ops(diag): add archicratie deploy/edge diagnostic script

2026-02-21 17:45:52 +01:00
28 changed files with 330 additions and 2741 deletions
--- a/.gitea/ISSUE_TEMPLATE/correction-paragraphe.md
+++ b/.gitea/ISSUE_TEMPLATE/correction-paragraphe.md
@@ -3,7 +3,7 @@ name: "Correction paragraphe"
 about: "Proposer une correction ciblée (un paragraphe) avec justification."
 ---

-## Chemin (ex: /archicrat-ia/prologue/)
+## Chemin (ex: /archicratie/prologue/)
 <!-- obligatoire -->
 /...

--- a/.gitea/ISSUE_TEMPLATE/verification-factuelle.md
+++ b/.gitea/ISSUE_TEMPLATE/verification-factuelle.md
@@ -3,7 +3,7 @@ name: "Vérification factuelle / sources"
 about: "Signaler une assertion à sourcer ou à corriger (preuves, références)."
 ---

-## Chemin (ex: /archicrat-ia/prologue/)
+## Chemin (ex: /archicratie/prologue/)
 <!-- obligatoire -->
 /...

--- a/.gitea/workflows/anno-apply-pr.yml
+++ b/.gitea/workflows/anno-apply-pr.yml
@@ -1,343 +0,0 @@
-name: Anno Apply (PR)
-
-on:
-  issues:
-    types: [labeled]
-  workflow_dispatch:
-    inputs:
-      issue:
-        description: "Issue number to apply"
-        required: true
-
-env:
-  NODE_OPTIONS: --dns-result-order=ipv4first
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  apply-approved:
-    runs-on: ubuntu-latest
-    container:
-      image: mcr.microsoft.com/devcontainers/javascript-node:22-bookworm
-
-    steps:
-      - name: Tools sanity
-        run: |
-          set -euo pipefail
-          git --version
-          node --version
-          npm --version
-          npm ping --registry=https://registry.npmjs.org
-
-      - name: Derive context (event.json / workflow_dispatch)
-        env:
-          INPUT_ISSUE: ${{ inputs.issue }}
-          FORGE_API: ${{ vars.FORGE_API || vars.FORGE_BASE }}
-        run: |
-          set -euo pipefail
-          export EVENT_JSON="/var/run/act/workflow/event.json"
-          test -f "$EVENT_JSON" || { echo "❌ Missing $EVENT_JSON"; exit 1; }
-
-          node --input-type=module - <<'NODE' > /tmp/anno.env
-          import fs from "node:fs";
-
-          const ev = JSON.parse(fs.readFileSync(process.env.EVENT_JSON, "utf8"));
-          const repoObj = ev?.repository || {};
-
-          const cloneUrl =
-            repoObj?.clone_url ||
-            (repoObj?.html_url ? (repoObj.html_url.replace(/\/$/,"") + ".git") : "");
-
-          if (!cloneUrl) throw new Error("No repository clone_url/html_url in event.json");
-
-          let owner =
-            repoObj?.owner?.login ||
-            repoObj?.owner?.username ||
-            (repoObj?.full_name ? repoObj.full_name.split("/")[0] : "");
-
-          let repo =
-            repoObj?.name ||
-            (repoObj?.full_name ? repoObj.full_name.split("/")[1] : "");
-
-          if (!owner || !repo) {
-            const m = cloneUrl.match(/[:/](?<o>[^/]+)\/(?<r>[^/]+?)(?:\.git)?$/);
-            if (m?.groups) { owner = owner || m.groups.o; repo = repo || m.groups.r; }
-          }
-          if (!owner || !repo) throw new Error("Cannot infer owner/repo");
-
-          const defaultBranch = repoObj?.default_branch || "main";
-
-          const issueNumber =
-            ev?.issue?.number ||
-            ev?.issue?.index ||
-            (process.env.INPUT_ISSUE ? Number(process.env.INPUT_ISSUE) : 0);
-
-          if (!issueNumber || !Number.isFinite(Number(issueNumber))) {
-            throw new Error("No issue number in event.json or workflow_dispatch input");
-          }
-
-          const labelName =
-            ev?.label?.name ||
-            ev?.label ||
-            "workflow_dispatch";
-
-          const u = new URL(cloneUrl);
-          const origin = u.origin;
-
-          const apiBase = (process.env.FORGE_API && String(process.env.FORGE_API).trim())
-            ? String(process.env.FORGE_API).trim().replace(/\/+$/,"")
-            : origin;
-
-          function sh(s){ return JSON.stringify(String(s)); }
-
-          process.stdout.write([
-            `CLONE_URL=${sh(cloneUrl)}`,
-            `OWNER=${sh(owner)}`,
-            `REPO=${sh(repo)}`,
-            `DEFAULT_BRANCH=${sh(defaultBranch)}`,
-            `ISSUE_NUMBER=${sh(issueNumber)}`,
-            `LABEL_NAME=${sh(labelName)}`,
-            `API_BASE=${sh(apiBase)}`
-          ].join("\n") + "\n");
-          NODE
-
-          echo "✅ context:"
-          sed -n '1,120p' /tmp/anno.env
-
-      - name: Gate on label state/approved
-        run: |
-          set -euo pipefail
-          source /tmp/anno.env
-          if [[ "$LABEL_NAME" != "state/approved" && "$LABEL_NAME" != "workflow_dispatch" ]]; then
-            echo "ℹ️ label=$LABEL_NAME => skip"
-            echo "SKIP=1" >> /tmp/anno.env
-            exit 0
-          fi
-          echo "✅ proceed (issue=$ISSUE_NUMBER)"
-
-      - name: Checkout default branch
-        run: |
-          set -euo pipefail
-          source /tmp/anno.env
-          [[ "${SKIP:-0}" != "1" ]] || { echo "ℹ️ skipped"; exit 0; }
-
-          rm -rf .git
-          git init -q
-          git remote add origin "$CLONE_URL"
-          git fetch --depth 1 origin "$DEFAULT_BRANCH"
-          git -c advice.detachedHead=false checkout -q FETCH_HEAD
-          git log -1 --oneline
-
-      - name: Install deps
-        run: |
-          set -euo pipefail
-          source /tmp/anno.env
-          [[ "${SKIP:-0}" != "1" ]] || { echo "ℹ️ skipped"; exit 0; }
-          npm ci
-
-      - name: Check apply script exists
-        run: |
-          set -euo pipefail
-          source /tmp/anno.env
-          [[ "${SKIP:-0}" != "1" ]] || { echo "ℹ️ skipped"; exit 0; }
-          test -f scripts/apply-annotation-ticket.mjs || {
-            echo "❌ missing scripts/apply-annotation-ticket.mjs on $DEFAULT_BRANCH"
-            ls -la scripts | sed -n '1,200p' || true
-            exit 1
-          }
-
-      - name: Build dist (needed for --verify)
-        run: |
-          set -euo pipefail
-          source /tmp/anno.env
-          [[ "${SKIP:-0}" != "1" ]] || { echo "ℹ️ skipped"; exit 0; }
-
-          npm run build:clean
-
-          test -f dist/para-index.json || {
-            echo "❌ missing dist/para-index.json after build"
-            ls -la dist | sed -n '1,200p' || true
-            exit 1
-          }
-          echo "✅ dist/para-index.json present"
-
-      - name: Apply ticket on bot branch (strict+verify, commit)
-        continue-on-error: true
-        env:
-          FORGE_TOKEN: ${{ secrets.FORGE_TOKEN }}
-          BOT_GIT_NAME: ${{ secrets.BOT_GIT_NAME }}
-          BOT_GIT_EMAIL: ${{ secrets.BOT_GIT_EMAIL }}
-        run: |
-          set -euo pipefail
-          source /tmp/anno.env
-          [[ "${SKIP:-0}" != "1" ]] || { echo "ℹ️ skipped"; exit 0; }
-
-          test -n "${FORGE_TOKEN:-}" || { echo "❌ Missing secret FORGE_TOKEN"; exit 1; }
-
-          git config user.name  "${BOT_GIT_NAME:-archicratie-bot}"
-          git config user.email "${BOT_GIT_EMAIL:-bot@archicratie.local}"
-
-          START_SHA="$(git rev-parse HEAD)"
-          TS="$(date -u +%Y%m%d-%H%M%S)"
-          BR="bot/anno-${ISSUE_NUMBER}-${TS}"
-          echo "BRANCH=$BR" >> /tmp/anno.env
-          git checkout -b "$BR"
-
-          export FORGE_API="$API_BASE"
-          export GITEA_OWNER="$OWNER"
-          export GITEA_REPO="$REPO"
-
-          LOG="/tmp/apply.log"
-          set +e
-          node scripts/apply-annotation-ticket.mjs "$ISSUE_NUMBER" --strict --verify --commit >"$LOG" 2>&1
-          RC=$?
