diff --git a/Fuchs/Docs/Concepts/admin-system-status.md b/Fuchs/Docs/Concepts/admin-system-status.md
index b1593c4..fb08d51 100644
--- a/Fuchs/Docs/Concepts/admin-system-status.md
+++ b/Fuchs/Docs/Concepts/admin-system-status.md
@@ -92,6 +92,25 @@ click "Administration"  → $ocms.init('admin')
 - Every probe emits the `fuchs.systemstatus.probes` counter tagged by component + status and an
   `systemstatus.probe` activity span.
 
+### Cards on the page
+The page renders one non-probe system card, five refreshable connectivity cards (in this
+order), and the non-refreshable startup-checks card. UI labels are from `fis.admin_txt_de.js`.
+
+| Card (label) | Shows | Data source |
+| --- | --- | --- |
+| System | Hostname, OS, .NET framework, Environment, Test-Deployment flag, Prozess-ID, Laufzeit/Start (UTC) | `GetInfo()` — `Environment`/`Process.GetCurrentProcess()`, no network call |
+| SQL-Datenbank (`database`) | Server, Datenbank, Login (never the password) | Config: `fuchs_fds_ConnectionString` parsed. Probe: `SELECT @@SERVERNAME, DB_NAME(), SUSER_SNAME()` |
+| E-Mail-Dienst (`email`) | Mailer aktiv, Base-URL, Account, Server-ID, Token hinterlegt, OverrideRecipient/Umleitung aktiv | Config: `ProcessWebComSettings` / `FuchsEmailSettings`. Probe: `IComService.VerifyCredentialsAsync` → `GET {BaseUrl}/api/mailer/verify` at ProcessWeb, `ok` only when the Mailer API confirms account (+ server-id when configured) |
+| Azure Blob Storage (`blob`) | Aktiviert, Konfiguriert, Rechnungs-/Mahnungs-Container, per-container file counts (Metrics) | Config: `AzureBlobStorageSettings` / `AzureBlobStorage_ConnectionString`. Probe: `IBlobStorageService.CheckConnectivityAsync` (account-info + blob count per container) |
+| MFR (ERP) (`mfr`) | Host, Zugangsdaten hinterlegt, Sync aktiv | Config: `Fds:MFR_host` / `Fds:MFR_UserName` / `Fds:SyncEnabled`. Probe: `IMfrClientFactory.Create().GetEntities()` |
+| Azure Key Vault (`keyvault`) | Vault-URI, App-Präfix, Verwaltete Secrets (count), Client registriert | Config: `SecretManagement:VaultUri`/`AppName`/`ManagedSecretKeys`, whether a `SecretClient` is DI-registered. Probe: reads the first key in `ManagedSecretKeys` via `SecretClient.GetSecretAsync` |
+| Startup-Prüfungen (non-refreshable) | OK/Fehler/übersprungen per check: Key Vault, SQL-Datenbank, MFR, Spire.PDF-Lizenz, E-Mail (Startup-Probe) | `StartupCheckReporter.Latest`, captured once by `StartupSelfTestService` at boot; see next section |
+
+Each connectivity card also carries a colored status pill (`ok`/`error`/`disabled`/`unconfigured`)
+and a per-card "Aktualisieren" button (`POST /do/admin/probe/<component>`); the topbar "Alle
+prüfen" button re-runs all five in parallel via `POST /do/admin/status`. The E-Mail-Dienst card
+additionally hosts the test-email dialog (see `SendTestEmailAsync` below).
+
 ### Startup-checks widget (non-refreshable)
 `StartupSelfTestService` runs the boot self-test once (Key Vault / Database / MFR / PDF-license /
 mailer, gated by `Fuchs:StartupChecks:*`). It now also writes its outcome to the singleton
diff --git a/Fuchs/Services/SystemStatusService.cs b/Fuchs/Services/SystemStatusService.cs
index 837dd81..ab8ed6b 100644
--- a/Fuchs/Services/SystemStatusService.cs
+++ b/Fuchs/Services/SystemStatusService.cs
@@ -1,4 +1,4 @@
-using System.Diagnostics;
+using System.Diagnostics;
 using Azure;
 using Azure.Security.KeyVault.Secrets;
 using Fuchs.intranet;