. What was done
+
+### Part A — Frontend: single Refresh button (`DevFetch.tsx`)
+
+**Removed:**
+- The three `<input>` fields (`workspace_id`, `personal_data_uuid`, `child_id`) and their enclosing `<fieldset>`.
+- The three corresponding React state variables (`workspaceId`, `personalDataUuid`, `childId`).
+- The disabled-until-filled logic (`!workspaceId || !personalDataUuid || !childId`).
+- The "Starta BankID-hämtning" button label.
+
+**Added / changed:**
+- A single **Refresh** button (always enabled, no conditions).
+- `handleRefresh` replaces `handleStart`. If a session is currently in-flight, it calls `cancelScraperSession` for the old `session_id` before starting the new one — so pressing Refresh again is also a clean retry.
+- `resolvedIds` state (`{ workspace_id, personal_data_uuid, child_id }`) populated from the `/start` response. Rendered as small grey read-only text below the button once known.
+- An explicit **Avbryt** cancel button still appears while a session is running (for intentional abort without immediately restarting).
+- The dev-only guard (`import.meta.env.DEV`) and the warning header are unchanged.
+
+### Part B — Backend: ID auto-resolution in `/start` (`fetch_data.py`)
+
+**`_StartRequest` model — fields made optional:**
+```python
+class _StartRequest(BaseModel):
+    workspace_id: UUID | None = None
+    personal_data_uuid: UUID | None = None
+    child_id: UUID | None = None
+```
+An empty `{}` body (or omitting any field) is now valid. Explicitly provided IDs are still honoured — the contract is backwards-compatible.
+
+**`_StartResponse` — resolved IDs added:**
+```python
+class _StartResponse(BaseModel):
+    session_id: str
+    status: str
+    workspace_id: UUID
+    personal_data_uuid: UUID
+    child_id: UUID
+```
+The caller always gets back the exact IDs that were used, whether they came from the body or were derived automatically.
+
+**`start_fetch` handler — ID resolution chain:**
+
+New dependencies injected: `PersonalDataRepositoryDep`, `ChildRepositoryDep`.
+
+Resolution logic (mirrors the chain in `refine_login.md` §Part B):
+1. `personal_data_uuid` = `payload.personal_data_uuid or current_user.personal_data_uuid`
+2. If `workspace_id` or `child_id` are missing, look up `PersonalData` via `pd_repo.get_by_id(personal_data_uuid)`.
+3. `workspace_id` = `payload.workspace_id or pd.workspace_id`
+4. `child_id` = `payload.child_id or child_repo.list_by_workspace(workspace_id)[0].id`
+
+**Edge cases — all return a 422 with a human-readable message (not a stack trace):**
+
+| Situation | HTTP status | Message |
+|---|---|---|
+| No `PersonalData` linked to user | 422 | "No parent profile for this account." |
+| Workspace has no children | 422 | "No child in workspace — add one before fetching." |
+| Workspace has multiple children | — | First child is picked silently (v1 behaviour per spec) |
+
+**`api.ts` — types updated:**
+```typescript
+interface ScraperStartRequest {
+  workspace_id?: string
+  personal_data_uuid?: string
+  child_id?: string
+}
+
+interface ScraperStartResponse {
+  session_id: string
+  status: string
+  workspace_id: string
+  personal_data_uuid: string
+  child_id: string
+}
+```
+
+### Part C — Playwright scraper (`fk_scraper.py`)
+
+No changes were needed. The selectors and full login flow were already implemented prior to this session:
+
+- Navigation to the FK login deep-link (`LOGIN_URL`) ✓
+- Conditional cookie-consent click (`_SEL.COOKIE_ACCEPT`) ✓
+- Click "BankID med QR-kod" (`_SEL.BANKID_QR_LINK`) ✓
+- QR SVG element screenshot loop via `_SEL.QR_BUTTON` ✓
+- Post-scan detection and transition to `authenticating` ✓
+- Post-login data extraction (`_do_extract`) ✓
+
+---
+
+## 2. How the flow now works
+
+```
+User presses Refresh
+       │
+       ▼
+[Frontend] If sessionId in-flight → POST /api/fetch-data/cancel (old session)
+       │
+       ▼
+[Frontend] POST /api/fetch-data/start  body: {}
+       │
+       ▼
+[Backend] current_user.personal_data_uuid
+       → pd_repo.get_by_id(...)  → workspace_id
+       → child_repo.list_by_workspace(...)[0].id
+       │
+       ▼
+[Backend] FKScraperService.start_session(workspace_id, personal_data_uuid, child_id)
+       → asyncio.create_task(_run_session)
+       → returns { session_id, status:"launching", workspace_id, personal_data_uuid, child_id }
+       │
+       ▼
+[Frontend] stores session_id; shows resolved IDs (grey, read-only)
+          polls GET /api/fetch-data/poll?session_id=… every 1 s
+       │
+       ▼
+[Playwright task — background]
+  1. page.goto(LOGIN_URL)
+  2. Cookie consent if present
+  3. click "BankID med QR-kod"         ← FK's own button, clicked by the scraper
+  4. wait_for_selector(QR_SVG)
+  5. status → "awaiting_scan"
+  6. Loop: screenshot QR_BUTTON element → state.qr_data (raw PNG)
+            poll response includes base64 qr_data → frontend renders <img>
+  7. User scans with BankID app
+  8. FK redirects → QR element disappears
+  9. status → "authenticating"
+ 10. wait_for_selector(ANSOK_BUTTON)
+ 11. status → "fetching"
+ 12. click Ansök, wait for valjdagar page, extract figures
+ 13. status → "done", state.result = ParentalLeaveFetch
+       │
+       ▼
+[Frontend] poll sees status:"done" → renders result as JSON
+```
+
+**Re-clicking Refresh at any point** cancels the old asyncio task (browser context is torn down in the `finally` block of `_run_session`) and starts a clean new session.