-          set -e
-
-          echo "APPLY_RC=$RC" >> /tmp/anno.env
-
-          echo "== apply log (tail) =="
-          tail -n 180 "$LOG" || true
-
-          END_SHA="$(git rev-parse HEAD)"
-
-          if [[ "$RC" -ne 0 ]]; then
-            echo "NOOP=0" >> /tmp/anno.env
-            exit 0
-          fi
-
-          if [[ "$START_SHA" == "$END_SHA" ]]; then
-            echo "NOOP=1" >> /tmp/anno.env
-          else
-            echo "NOOP=0" >> /tmp/anno.env
-            echo "END_SHA=$END_SHA" >> /tmp/anno.env
-          fi
-
-      - name: Comment issue on failure (strict/verify/etc)
-        if: ${{ always() }}
-        env:
-          FORGE_TOKEN: ${{ secrets.FORGE_TOKEN }}
-        run: |
-          set -euo pipefail
-          source /tmp/anno.env
-          [[ "${SKIP:-0}" != "1" ]] || { echo "ℹ️ skipped"; exit 0; }
-
-          RC="${APPLY_RC:-0}"
-          if [[ "$RC" == "0" ]]; then
-            echo "ℹ️ no failure detected"
-            exit 0
-          fi
-
-          BODY="$(tail -n 160 /tmp/apply.log | sed 's/\r$//')"
-          MSG="❌ apply-annotation-ticket a échoué (rc=${RC}).\n\n\`\`\`\n${BODY}\n\`\`\`\n"
-
-          PAYLOAD="$(node --input-type=module -e 'console.log(JSON.stringify({body: process.argv[1]||""}))' "$MSG")"
-
-          curl -fsS -X POST \
-            -H "Authorization: token $FORGE_TOKEN" \
-            -H "Content-Type: application/json" \
-            "$API_BASE/api/v1/repos/$OWNER/$REPO/issues/$ISSUE_NUMBER/comments" \
-            --data-binary "$PAYLOAD"
-
-      - name: Comment issue if no-op (already applied)
-        if: ${{ always() }}
-        env:
-          FORGE_TOKEN: ${{ secrets.FORGE_TOKEN }}
-        run: |
-          set -euo pipefail
-          source /tmp/anno.env
-          [[ "${SKIP:-0}" != "1" ]] || exit 0
-
-          [[ "${APPLY_RC:-0}" == "0" ]] || exit 0
-          [[ "${NOOP:-0}" == "1" ]] || exit 0
-
-          MSG="ℹ️ Ticket #${ISSUE_NUMBER} : rien à appliquer (déjà présent / dédupliqué)."
-          PAYLOAD="$(node --input-type=module -e 'console.log(JSON.stringify({body: process.argv[1]||""}))' "$MSG")"
-
-          curl -fsS -X POST \
-            -H "Authorization: token $FORGE_TOKEN" \
-            -H "Content-Type: application/json" \
-            "$API_BASE/api/v1/repos/$OWNER/$REPO/issues/$ISSUE_NUMBER/comments" \
-            --data-binary "$PAYLOAD"
-
-      - name: Push bot branch
-        if: ${{ always() }}
-        env:
-          FORGE_TOKEN: ${{ secrets.FORGE_TOKEN }}
-        run: |
-          set -euo pipefail
-          source /tmp/anno.env
-          [[ "${SKIP:-0}" != "1" ]] || exit 0
-
-          [[ "${APPLY_RC:-0}" == "0" ]] || { echo "ℹ️ apply failed -> skip push"; exit 0; }
-          [[ "${NOOP:-0}" == "0" ]] || { echo "ℹ️ no-op -> skip push"; exit 0; }
-
-          AUTH_URL="$(node --input-type=module -e '
-            const [clone, tok] = process.argv.slice(1);
-            const u = new URL(clone);
-            u.username = "oauth2";
-            u.password = tok;
-            console.log(u.toString());
-          ' "$CLONE_URL" "$FORGE_TOKEN")"
-
-          git remote set-url origin "$AUTH_URL"
-          git push -u origin "$BRANCH"
-
-      - name: Create PR + comment issue
-        if: ${{ always() }}
-        env:
-          FORGE_TOKEN: ${{ secrets.FORGE_TOKEN }}
-        run: |
-          set -euo pipefail
-          source /tmp/anno.env
-          [[ "${SKIP:-0}" != "1" ]] || exit 0
-
-          [[ "${APPLY_RC:-0}" == "0" ]] || { echo "ℹ️ apply failed -> skip PR"; exit 0; }
-          [[ "${NOOP:-0}" == "0" ]] || { echo "ℹ️ no-op -> skip PR"; exit 0; }
-
-          PR_TITLE="anno: apply ticket #${ISSUE_NUMBER}"
-          PR_BODY="PR auto depuis ticket #${ISSUE_NUMBER} (state/approved).\n\n- Branche: ${BRANCH}\n- Commit: ${END_SHA}\n\nMerge si CI OK."
-
-          PR_PAYLOAD="$(node --input-type=module -e '
-            const [title, body, base, head] = process.argv.slice(1);
-            console.log(JSON.stringify({ title, body, base, head, allow_maintainer_edit: true }));
-          ' "$PR_TITLE" "$PR_BODY" "$DEFAULT_BRANCH" "${OWNER}:${BRANCH}")"
-
-          PR_JSON="$(curl -fsS -X POST \
-            -H "Authorization: token $FORGE_TOKEN" \
-            -H "Content-Type: application/json" \
-            "$API_BASE/api/v1/repos/$OWNER/$REPO/pulls" \
-            --data-binary "$PR_PAYLOAD")"
-
-          PR_URL="$(node --input-type=module -e '
-            const pr = JSON.parse(process.argv[1] || "{}");
-            console.log(pr.html_url || pr.url || "");
-          ' "$PR_JSON")"
-
-          test -n "$PR_URL" || { echo "❌ PR URL missing. Raw: $PR_JSON"; exit 1; }
-
-          MSG="✅ PR créée pour ticket #${ISSUE_NUMBER} : ${PR_URL}"
-          C_PAYLOAD="$(node --input-type=module -e 'console.log(JSON.stringify({body: process.argv[1]||""}))' "$MSG")"
-
-          curl -fsS -X POST \
-            -H "Authorization: token $FORGE_TOKEN" \
-            -H "Content-Type: application/json" \
-            "$API_BASE/api/v1/repos/$OWNER/$REPO/issues/$ISSUE_NUMBER/comments" \
-            --data-binary "$C_PAYLOAD"
-
-          echo "✅ PR: $PR_URL"
-
-      - name: Finalize (fail job if apply failed)
-        if: ${{ always() }}
-        run: |
-          set -euo pipefail
-          source /tmp/anno.env || true
-          [[ "${SKIP:-0}" != "1" ]] || { echo "ℹ️ skipped"; exit 0; }
-
-          RC="${APPLY_RC:-0}"
-          if [[ "$RC" != "0" ]]; then
-            echo "❌ apply failed (rc=$RC)"
-            exit "$RC"
-          fi
-          echo "✅ apply ok"
--- a/.gitea/workflows/anno-reject.yml
+++ b/.gitea/workflows/anno-reject.yml
@@ -1,98 +0,0 @@
-name: Anno Reject
-
-on:
-  issues:
-    types: [labeled]
-
-env:
-  NODE_OPTIONS: --dns-result-order=ipv4first
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  reject:
-    runs-on: ubuntu-latest
-    container:
-      image: mcr.microsoft.com/devcontainers/javascript-node:22-bookworm
-
-    steps:
-      - name: Derive context
-        run: |
-          set -euo pipefail
-          export EVENT_JSON="/var/run/act/workflow/event.json"
-          test -f "$EVENT_JSON" || { echo "❌ Missing $EVENT_JSON"; exit 1; }
-
-          node --input-type=module - <<'NODE' > /tmp/reject.env
-          import fs from "node:fs";
-
-          const ev = JSON.parse(fs.readFileSync(process.env.EVENT_JSON, "utf8"));
-          const repoObj = ev?.repository || {};
-          const cloneUrl =
-            repoObj?.clone_url ||
-            (repoObj?.html_url ? (repoObj.html_url.replace(/\/$/,"") + ".git") : "");
-          if (!cloneUrl) throw new Error("No repository url");
-
-          let owner =
-            repoObj?.owner?.login ||
-            repoObj?.owner?.username ||
-            (repoObj?.full_name ? repoObj.full_name.split("/")[0] : "");
-          let repo =
-            repoObj?.name ||
-            (repoObj?.full_name ? repoObj.full_name.split("/")[1] : "");
-
-          if (!owner || !repo) {
-            const m = cloneUrl.match(/[:/](?<o>[^/]+)\/(?<r>[^/]+?)(?:\.git)?$/);
-            if (m?.groups) { owner = owner || m.groups.o; repo = repo || m.groups.r; }
-          }
-          if (!owner || !repo) throw new Error("Cannot infer owner/repo");
-
-          const issueNumber = ev?.issue?.number || ev?.issue?.index;
-          if (!issueNumber) throw new Error("No issue number");
-
-          const labelName = ev?.label?.name || ev?.label || "";
-          const u = new URL(cloneUrl);
-
-          function sh(s){ return JSON.stringify(String(s)); }
-          process.stdout.write([
-            `OWNER=${sh(owner)}`,
-            `REPO=${sh(repo)}`,
-            `ISSUE_NUMBER=${sh(issueNumber)}`,
-            `LABEL_NAME=${sh(labelName)}`,
-            `API_BASE=${sh(u.origin)}`
-          ].join("\n") + "\n");
-          NODE
-
-      - name: Gate on label state/rejected
-        run: |
-          set -euo pipefail
-          source /tmp/reject.env
-          if [[ "$LABEL_NAME" != "state/rejected" ]]; then
-            echo "ℹ️ label=$LABEL_NAME => skip"
-            exit 0
-          fi
-          echo "✅ reject issue=$ISSUE_NUMBER"
-
-      - name: Comment + close issue
-        env:
-          FORGE_TOKEN: ${{ secrets.FORGE_TOKEN }}
-        run: |
-          set -euo pipefail
-          source /tmp/reject.env
-          test -n "${FORGE_TOKEN:-}" || { echo "❌ Missing secret FORGE_TOKEN"; exit 1; }
-
-          MSG="❌ Ticket #${ISSUE_NUMBER} refusé (label state/rejected)."
