diff --git a/ops/diag/archicratie-diag.sh b/ops/diag/archicratie-diag.sh
new file mode 100755
index 0000000..16c85a4
--- /dev/null
+++ b/ops/diag/archicratie-diag.sh
@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+CTX="${1:-/volume2/docker/archicratie-web/current}"
+EDGE_PORT="${EDGE_PORT:-18080}"
+STAGING_HOST="${STAGING_HOST:-staging.archicratie.trans-hands.synology.me}"
+LIVE_HOST="${LIVE_HOST:-archicratie.trans-hands.synology.me}"
+
+BLUE_CNAME="${BLUE_CNAME:-archicratie-web-blue}"
+GREEN_CNAME="${GREEN_CNAME:-archicratie-web-green}"
+
+BLUE_UPSTREAM="${BLUE_UPSTREAM:-8081}"
+GREEN_UPSTREAM="${GREEN_UPSTREAM:-8082}"
+
+echo "== Archicratie diagnostic =="
+echo "CTX=$CTX"
+echo "EDGE_PORT=$EDGE_PORT"
+echo "STAGING_HOST=$STAGING_HOST"
+echo "LIVE_HOST=$LIVE_HOST"
+echo "BLUE_CNAME=$BLUE_CNAME  BLUE_UPSTREAM=$BLUE_UPSTREAM"
+echo "GREEN_CNAME=$GREEN_CNAME GREEN_UPSTREAM=$GREEN_UPSTREAM"
+echo
+
+echo "== 1) Containers status (docker ps) =="
+sudo docker ps --filter name=archicratie-web --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}"
+echo
+
+echo "== 2) Port bindings (source de vérité: docker port) =="
+echo "-- $BLUE_CNAME --"
+sudo docker port "$BLUE_CNAME" 80 || true
+echo "-- $GREEN_CNAME --"
+sudo docker port "$GREEN_CNAME" 80 || true
+echo
+
+echo "== 3) Canonical upstream direct (8081/8082) =="
+for p in "$BLUE_UPSTREAM" "$GREEN_UPSTREAM"; do
+  echo "-- 127.0.0.1:$p --"
+  curl -fsS "http://127.0.0.1:$p/" \
+    | grep -oE 'rel="canonical" href="[^"]+"' \
+    | head -n 1 || echo "WARN: canonical not found"
+done
+echo
+
+echo "== 4) Edge routing proof (HEAD via Host header) =="
+echo "-- staging via edge --"
+curl -sSI -H "Host: $STAGING_HOST" "http://127.0.0.1:$EDGE_PORT/" \
+  | grep -iE 'HTTP/|location:|x-archi-router|x-archi-route' \
+  | head -n 30 || true
+echo
+
+echo "-- live via edge --"
+curl -sSI -H "Host: $LIVE_HOST" "http://127.0.0.1:$EDGE_PORT/" \
+  | grep -iE 'HTTP/|location:|x-archi-router|x-archi-route' \
+  | head -n 30 || true
+echo
+
+echo "== 5) Traefik errors last 5m (hard fail only) =="
+if sudo docker logs edge-traefik --since 5m | grep -Ei 'level=error|middleware .* does not exist|yaml' >/dev/null; then
+  echo "❌ FOUND traefik errors:"
+  sudo docker logs edge-traefik --since 5m | grep -Ei 'level=error|middleware .* does not exist|yaml' | tail -n 200
+  exit 2
+else
+  echo "✅ OK: pas d'erreur critique traefik (5m)"
+fi
+echo
+
+echo "== 6) Quick expectations (soft checks) =="
+BLUE_BIND="$(sudo docker port "$BLUE_CNAME" 80 2>/dev/null || true)"
+GREEN_BIND="$(sudo docker port "$GREEN_CNAME" 80 2>/dev/null || true)"
+
+if echo "$BLUE_BIND" | grep -q "127.0.0.1:$BLUE_UPSTREAM"; then
+  echo "✅ BLUE binding OK: $BLUE_BIND"
+else
+  echo "⚠️  BLUE binding unexpected: $BLUE_BIND"
+fi
+
+if echo "$GREEN_BIND" | grep -q "127.0.0.1:$GREEN_UPSTREAM"; then
+  echo "✅ GREEN binding OK: $GREEN_BIND"
+else
+  echo "⚠️  GREEN binding unexpected: $GREEN_BIND"
+fi
+
+echo
+echo "✅ Diagnostic complete."