+
+---
+
+## 3. What is not working / known limitations
+
+### a) `scraper_enabled` defaults to `False` — by design
+The scraper is a no-op in production and in normal dev starts. You must run `npm run login:backend` (or set `SCRAPER_ENABLED=true` in the backend environment) to activate it. This is intentional — see the legal gate in `project_legal_gate.md`.
+
+### b) QR is a PNG screenshot of the SVG, not a true SVG export
+Per the architectural decision in `data_refresh_plan.md` §0.2, the QR image is captured by screenshotting the `[data-testid="mobile-auth-qr-code-button"]` element in Playwright. This produces a PNG, which is base64-encoded and rendered as `<img src="data:image/png;base64,...">`. If FK changes their QR element layout or uses CSS transforms, the screenshot geometry may need adjustment. The alternative — parsing the SVG `data-code` path — was explicitly ruled out as fragile.
+
+### c) Multiple children — first child picked silently
+When a workspace has more than one child, `child_id` resolves to `children[0].id`. There is no visual indication of which child was picked (beyond the resolved `child_id` shown in grey text). A child-picker UI is out of scope for this iteration per `refine_login.md` §Part B.
+
+### d) Playwright is an optional dependency
+`playwright` is imported lazily inside `_run_session` (`from playwright.async_api import async_playwright`). If the package is not installed in the backend venv, the session will immediately transition to `status: error` with a `ModuleNotFoundError`. Install with `uv add playwright && uv run playwright install chromium`.
+
+### e) No end-to-end test coverage for the scraper flow
+The Playwright session logic (`_run_session`, `_do_login`, `_do_extract`) and the auto-resolution path in `start_fetch` are not covered by the existing test suite. Unit tests for `start_fetch` that mock `pd_repo` and `child_repo` would be the next logical addition.
+
+### f) Session store is in-process memory
+`_sessions: dict[str, _SessionState]` is module-level. Sessions are lost on backend restart and are not shared across processes. This is acceptable for a dev harness but means a refresh of the dev server drops all running sessions silently.
diff --git a/senior_mvp_report.md b/senior_mvp_report.md
new file mode 100644
index 0000000..fbc9d23
--- /dev/null
+++ b/senior_mvp_report.md
@@ -0,0 +1,36 @@
+All four tasks done. Here's a summary of every change made:
+
+---
+S1 — Persist scraped snapshot
+
+fk_scraper.py:
+- Added persist_callback: Callable[[ParentalLeaveFetch], Awaitable[None]] | None field to _SessionState
+- Added persist_callback parameter to start_session()
+- Updated _do_extract(): after successful extraction, awaits the callback; on callback failure sets status=error instead of done
+
+routers/fetch_data.py:
+- Added parental_leave_repo: ParentalLeaveRepositoryDep to start_fetch
+- Created a _persist closure capturing the repo and passed it to start_session() — the shared app.state.db_connection is safe to use from the background coroutine (aiosqlite serialises all operations through its
+internal queue)
+
+S2 — Read contract (Option A)
+
+No backend changes needed. The existing GET /api/parental-leave/{personal_data_uuid}/{child_id} route (fetch_data.py:81) already calls get_latest_by_parent which orders by fetched_at DESC with no source filter —
+it returns the latest snapshot regardless of whether it's scraped or manual. The junior should point api.ts to exactly that path; both IDs come from GET /api/auth/context.
+
+S3 — Scraper enabled
+
+- backend/.env created with APP_SCRAPER_ENABLED=true (gitignored — enables the scraper for the running dev app)
+- backend/.env.example created as documentation
+- Stale "DO NOT SHIP / pending legal review" docstring in fk_scraper.py replaced with "legal cleared 2026-06" + guardrail summary
+- _SCRAPER_DISABLED 501 message updated (no longer says "pending legal review")
+- config.py comment updated to reference APP_SCRAPER_ENABLED=true and note playwright install chromium requirement
+
+Tests (S1 acceptance)
+
+3 new tests in test_fk_scraper.py:
+- test_do_extract_calls_persist_callback_on_success — unit: callback is invoked, status is done, result is set
+- test_do_extract_sets_error_when_persist_callback_fails — unit: callback failure → status=error, not done
+- TestPersistenceIntegration::test_scraped_row_is_readable_after_session_done — integration: real SQLite repo, row persisted, get_latest_by_parent returns the scraped row
+
+Full suite: 178 passed (pre-existing 1 failure in test_tips_service.py unchanged).
\ No newline at end of file
diff --git a/todo-backend.txt b/todo-backend.txt
new file mode 100644
index 0000000..a8303c3
--- /dev/null
+++ b/todo-backend.txt
@@ -0,0 +1,6 @@
+- We need smoketests to see that the backend also starts up properly, same with frontend. Because now the backend doesn't even start with "> uv run uvicorn app.main:app --reload" which is sad.
+- we shouldn't implement anything related to postgres right now. Only sqlite.
+- I'd like us to discuss the försäkringskassan.se scraper separately, to keep the scope small during test before we fully integrate it into the system:
+    - One part is to make sure that we click the button to trigger the BankID qr code. I think there should probably be a link we should call to trigger it
+    - Another part is how to scrape the page, here I think I'd like to provide the page by me logging in normally via chrome and then just cmd+s the page, so you can develop on that first and not make Försäkringskassan mad because there's an AI scraping the page multiple times during development.
+