-          PAYLOAD="$(node --input-type=module -e 'console.log(JSON.stringify({body: process.argv[1]||""}))' "$MSG")"
-
-          curl -fsS -X POST \
-            -H "Authorization: token $FORGE_TOKEN" \
-            -H "Content-Type: application/json" \
-            "$API_BASE/api/v1/repos/$OWNER/$REPO/issues/$ISSUE_NUMBER/comments" \
-            --data-binary "$PAYLOAD"
-
-          curl -fsS -X PATCH \
-            -H "Authorization: token $FORGE_TOKEN" \
-            -H "Content-Type: application/json" \
-            "$API_BASE/api/v1/repos/$OWNER/$REPO/issues/$ISSUE_NUMBER" \
-            --data-binary '{"state":"closed"}'
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -79,7 +79,22 @@ jobs:
          set -euo pipefail
          npm ci

-      - name: Full test suite (CI=1)
+      - name: Inline scripts syntax check
        run: |
          set -euo pipefail
-          npm run ci
+          node scripts/check-inline-js.mjs
+
+      - name: Build (includes postbuild injection + pagefind)
+        run: |
+          set -euo pipefail
+          npm run build
+
+      - name: Anchors contract
+        run: |
+          set -euo pipefail
+          npm run test:anchors
+
+      - name: Verify anchor aliases injected in dist
+        run: |
+          set -euo pipefail
+          node scripts/verify-anchor-aliases-in-dist.mjs
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -0,0 +1,103 @@
+name: CI
+
+on:
+  push: {}
+  pull_request:
+    branches: ["master"]
+  workflow_dispatch: {}
+
+env:
+  NODE_OPTIONS: --dns-result-order=ipv4first
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  build-and-anchors:
+    runs-on: ubuntu-latest
+    container:
+      image: mcr.microsoft.com/devcontainers/javascript-node:22-bookworm
+
+    steps:
+      - name: Tools sanity
+        run: |
+          set -euo pipefail
+          git --version
+          node --version
+          npm --version
+          npm ping --registry=https://registry.npmjs.org
+
+      - name: Checkout (from event.json, no external actions)
+        run: |
+          set -euo pipefail
+          EVENT_JSON="/var/run/act/workflow/event.json"
+          test -f "$EVENT_JSON" || (echo "❌ Missing $EVENT_JSON" && exit 1)
+
+          eval "$(node - <<'NODE'
+          import fs from "node:fs";
+          const ev = JSON.parse(fs.readFileSync("/var/run/act/workflow/event.json","utf8"));
+          const repo =
+            ev?.repository?.clone_url ||
+            (ev?.repository?.html_url ? (ev.repository.html_url.replace(/\/$/,'') + ".git") : "");
+          const sha =
+            ev?.after ||
+            ev?.pull_request?.head?.sha ||
+            ev?.head_commit?.id ||
+            ev?.sha ||
+            "";
+          if (!repo) { console.error("No repository.clone_url/html_url in event.json"); process.exit(1); }
+          if (!sha)  { console.error("No sha/after/pull_request.head.sha in event.json"); process.exit(1); }
+          console.log(`REPO_URL=${JSON.stringify(repo)}`);
+          console.log(`SHA=${JSON.stringify(sha)}`);
+NODE
+          )"
+
+          echo "Repo URL: $REPO_URL"
+          echo "SHA:      $SHA"
+
+          rm -rf .git
+          git init
+          git remote add origin "$REPO_URL"
+          git fetch --depth 1 origin "$SHA"
+          git checkout -q FETCH_HEAD
+          git log -1 --oneline
+
+      - name: Anchor aliases schema
+        run: |
+          set -euo pipefail
+          node scripts/check-anchor-aliases.mjs
+
+      - name: NPM harden
+        run: |
+          set -euo pipefail
+          npm config set fetch-retries 5
+          npm config set fetch-retry-mintimeout 20000
+          npm config set fetch-retry-maxtimeout 120000
+          npm config set registry https://registry.npmjs.org
+          npm config get registry
+
+      - name: Install deps
+        run: |
+          set -euo pipefail
+          npm ci
+
+      - name: Inline scripts syntax check
+        run: |
+          set -euo pipefail
+          node scripts/check-inline-js.mjs
+
+      - name: Build (includes postbuild injection + pagefind)
+        run: |
+          set -euo pipefail
+          npm run build
+
+      - name: Anchors contract
+        run: |
+          set -euo pipefail
+          npm run test:anchors
+
+      - name: Verify anchor aliases injected in dist
+        run: |
+          set -euo pipefail
+          node scripts/verify-anchor-aliases-in-dist.mjs
--- a/.gitea/workflows/deploy-staging-live.yml
+++ b/.gitea/workflows/deploy-staging-live.yml
@@ -1,502 +0,0 @@
-name: Deploy staging+live (annotations)
-
-on:
-  push:
-    branches: [main]
-  workflow_dispatch:
-    inputs:
-      force:
-        description: "Force deploy even if gate would skip (1=yes, 0=no)"
-        required: false
-        default: "0"
-
-env:
-  NODE_OPTIONS: --dns-result-order=ipv4first
-  DOCKER_API_VERSION: "1.43"
-  COMPOSE_VERSION: "2.29.7"
-
-defaults:
-  run:
-    shell: bash
-
-concurrency:
-  group: deploy-staging-live-main
-  cancel-in-progress: false
-
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    container:
-      image: mcr.microsoft.com/devcontainers/javascript-node:22-bookworm
-
-    steps:
-      - name: Tools sanity
-        run: |
-          set -euo pipefail
-          git --version
-          node --version
-          npm --version
-
-      - name: Checkout (push or workflow_dispatch, no external actions)
-        env:
-          EVENT_JSON: /var/run/act/workflow/event.json
-        run: |
-          set -euo pipefail
-          test -f "$EVENT_JSON" || { echo "❌ Missing $EVENT_JSON"; exit 1; }
-
-          node --input-type=module <<'NODE'
-          import fs from "node:fs";
-          const ev = JSON.parse(fs.readFileSync(process.env.EVENT_JSON, "utf8"));
-          const repoObj = ev?.repository || {};
-          const cloneUrl =
-            repoObj?.clone_url ||
-            (repoObj?.html_url ? (repoObj.html_url.replace(/\/$/,"") + ".git") : "");
-          if (!cloneUrl) throw new Error("No repository clone_url/html_url in event.json");
-
-          const defaultBranch = repoObj?.default_branch || "main";
-          const sha =
-            (process.env.GITHUB_SHA && String(process.env.GITHUB_SHA).trim()) ||
-            ev?.after ||
-            ev?.sha ||
-            ev?.head_commit?.id ||
-            ev?.pull_request?.head?.sha ||
-            "";
-
-          const shq = (s) => "'" + String(s).replace(/'/g, "'\\''") + "'";
-          fs.writeFileSync("/tmp/deploy.env", [
-            `REPO_URL=${shq(cloneUrl)}`,
-            `DEFAULT_BRANCH=${shq(defaultBranch)}`,
-            `SHA=${shq(sha)}`
-          ].join("\n") + "\n");
-          NODE
-
-          source /tmp/deploy.env
-          echo "Repo URL:       $REPO_URL"
-          echo "Default branch: $DEFAULT_BRANCH"
-          echo "SHA:            ${SHA:-<empty>}"
-
-          rm -rf .git
-          git init -q
-          git remote add origin "$REPO_URL"
-
-          if [[ -n "${SHA:-}" ]]; then
-            git fetch --depth 1 origin "$SHA"
-            git -c advice.detachedHead=false checkout -q FETCH_HEAD
-          else
-            git fetch --depth 1 origin "$DEFAULT_BRANCH"
-            git -c advice.detachedHead=false checkout -q "origin/$DEFAULT_BRANCH"
-            SHA="$(git rev-parse HEAD)"
-            echo "SHA='$SHA'" >> /tmp/deploy.env
-            echo "Resolved SHA: $SHA"
-          fi
-
-          git log -1 --oneline
-
-      - name: Gate — auto deploy only on annotations/media changes
-        env:
-          INPUT_FORCE: ${{ inputs.force }}
-        run: |
-          set -euo pipefail
-          source /tmp/deploy.env
-
-          FORCE="${INPUT_FORCE:-0}"
-          if [[ "$FORCE" == "1" ]]; then
-            echo "✅ force=1 -> bypass gate -> deploy allowed"
-            echo "GO=1" >> /tmp/deploy.env
-            exit 0
-          fi
-
-          # merge commit safe: -m => considère les parents (liste de fichiers plus fiable)
-          CHANGED="$(git show -m --name-only --pretty="" "$SHA" | sed '/^$/d' || true)"
-          echo "== changed files =="
-          echo "$CHANGED" | sed -n '1,240p'
-
-          if echo "$CHANGED" | grep -qE '^(src/annotations/|public/media/)'; then
-            echo "GO=1" >> /tmp/deploy.env
-            echo "✅ deploy allowed (annotations/media change detected)"
-          else
-            echo "GO=0" >> /tmp/deploy.env
-            echo "ℹ️ no annotations/media change -> skip deploy"
-          fi
-
-      - name: Install docker client + docker compose plugin (v2) + python yaml
-        run: |
-          set -euo pipefail
-          source /tmp/deploy.env
-          [[ "${GO:-0}" == "1" ]] || { echo "ℹ️ skipped"; exit 0; }
-
-          apt-get -o Acquire::Retries=5 -o Acquire::ForceIPv4=true update
-          apt-get install -y --no-install-recommends ca-certificates curl docker.io python3 python3-yaml
-          rm -rf /var/lib/apt/lists/*
-
-          mkdir -p /usr/local/lib/docker/cli-plugins
-          curl -fsSL \
-            "https://github.com/docker/compose/releases/download/v${COMPOSE_VERSION}/docker-compose-linux-x86_64" \
-            -o /usr/local/lib/docker/cli-plugins/docker-compose
-          chmod +x /usr/local/lib/docker/cli-plugins/docker-compose
-
-          docker version
-          docker compose version
-          python3 --version
-
-          # 🔥 KEY FIX: reuse existing compose project name if containers already exist
-          PROJ="$(docker inspect archicratie-web-blue --format '{{ index .Config.Labels "com.docker.compose.project" }}' 2>/dev/null || true)"
-          if [[ -z "${PROJ:-}" ]]; then
-            PROJ="$(docker inspect archicratie-web-green --format '{{ index .Config.Labels "com.docker.compose.project" }}' 2>/dev/null || true)"
-          fi
-          if [[ -z "${PROJ:-}" ]]; then PROJ="archicratie-web"; fi
-          echo "COMPOSE_PROJECT_NAME='$PROJ'" >> /tmp/deploy.env
-          echo "✅ Using COMPOSE_PROJECT_NAME=$PROJ"
-
-      - name: Assert required vars (PUBLIC_GITEA_*)
-        env:
-          PUBLIC_GITEA_BASE: ${{ vars.PUBLIC_GITEA_BASE }}
-          PUBLIC_GITEA_OWNER: ${{ vars.PUBLIC_GITEA_OWNER }}
-          PUBLIC_GITEA_REPO: ${{ vars.PUBLIC_GITEA_REPO }}
-        run: |
-          set -euo pipefail
-          source /tmp/deploy.env
-          [[ "${GO:-0}" == "1" ]] || { echo "ℹ️ skipped"; exit 0; }
-
-          test -n "${PUBLIC_GITEA_BASE:-}"  || { echo "❌ missing repo var PUBLIC_GITEA_BASE"; exit 2; }
-          test -n "${PUBLIC_GITEA_OWNER:-}" || { echo "❌ missing repo var PUBLIC_GITEA_OWNER"; exit 2; }
-          test -n "${PUBLIC_GITEA_REPO:-}"  || { echo "❌ missing repo var PUBLIC_GITEA_REPO"; exit 2; }
-          echo "✅ vars OK"
-
-      - name: Assert deploy files exist
-        run: |
-          set -euo pipefail
-          source /tmp/deploy.env
-          [[ "${GO:-0}" == "1" ]] || { echo "ℹ️ skipped"; exit 0; }
-
-          test -f docker-compose.yml
-          test -f Dockerfile
-          test -f nginx.conf
-          echo "✅ deploy files OK"
-
-      - name: Build + deploy staging (blue) then smoke
-        env:
-          PUBLIC_GITEA_BASE: ${{ vars.PUBLIC_GITEA_BASE }}
-          PUBLIC_GITEA_OWNER: ${{ vars.PUBLIC_GITEA_OWNER }}
-          PUBLIC_GITEA_REPO: ${{ vars.PUBLIC_GITEA_REPO }}
-        run: |
-          set -euo pipefail
-          source /tmp/deploy.env
-          [[ "${GO:-0}" == "1" ]] || { echo "ℹ️ skipped"; exit 0; }
-          PROJ="${COMPOSE_PROJECT_NAME:-archicratie-web}"
-
-          retry_url() {
-            local url="$1"; local tries="${2:-45}"; local delay="${3:-1}"
-            local i=1
-            while (( i <= tries )); do
-              if curl -fsS --max-time 5 --retry 2 --retry-delay 0 --retry-all-errors "$url" >/dev/null 2>&1; then
-                return 0
-              fi
-              echo "… wait [$i/$tries] $url"
-              sleep "$delay"
-              ((i++))
-            done
-            return 1
-          }
-
-          fetch_html() {
-            local url="$1"; local tries="${2:-45}"; local delay="${3:-1}"
-            local i=1
-            while (( i <= tries )); do
-              local html
-              html="$(curl -fsS --max-time 8 --retry 2 --retry-delay 0 --retry-all-errors "$url" 2>/dev/null || true)"
-              if [[ -n "$html" ]]; then
-                printf "%s" "$html"
-                return 0
-              fi
-              echo "… wait HTML [$i/$tries] $url"
-              sleep "$delay"
-              ((i++))
-            done
-            return 1
-          }
-
-          dump_container() {
-            local name="$1"
-            echo "== docker ps (filter=$name) =="
-            docker ps -a --filter "name=$name" --format 'table {{.Names}}\t{{.Status}}\t{{.Image}}' || true
-            echo "== docker logs (tail) $name =="
-            docker logs --tail 200 "$name" 2>/dev/null || true
-          }
-
-          TS="$(date -u +%Y%m%d-%H%M%S)"
-          echo "TS='$TS'" >> /tmp/deploy.env
-          docker image tag archicratie-web:blue  "archicratie-web:blue.BAK.${TS}"  || true
-          docker image tag archicratie-web:green "archicratie-web:green.BAK.${TS}" || true
-
-          docker compose -p "$PROJ" -f docker-compose.yml config >/dev/null
-
-          docker compose -p "$PROJ" -f docker-compose.yml build web_blue
-
-          docker rm -f archicratie-web-blue || true
-          docker compose -p "$PROJ" -f docker-compose.yml up -d --force-recreate --remove-orphans web_blue
-
-          retry_url "http://127.0.0.1:8081/para-index.json"        60 1 || { dump_container archicratie-web-blue; exit 31; }
-          retry_url "http://127.0.0.1:8081/annotations-index.json" 60 1 || { dump_container archicratie-web-blue; exit 32; }
-          retry_url "http://127.0.0.1:8081/pagefind/pagefind.js"    60 1 || { dump_container archicratie-web-blue; exit 33; }
-
-          HTML="$(fetch_html "http://127.0.0.1:8081/archicrat-ia/chapitre-1/" 60 1 || true)"
-          CANON="$(echo "$HTML" | grep -oE 'rel="canonical" href="[^"]+"' | head -n1 || true)"
-          echo "canonical(blue)=$CANON"
-          echo "$CANON" | grep -q 'https://staging\.archicratie\.trans-hands\.synology\.me/' || {
-            dump_container archicratie-web-blue
-            echo "❌ staging canonical mismatch"
-            exit 34
-          }
-
-          echo "✅ staging OK"
-
-      - name: Build + deploy live (green) then smoke + rollback if needed
-        env:
-          PUBLIC_GITEA_BASE: ${{ vars.PUBLIC_GITEA_BASE }}
-          PUBLIC_GITEA_OWNER: ${{ vars.PUBLIC_GITEA_OWNER }}
-          PUBLIC_GITEA_REPO: ${{ vars.PUBLIC_GITEA_REPO }}
-        run: |
-          set -euo pipefail
-          source /tmp/deploy.env
-          [[ "${GO:-0}" == "1" ]] || { echo "ℹ️ skipped"; exit 0; }
-          PROJ="${COMPOSE_PROJECT_NAME:-archicratie-web}"
-          TS="${TS:-$(date -u +%Y%m%d-%H%M%S)}"
-
-          retry_url() {
-            local url="$1"; local tries="${2:-45}"; local delay="${3:-1}"
-            local i=1
-            while (( i <= tries )); do
-              if curl -fsS --max-time 5 --retry 2 --retry-delay 0 --retry-all-errors "$url" >/dev/null 2>&1; then
-                return 0
-              fi
-              echo "… wait [$i/$tries] $url"
-              sleep "$delay"
-              ((i++))
-            done
-            return 1
-          }
-
-          fetch_html() {
-            local url="$1"; local tries="${2:-45}"; local delay="${3:-1}"
-            local i=1
-            while (( i <= tries )); do
-              local html
-              html="$(curl -fsS --max-time 8 --retry 2 --retry-delay 0 --retry-all-errors "$url" 2>/dev/null || true)"
-              if [[ -n "$html" ]]; then
-                printf "%s" "$html"
-                return 0
-              fi
-              echo "… wait HTML [$i/$tries] $url"
-              sleep "$delay"
-              ((i++))
-            done
-            return 1
-          }
-
-          dump_container() {
-            local name="$1"
-            echo "== docker ps (filter=$name) =="
-            docker ps -a --filter "name=$name" --format 'table {{.Names}}\t{{.Status}}\t{{.Image}}' || true
-            echo "== docker logs (tail) $name =="
-            docker logs --tail 200 "$name" 2>/dev/null || true
-          }
-
-          rollback() {
-            echo "⚠️ rollback green -> previous image tag (best effort)"
-            docker image tag "archicratie-web:green.BAK.${TS}" archicratie-web:green || true
-            docker rm -f archicratie-web-green || true
-            docker compose -p "$PROJ" -f docker-compose.yml up -d --force-recreate --remove-orphans web_green || true
-          }
-
-          docker compose -p "$PROJ" -f docker-compose.yml config >/dev/null
-
-          if ! docker compose -p "$PROJ" -f docker-compose.yml build web_green; then
-            dump_container archicratie-web-green
-            rollback
-            exit 40
-          fi
-
-          docker rm -f archicratie-web-green || true
-          if ! docker compose -p "$PROJ" -f docker-compose.yml up -d --force-recreate --remove-orphans web_green; then
-            dump_container archicratie-web-green
-            rollback
-            exit 41
-          fi
-
-          retry_url "http://127.0.0.1:8082/para-index.json"        90 1 || { dump_container archicratie-web-green; rollback; exit 42; }
-          retry_url "http://127.0.0.1:8082/annotations-index.json" 90 1 || { dump_container archicratie-web-green; rollback; exit 43; }
-          retry_url "http://127.0.0.1:8082/pagefind/pagefind.js"    90 1 || { dump_container archicratie-web-green; rollback; exit 44; }
-
-          HTML="$(fetch_html "http://127.0.0.1:8082/archicrat-ia/chapitre-1/" 90 1 || true)"
-          CANON="$(echo "$HTML" | grep -oE 'rel="canonical" href="[^"]+"' | head -n1 || true)"
-          echo "canonical(green)=$CANON"
-          echo "$CANON" | grep -q 'https://archicratie\.trans-hands\.synology\.me/' || {
-            dump_container archicratie-web-green
-            echo "❌ live canonical mismatch"
-            rollback
-            exit 45
-          }
-
-          echo "✅ live OK"
-
-      - name: Hotpatch annotations-index.json (deep merge shards) into blue+green
-        run: |
-          set -euo pipefail
-          source /tmp/deploy.env
-          [[ "${GO:-0}" == "1" ]] || { echo "ℹ️ skipped"; exit 0; }
-
-          python3 - <<'PY'
-          import os, re, json, glob, datetime
-          import yaml
-
-          ROOT = os.getcwd()
-          ANNO_ROOT = os.path.join(ROOT, "src", "annotations")
-
-          def is_obj(x): return isinstance(x, dict)
-          def is_arr(x): return isinstance(x, list)
-
-          def key_media(it):
-            return str((it or {}).get("src",""))
-
-          def key_ref(it):
-            it = it or {}
-            return "||".join([
-              str(it.get("url","")),
-              str(it.get("label","")),
-              str(it.get("kind","")),
-              str(it.get("citation","")),
-            ])
-
-          def key_comment(it):
-            return str((it or {}).get("text","")).strip()
-
-          def dedup_extend(dst_list, src_list, key_fn):
-            seen = set()
-            out = []
-            for x in (dst_list or []):
-              k = key_fn(x)
-              if k and k not in seen:
-                seen.add(k); out.append(x)
-            for x in (src_list or []):
-              k = key_fn(x)
-              if k and k not in seen:
-                seen.add(k); out.append(x)
-            return out
-
-          def deep_merge(dst, src):
-            for k, v in (src or {}).items():
-              if k in ("media", "refs", "comments_editorial") and is_arr(v):
-                if k == "media":
-                  dst[k] = dedup_extend(dst.get(k, []), v, key_media)
-                elif k == "refs":
-                  dst[k] = dedup_extend(dst.get(k, []), v, key_ref)
-                else:
-                  dst[k] = dedup_extend(dst.get(k, []), v, key_comment)
-                continue
-
-              if is_obj(v):
-                if not is_obj(dst.get(k)):
-                  dst[k] = dst.get(k) if is_obj(dst.get(k)) else {}
-                deep_merge(dst[k], v)
-                continue
-
-              if is_arr(v):
-                cur = dst.get(k, [])
-                if not is_arr(cur): cur = []
-                seen = set()
-                out = []
-                for x in cur:
-                  s = json.dumps(x, sort_keys=True, ensure_ascii=False)
-                  if s not in seen:
-                    seen.add(s); out.append(x)
-                for x in v:
-                  s = json.dumps(x, sort_keys=True, ensure_ascii=False)
-                  if s not in seen:
-                    seen.add(s); out.append(x)
-                dst[k] = out
-                continue
-
-              if k not in dst or dst.get(k) in (None, ""):
-                dst[k] = v
-
-          def para_num(pid):
-            m = re.match(r"^p-(\d+)-", str(pid))
-            return int(m.group(1)) if m else 10**9
-
-          def sort_lists(entry):
-            for k in ("media","refs","comments_editorial"):
-              arr = entry.get(k)
-              if not is_arr(arr): continue
-              def ts(x):
-                try:
-                  return datetime.datetime.fromisoformat(str((x or {}).get("ts","")).replace("Z","+00:00")).timestamp()
-                except Exception:
-                  return 0
-              arr.sort(key=lambda x: (ts(x), json.dumps(x, sort_keys=True, ensure_ascii=False)))
-              entry[k] = arr
-
-          pages = {}
-          errors = []
-
-          if not os.path.isdir(ANNO_ROOT):
-            raise SystemExit(f"Missing annotations root: {ANNO_ROOT}")
-
-          files = sorted(glob.glob(os.path.join(ANNO_ROOT, "**", "*.yml"), recursive=True))
-          for fp in files:
-            try:
-              with open(fp, "r", encoding="utf-8") as f:
-                doc = yaml.safe_load(f) or {}
-              if not isinstance(doc, dict) or doc.get("schema") != 1:
-                continue
-              page = str(doc.get("page","")).strip().strip("/")
-              paras = doc.get("paras") or {}
-              if not page or not isinstance(paras, dict):
-                continue
-
-              pg = pages.setdefault(page, {"paras": {}})
-              for pid, entry in paras.items():
-                pid = str(pid)
-                if pid not in pg["paras"] or not isinstance(pg["paras"].get(pid), dict):
-                  pg["paras"][pid] = {}
-                if isinstance(entry, dict):
-                  deep_merge(pg["paras"][pid], entry)
-                sort_lists(pg["paras"][pid])
-
-            except Exception as e:
-              errors.append({"file": os.path.relpath(fp, ROOT), "error": str(e)})
-
-          for page, obj in pages.items():
-            keys = list((obj.get("paras") or {}).keys())
-            keys.sort(key=lambda k: (para_num(k), k))
-            obj["paras"] = {k: obj["paras"][k] for k in keys}
-
-          out = {
-            "schema": 1,
-            "generatedAt": datetime.datetime.utcnow().replace(tzinfo=datetime.timezone.utc).isoformat().replace("+00:00","Z"),
-            "pages": pages,
-            "stats": {
-              "pages": len(pages),
-              "paras": sum(len(v.get("paras") or {}) for v in pages.values()),
-              "errors": len(errors),
-            },
-            "errors": errors,
-          }
-
-          with open("/tmp/annotations-index.json", "w", encoding="utf-8") as f:
-            json.dump(out, f, ensure_ascii=False)
-
-          print("OK: wrote /tmp/annotations-index.json pages=", out["stats"]["pages"], "paras=", out["stats"]["paras"], "errors=", out["stats"]["errors"])
-          PY
-
-          for c in archicratie-web-blue archicratie-web-green; do
-            echo "== patch $c =="
-            docker cp /tmp/annotations-index.json "${c}:/usr/share/nginx/html/annotations-index.json"
-          done
-
-          for p in 8081 8082; do
-            echo "== smoke annotations-index on $p =="
-            curl -fsS "http://127.0.0.1:${p}/annotations-index.json" | python3 -c 'import sys,json; j=json.load(sys.stdin); print("generatedAt:", j.get("generatedAt")); print("pages:", len(j.get("pages") or {}))'
-          done
-
-          echo "✅ hotpatch annotations-index done"
--- a/.gitignore
+++ b/.gitignore
@@ -3,10 +3,6 @@
 .env.*
 !.env.example

-# dev-only
-public/_auth/whoami
-public/_auth/whoami/*
-
 # --- local backups ---
 *.bak
 *.bak.*
--- a/docs/diagrams/START-HERE.md
+++ b/docs/diagrams/START-HERE.md
--- a/ops/diag/archicratie-diag.sh
+++ b/ops/diag/archicratie-diag.sh
@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+CTX="${1:-/volume2/docker/archicratie-web/current}"
+EDGE_PORT="${EDGE_PORT:-18080}"
+STAGING_HOST="${STAGING_HOST:-staging.archicratie.trans-hands.synology.me}"
+LIVE_HOST="${LIVE_HOST:-archicratie.trans-hands.synology.me}"
+
+BLUE_CNAME="${BLUE_CNAME:-archicratie-web-blue}"
+GREEN_CNAME="${GREEN_CNAME:-archicratie-web-green}"
+
+BLUE_UPSTREAM="${BLUE_UPSTREAM:-8081}"
+GREEN_UPSTREAM="${GREEN_UPSTREAM:-8082}"
+
+echo "== Archicratie diagnostic =="
+echo "CTX=$CTX"
+echo "EDGE_PORT=$EDGE_PORT"
+echo "STAGING_HOST=$STAGING_HOST"
+echo "LIVE_HOST=$LIVE_HOST"
+echo "BLUE_CNAME=$BLUE_CNAME  BLUE_UPSTREAM=$BLUE_UPSTREAM"
+echo "GREEN_CNAME=$GREEN_CNAME GREEN_UPSTREAM=$GREEN_UPSTREAM"
+echo
+
+echo "== 1) Containers status (docker ps) =="
+sudo docker ps --filter name=archicratie-web --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}"
+echo
+
+echo "== 2) Port bindings (source de vérité: docker port) =="
+echo "-- $BLUE_CNAME --"
+sudo docker port "$BLUE_CNAME" 80 || true
+echo "-- $GREEN_CNAME --"
+sudo docker port "$GREEN_CNAME" 80 || true
+echo
+
+echo "== 3) Canonical upstream direct (8081/8082) =="
+for p in "$BLUE_UPSTREAM" "$GREEN_UPSTREAM"; do
+  echo "-- 127.0.0.1:$p --"
+  curl -fsS "http://127.0.0.1:$p/" \
+    | grep -oE 'rel="canonical" href="[^"]+"' \
+    | head -n 1 || echo "WARN: canonical not found"
+done
+echo
+
+echo "== 4) Edge routing proof (HEAD via Host header) =="
+echo "-- staging via edge --"
+curl -sSI -H "Host: $STAGING_HOST" "http://127.0.0.1:$EDGE_PORT/" \
+  | grep -iE 'HTTP/|location:|x-archi-router|x-archi-route' \
+  | head -n 30 || true
+echo
+
+echo "-- live via edge --"
+curl -sSI -H "Host: $LIVE_HOST" "http://127.0.0.1:$EDGE_PORT/" \
+  | grep -iE 'HTTP/|location:|x-archi-router|x-archi-route' \
+  | head -n 30 || true
+echo
+
+echo "== 5) Traefik errors last 5m (hard fail only) =="
+if sudo docker logs edge-traefik --since 5m | grep -Ei 'level=error|middleware .* does not exist|yaml' >/dev/null; then
+  echo "❌ FOUND traefik errors:"
+  sudo docker logs edge-traefik --since 5m | grep -Ei 'level=error|middleware .* does not exist|yaml' | tail -n 200
+  exit 2
+else
+  echo "✅ OK: pas d'erreur critique traefik (5m)"
+fi
+echo
+
+echo "== 6) Quick expectations (soft checks) =="
+BLUE_BIND="$(sudo docker port "$BLUE_CNAME" 80 2>/dev/null || true)"
+GREEN_BIND="$(sudo docker port "$GREEN_CNAME" 80 2>/dev/null || true)"
+
+if echo "$BLUE_BIND" | grep -q "127.0.0.1:$BLUE_UPSTREAM"; then
+  echo "✅ BLUE binding OK: $BLUE_BIND"
+else
+  echo "⚠️  BLUE binding unexpected: $BLUE_BIND"
+fi
+
+if echo "$GREEN_BIND" | grep -q "127.0.0.1:$GREEN_UPSTREAM"; then
+  echo "✅ GREEN binding OK: $GREEN_BIND"
+else
+  echo "⚠️  GREEN binding unexpected: $GREEN_BIND"
+fi
+
+echo
+echo "✅ Diagnostic complete."
--- a/package-lock.json
+++ b/package-lock.json
@@ -9,7 +9,7 @@
      "version": "0.0.1",
      "dependencies": {
        "@astrojs/mdx": "^4.3.13",
-        "astro": "^5.17.3"
+        "astro": "^5.16.11"
      },
      "devDependencies": {
        "@astrojs/sitemap": "^3.7.0",
@@ -1905,9 +1905,9 @@
      }
    },
    "node_modules/astro": {
-      "version": "5.17.3",
-      "resolved": "https://registry.npmjs.org/astro/-/astro-5.17.3.tgz",
-      "integrity": "sha512-69dcfPe8LsHzklwj+hl+vunWUbpMB6pmg35mACjetxbJeUNNys90JaBM8ZiwsPK689SAj/4Zqb1ayaANls9/MA==",
+      "version": "5.16.11",
+      "resolved": "https://registry.npmjs.org/astro/-/astro-5.16.11.tgz",
+      "integrity": "sha512-Z7kvkTTT5n6Hn5lCm6T3WU6pkxx84Hn25dtQ6dR7ATrBGq9eVa8EuB/h1S8xvaoVyCMZnIESu99Z9RJfdLRLDA==",
      "license": "MIT",
      "dependencies": {
        "@astrojs/compiler": "^2.13.0",
@@ -1933,7 +1933,7 @@
        "dlv": "^1.1.3",
        "dset": "^3.1.4",
        "es-module-lexer": "^1.7.0",
-        "esbuild": "^0.27.3",
+        "esbuild": "^0.25.0",
        "estree-walker": "^3.0.3",
        "flattie": "^1.1.1",
        "fontace": "~0.4.0",
@@ -1954,16 +1954,16 @@
        "prompts": "^2.4.2",
        "rehype": "^13.0.2",
        "semver": "^7.7.3",
-        "shiki": "^3.21.0",
+        "shiki": "^3.20.0",
        "smol-toml": "^1.6.0",
        "svgo": "^4.0.0",
        "tinyexec": "^1.0.2",
        "tinyglobby": "^0.2.15",
        "tsconfck": "^3.1.6",
        "ultrahtml": "^1.6.0",
-        "unifont": "~0.7.3",
+        "unifont": "~0.7.1",
        "unist-util-visit": "^5.0.0",
-        "unstorage": "^1.17.4",
+        "unstorage": "^1.17.3",
        "vfile": "^6.0.3",
        "vite": "^6.4.1",
        "vitefu": "^1.1.1",
@@ -1990,463 +1990,6 @@
        "sharp": "^0.34.0"
      }
    },
-    "node_modules/astro/node_modules/@esbuild/aix-ppc64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.27.3.tgz",
-      "integrity": "sha512-9fJMTNFTWZMh5qwrBItuziu834eOCUcEqymSH7pY+zoMVEZg3gcPuBNxH1EvfVYe9h0x/Ptw8KBzv7qxb7l8dg==",
-      "cpu": [
-        "ppc64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "aix"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/android-arm": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.27.3.tgz",
-      "integrity": "sha512-i5D1hPY7GIQmXlXhs2w8AWHhenb00+GxjxRncS2ZM7YNVGNfaMxgzSGuO8o8SJzRc/oZwU2bcScvVERk03QhzA==",
-      "cpu": [
-        "arm"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/android-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.27.3.tgz",
-      "integrity": "sha512-YdghPYUmj/FX2SYKJ0OZxf+iaKgMsKHVPF1MAq/P8WirnSpCStzKJFjOjzsW0QQ7oIAiccHdcqjbHmJxRb/dmg==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/android-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.27.3.tgz",
-      "integrity": "sha512-IN/0BNTkHtk8lkOM8JWAYFg4ORxBkZQf9zXiEOfERX/CzxW3Vg1ewAhU7QSWQpVIzTW+b8Xy+lGzdYXV6UZObQ==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/darwin-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.27.3.tgz",
-      "integrity": "sha512-Re491k7ByTVRy0t3EKWajdLIr0gz2kKKfzafkth4Q8A5n1xTHrkqZgLLjFEHVD+AXdUGgQMq+Godfq45mGpCKg==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/darwin-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.27.3.tgz",
-      "integrity": "sha512-vHk/hA7/1AckjGzRqi6wbo+jaShzRowYip6rt6q7VYEDX4LEy1pZfDpdxCBnGtl+A5zq8iXDcyuxwtv3hNtHFg==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/freebsd-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.27.3.tgz",
-      "integrity": "sha512-ipTYM2fjt3kQAYOvo6vcxJx3nBYAzPjgTCk7QEgZG8AUO3ydUhvelmhrbOheMnGOlaSFUoHXB6un+A7q4ygY9w==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/freebsd-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.27.3.tgz",
-      "integrity": "sha512-dDk0X87T7mI6U3K9VjWtHOXqwAMJBNN2r7bejDsc+j03SEjtD9HrOl8gVFByeM0aJksoUuUVU9TBaZa2rgj0oA==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/linux-arm": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.27.3.tgz",
-      "integrity": "sha512-s6nPv2QkSupJwLYyfS+gwdirm0ukyTFNl3KTgZEAiJDd+iHZcbTPPcWCcRYH+WlNbwChgH2QkE9NSlNrMT8Gfw==",
-      "cpu": [
-        "arm"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/linux-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.27.3.tgz",
-      "integrity": "sha512-sZOuFz/xWnZ4KH3YfFrKCf1WyPZHakVzTiqji3WDc0BCl2kBwiJLCXpzLzUBLgmp4veFZdvN5ChW4Eq/8Fc2Fg==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/linux-ia32": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.27.3.tgz",
-      "integrity": "sha512-yGlQYjdxtLdh0a3jHjuwOrxQjOZYD/C9PfdbgJJF3TIZWnm/tMd/RcNiLngiu4iwcBAOezdnSLAwQDPqTmtTYg==",
-      "cpu": [
-        "ia32"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/linux-loong64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.27.3.tgz",
-      "integrity": "sha512-WO60Sn8ly3gtzhyjATDgieJNet/KqsDlX5nRC5Y3oTFcS1l0KWba+SEa9Ja1GfDqSF1z6hif/SkpQJbL63cgOA==",
-      "cpu": [
-        "loong64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/linux-mips64el": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.27.3.tgz",
-      "integrity": "sha512-APsymYA6sGcZ4pD6k+UxbDjOFSvPWyZhjaiPyl/f79xKxwTnrn5QUnXR5prvetuaSMsb4jgeHewIDCIWljrSxw==",
-      "cpu": [
-        "mips64el"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/linux-ppc64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.27.3.tgz",
-      "integrity": "sha512-eizBnTeBefojtDb9nSh4vvVQ3V9Qf9Df01PfawPcRzJH4gFSgrObw+LveUyDoKU3kxi5+9RJTCWlj4FjYXVPEA==",
-      "cpu": [
-        "ppc64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/linux-riscv64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.27.3.tgz",
-      "integrity": "sha512-3Emwh0r5wmfm3ssTWRQSyVhbOHvqegUDRd0WhmXKX2mkHJe1SFCMJhagUleMq+Uci34wLSipf8Lagt4LlpRFWQ==",
-      "cpu": [
-        "riscv64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/linux-s390x": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.27.3.tgz",
-      "integrity": "sha512-pBHUx9LzXWBc7MFIEEL0yD/ZVtNgLytvx60gES28GcWMqil8ElCYR4kvbV2BDqsHOvVDRrOxGySBM9Fcv744hw==",
-      "cpu": [
-        "s390x"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/linux-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.27.3.tgz",
-      "integrity": "sha512-Czi8yzXUWIQYAtL/2y6vogER8pvcsOsk5cpwL4Gk5nJqH5UZiVByIY8Eorm5R13gq+DQKYg0+JyQoytLQas4dA==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/netbsd-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.27.3.tgz",
-      "integrity": "sha512-sDpk0RgmTCR/5HguIZa9n9u+HVKf40fbEUt+iTzSnCaGvY9kFP0YKBWZtJaraonFnqef5SlJ8/TiPAxzyS+UoA==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "netbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/netbsd-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.27.3.tgz",
-      "integrity": "sha512-P14lFKJl/DdaE00LItAukUdZO5iqNH7+PjoBm+fLQjtxfcfFE20Xf5CrLsmZdq5LFFZzb5JMZ9grUwvtVYzjiA==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "netbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/openbsd-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.27.3.tgz",
-      "integrity": "sha512-AIcMP77AvirGbRl/UZFTq5hjXK+2wC7qFRGoHSDrZ5v5b8DK/GYpXW3CPRL53NkvDqb9D+alBiC/dV0Fb7eJcw==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/openbsd-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.27.3.tgz",
-      "integrity": "sha512-DnW2sRrBzA+YnE70LKqnM3P+z8vehfJWHXECbwBmH/CU51z6FiqTQTHFenPlHmo3a8UgpLyH3PT+87OViOh1AQ==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/openharmony-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.27.3.tgz",
-      "integrity": "sha512-NinAEgr/etERPTsZJ7aEZQvvg/A6IsZG/LgZy+81wON2huV7SrK3e63dU0XhyZP4RKGyTm7aOgmQk0bGp0fy2g==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openharmony"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/sunos-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.27.3.tgz",
-      "integrity": "sha512-PanZ+nEz+eWoBJ8/f8HKxTTD172SKwdXebZ0ndd953gt1HRBbhMsaNqjTyYLGLPdoWHy4zLU7bDVJztF5f3BHA==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "sunos"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/win32-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.27.3.tgz",
-      "integrity": "sha512-B2t59lWWYrbRDw/tjiWOuzSsFh1Y/E95ofKz7rIVYSQkUYBjfSgf6oeYPNWHToFRr2zx52JKApIcAS/D5TUBnA==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/win32-ia32": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.27.3.tgz",
-      "integrity": "sha512-QLKSFeXNS8+tHW7tZpMtjlNb7HKau0QDpwm49u0vUp9y1WOF+PEzkU84y9GqYaAVW8aH8f3GcBck26jh54cX4Q==",
-      "cpu": [
-        "ia32"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/win32-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.27.3.tgz",
-      "integrity": "sha512-4uJGhsxuptu3OcpVAzli+/gWusVGwZZHTlS63hh++ehExkVT8SgiEf7/uC/PclrPPkLhZqGgCTjd0VWLo6xMqA==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/esbuild": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.27.3.tgz",
-      "integrity": "sha512-8VwMnyGCONIs6cWue2IdpHxHnAjzxnw2Zr7MkVxB2vjmQ2ivqGFb4LEG3SMnv0Gb2F/G/2yA8zUaiL1gywDCCg==",
-      "hasInstallScript": true,
-      "license": "MIT",
-      "bin": {
-        "esbuild": "bin/esbuild"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "optionalDependencies": {
-        "@esbuild/aix-ppc64": "0.27.3",
-        "@esbuild/android-arm": "0.27.3",
-        "@esbuild/android-arm64": "0.27.3",
-        "@esbuild/android-x64": "0.27.3",
-        "@esbuild/darwin-arm64": "0.27.3",
-        "@esbuild/darwin-x64": "0.27.3",
-        "@esbuild/freebsd-arm64": "0.27.3",
-        "@esbuild/freebsd-x64": "0.27.3",
-        "@esbuild/linux-arm": "0.27.3",
-        "@esbuild/linux-arm64": "0.27.3",
-        "@esbuild/linux-ia32": "0.27.3",
-        "@esbuild/linux-loong64": "0.27.3",
-        "@esbuild/linux-mips64el": "0.27.3",
-        "@esbuild/linux-ppc64": "0.27.3",
-        "@esbuild/linux-riscv64": "0.27.3",
-        "@esbuild/linux-s390x": "0.27.3",
-        "@esbuild/linux-x64": "0.27.3",
-        "@esbuild/netbsd-arm64": "0.27.3",
-        "@esbuild/netbsd-x64": "0.27.3",
-        "@esbuild/openbsd-arm64": "0.27.3",
-        "@esbuild/openbsd-x64": "0.27.3",
-        "@esbuild/openharmony-arm64": "0.27.3",
-        "@esbuild/sunos-x64": "0.27.3",
-        "@esbuild/win32-arm64": "0.27.3",
-        "@esbuild/win32-ia32": "0.27.3",
-        "@esbuild/win32-x64": "0.27.3"
-      }
-    },
    "node_modules/axobject-query": {
      "version": "4.1.0",
      "resolved": "https://registry.npmjs.org/axobject-query/-/axobject-query-4.1.0.tgz",
--- a/package.json
+++ b/package.json
@@ -4,29 +4,32 @@
  "version": "0.0.1",
  "private": true,
  "scripts": {
-    "dev": "node scripts/write-dev-whoami.mjs && astro dev",
+    "dev": "astro dev",
    "preview": "astro preview",
    "astro": "astro",
+
    "clean": "rm -rf dist",
    "build": "astro build",
    "build:clean": "npm run clean && npm run build",
-    "postbuild": "node scripts/inject-anchor-aliases.mjs && node scripts/dedupe-ids-dist.mjs && node scripts/build-para-index.mjs && node scripts/build-annotations-index.mjs && node scripts/purge-dist-dev-whoami.mjs && npx pagefind --site dist",
+
+    "postbuild": "node scripts/inject-anchor-aliases.mjs && node scripts/dedupe-ids-dist.mjs && npx pagefind --site dist",
+
    "import": "node scripts/import-docx.mjs",
    "apply:ticket": "node scripts/apply-ticket.mjs",
+
    "audit:dist": "node scripts/audit-dist.mjs",
-    "build:para-index": "node scripts/build-para-index.mjs",
-    "build:annotations-index": "node scripts/build-annotations-index.mjs",
+
    "test:aliases": "node scripts/check-anchor-aliases.mjs",
    "test:anchors": "node scripts/check-anchors.mjs",
    "test:anchors:update": "node scripts/check-anchors.mjs --update",
-    "test:annotations": "node scripts/check-annotations.mjs",
-    "test:annotations:media": "node scripts/check-annotations-media.mjs",
-    "test": "npm run test:aliases && npm run build:clean && npm run audit:dist && node scripts/verify-anchor-aliases-in-dist.mjs && npm run test:anchors && npm run test:annotations && npm run test:annotations:media && node scripts/check-inline-js.mjs",
+
+    "test": "npm run test:aliases && npm run build:clean && npm run audit:dist && node scripts/verify-anchor-aliases-in-dist.mjs && npm run test:anchors && node scripts/check-inline-js.mjs",
+
    "ci": "CI=1 npm test"
  },
  "dependencies": {
    "@astrojs/mdx": "^4.3.13",
-    "astro": "^5.17.3"
+    "astro": "^5.16.11"
  },
  "devDependencies": {
    "@astrojs/sitemap": "^3.7.0",
--- a/public/media/archicrat-ia/chapitre-4/p-11-67c14c09/Capture_d_e_cran_2026-02-16_a_13.07.35.png
+++ b/public/media/archicrat-ia/chapitre-4/p-11-67c14c09/Capture_d_e_cran_2026-02-16_a_13.07.35.png
--- a/public/media/archicrat-ia/chapitre-4/p-2-31b12529/Capture_d_e_cran_2026-02-16_a_13.05.58.png
+++ b/public/media/archicrat-ia/chapitre-4/p-2-31b12529/Capture_d_e_cran_2026-02-16_a_13.05.58.png
--- a/public/media/archicrat-ia/chapitre-4/p-7-1da4a458/Capture_d_e_cran_2026-02-16_a_13.05.58.png
+++ b/public/media/archicrat-ia/chapitre-4/p-7-1da4a458/Capture_d_e_cran_2026-02-16_a_13.05.58.png
--- a/scripts/apply-annotation-ticket.mjs
+++ b/scripts/apply-annotation-ticket.mjs
@@ -1,838 +0,0 @@
-#!/usr/bin/env node
-// scripts/apply-annotation-ticket.mjs
-// Applique un ticket Gitea "type/media | type/reference | type/comment" vers:
-//
-//   ✅ src/annotations/<oeuvre>/<chapitre>/<paraId>.yml  (sharding par paragraphe)
-//   ✅ public/media/<oeuvre>/<chapitre>/<paraId>/<file>
-//
-// Robuste, idempotent, non destructif.
-//
-// DRY RUN si --dry-run
-// Options: --dry-run --no-download --verify --strict --commit --close
-//
-// Env requis:
-//   FORGE_API   = base API Gitea (LAN) ex: http://192.168.1.20:3000
-//   FORGE_TOKEN = PAT Gitea (repo + issues)
-//
-// Env optionnel:
-//   GITEA_OWNER / GITEA_REPO (sinon auto-détecté via git remote)
-//   ANNO_DIR    (défaut: src/annotations)
-//   PUBLIC_DIR  (défaut: public)
-//   MEDIA_ROOT  (défaut URL: /media)
-//
-// Ticket attendu (body):
-//   Chemin: /archicrat-ia/chapitre-4/
-//   Ancre: #p-0-xxxxxxxx
-//   Type: type/media | type/reference | type/comment
-//
-// Exit codes:
-//   0 ok
-//   1 erreur fatale
-//   2 refus (strict/verify/usage)
-
-import fs from "node:fs/promises";
-import path from "node:path";
-import process from "node:process";
-import { spawnSync } from "node:child_process";
-import YAML from "yaml";
-
-/* ---------------------------------- usage --------------------------------- */
-
-function usage(exitCode = 0) {
-  console.log(`
-apply-annotation-ticket — applique un ticket SidePanel (media/ref/comment) vers src/annotations/ (shard par paragraphe)
-
-Usage:
-  node scripts/apply-annotation-ticket.mjs <issue_number> [--dry-run] [--no-download] [--verify] [--strict] [--commit] [--close]
-
-Flags:
-  --dry-run      : n'écrit rien (affiche un aperçu)
-  --no-download  : n'essaie pas de télécharger les pièces jointes (media)
-  --verify       : vérifie que (page, ancre) existent (dist/para-index.json si dispo, sinon baseline)
-  --strict       : refuse si URL ref invalide (http/https) OU caption media vide
-  --commit       : git add + git commit (le script commit dans la branche courante)
-  --close        : ferme le ticket (nécessite --commit)
-
-Env requis:
-  FORGE_API   = base API Gitea (LAN) ex: http://192.168.1.20:3000
-  FORGE_TOKEN = PAT Gitea (repo + issues)
-
-Env optionnel:
-  GITEA_OWNER / GITEA_REPO  (sinon auto-détecté via git remote)
-  ANNO_DIR    (défaut: src/annotations)
-  PUBLIC_DIR  (défaut: public)
-  MEDIA_ROOT  (défaut URL: /media)
-
-Exit codes:
-  0 ok
-  1 erreur fatale
-  2 refus (strict/verify/close sans commit / incohérence)
-`);
-  process.exit(exitCode);
-}
-
-/* ---------------------------------- args ---------------------------------- */
-
-const argv = process.argv.slice(2);
-if (argv.length === 0 || argv.includes("--help") || argv.includes("-h")) usage(0);
-
-const issueNum = Number(argv[0]);
-if (!Number.isFinite(issueNum) || issueNum <= 0) {
-  console.error("❌ Numéro de ticket invalide.");
-  usage(2);
-}
-
-const DRY_RUN = argv.includes("--dry-run");
-const NO_DOWNLOAD = argv.includes("--no-download");
-const DO_VERIFY = argv.includes("--verify");
-const STRICT = argv.includes("--strict");
-const DO_COMMIT = argv.includes("--commit");
-const DO_CLOSE = argv.includes("--close");
-
-if (DO_CLOSE && !DO_COMMIT) {
-  console.error("❌ --close nécessite --commit.");
-  process.exit(2);
-}
-
-if (typeof fetch !== "function") {
-  console.error("❌ fetch() indisponible. Utilise Node 18+.");
-  process.exit(1);
-}
-
-/* --------------------------------- config --------------------------------- */
-
-const CWD = process.cwd();
-const ANNO_DIR = path.join(CWD, process.env.ANNO_DIR || "src", "annotations");
-const PUBLIC_DIR = path.join(CWD, process.env.PUBLIC_DIR || "public");
-const MEDIA_URL_ROOT = String(process.env.MEDIA_ROOT || "/media").replace(/\/+$/, "");
-
-/* --------------------------------- helpers -------------------------------- */
-
-function getEnv(name, fallback = "") {
-  return (process.env[name] ?? fallback).trim();
-}
-
-function run(cmd, args, opts = {}) {
-  const r = spawnSync(cmd, args, { stdio: "inherit", ...opts });
-  if (r.error) throw r.error;
-  if (r.status !== 0) throw new Error(`Command failed: ${cmd} ${args.join(" ")}`);
-}
-
-function runQuiet(cmd, args, opts = {}) {
-  const r = spawnSync(cmd, args, { encoding: "utf8", stdio: "pipe", ...opts });
-  if (r.error) throw r.error;
-  if (r.status !== 0) {
-    const out = (r.stdout || "") + (r.stderr || "");
-    throw new Error(`Command failed: ${cmd} ${args.join(" ")}\n${out}`);
-  }
-  return r.stdout || "";
-}
-
-async function exists(p) {
-  try {
-    await fs.access(p);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-function inferOwnerRepoFromGit() {
-  const r = spawnSync("git", ["remote", "get-url", "origin"], { encoding: "utf-8" });
-  if (r.status !== 0) return null;
-  const u = (r.stdout || "").trim();
-  const m = u.match(/[:/](?<owner>[^/]+)\/(?<repo>[^/]+?)(?:\.git)?$/);
-  if (!m?.groups) return null;
-  return { owner: m.groups.owner, repo: m.groups.repo };
-}
-
-function gitHasStagedChanges() {
-  const r = spawnSync("git", ["diff", "--cached", "--quiet"]);
-  return r.status === 1;
-}
-
-function escapeRegExp(s) {
-  return String(s).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-
-function pickLine(body, key) {
-  const re = new RegExp(`^\\s*${escapeRegExp(key)}\\s*:\\s*([^\\n\\r]+)`, "mi");
-  const m = String(body || "").match(re);
-  return m ? m[1].trim() : "";
-}
-
-function pickSection(body, markers) {
-  const text = String(body || "").replace(/\r\n/g, "\n");
-  const idx = markers
-    .map((m) => ({ m, i: text.toLowerCase().indexOf(m.toLowerCase()) }))
-    .filter((x) => x.i >= 0)
-    .sort((a, b) => a.i - b.i)[0];
-  if (!idx) return "";
-
-  const start = idx.i + idx.m.length;
-  const tail = text.slice(start);
-
-  const stops = ["\n## ", "\n---", "\nJustification", "\nProposition", "\nSources"];
-  let end = tail.length;
-  for (const s of stops) {
-    const j = tail.toLowerCase().indexOf(s.toLowerCase());
-    if (j >= 0 && j < end) end = j;
-  }
-  return tail.slice(0, end).trim();
-}
-
-function normalizeChemin(chemin) {
-  let c = String(chemin || "").trim();
-  if (!c) return "";
-  if (!c.startsWith("/")) c = "/" + c;
-  if (!c.endsWith("/")) c = c + "/";
-  c = c.replace(/\/{2,}/g, "/");
-  return c;
-}
-
-function normalizePageKeyFromChemin(chemin) {
-  return normalizeChemin(chemin).replace(/^\/+|\/+$/g, "");
-}
-
-function normalizeAnchorId(s) {
-  let a = String(s || "").trim();
-  if (a.startsWith("#")) a = a.slice(1);
-  return a;
-}
-
-function assert(cond, msg, code = 1) {
-  if (!cond) {
-    const e = new Error(msg);
-    e.__exitCode = code;
-    throw e;
-  }
-}
-
-function isPlainObject(x) {
-  return !!x && typeof x === "object" && !Array.isArray(x);
-}
-
-function paraIndexFromId(id) {
-  const m = String(id).match(/^p-(\d+)-/i);
-  return m ? Number(m[1]) : Number.NaN;
-}
-
-function isHttpUrl(u) {
-  try {
-    const x = new URL(String(u));
-    return x.protocol === "http:" || x.protocol === "https:";
-  } catch {
-    return false;
-  }
-}
-
-/* ------------------------------ para-index (verify + sort) ------------------------------ */
-
-async function loadParaOrderFromDist(pageKey) {
-  const distIdx = path.join(CWD, "dist", "para-index.json");
-  if (!(await exists(distIdx))) return null;
-
-  let j;
-  try {
-    j = JSON.parse(await fs.readFile(distIdx, "utf8"));
-  } catch {
-    return null;
-  }
-
-  // Support several shapes:
-  // A) { items:[{id,page,...}, ...] }
-  if (Array.isArray(j?.items)) {
-    const ids = [];
-    for (const it of j.items) {
-      const p = String(it?.page || it?.pageKey || "");
-      const id = String(it?.id || it?.paraId || "");
-      if (p === pageKey && id) ids.push(id);
-    }
-    if (ids.length) return ids;
-  }
-
-  // B) { byId: { "p-...": { page:"archicrat-ia/chapitre-4", ... }, ... } }
-  if (j?.byId && typeof j.byId === "object") {
-    // cannot rebuild full order; but can verify existence
-    // return a pseudo-order map from known ids sorted by p-<n>- then alpha
-    const ids = Object.keys(j.byId).filter((id) => String(j.byId[id]?.page || "") === pageKey);
-    if (ids.length) {
-      ids.sort((a, b) => {
-        const ia = paraIndexFromId(a);
-        const ib = paraIndexFromId(b);
-        if (Number.isFinite(ia) && Number.isFinite(ib) && ia !== ib) return ia - ib;
-        return String(a).localeCompare(String(b));
-      });
-      return ids;
-    }
-  }
-
-  // C) { pages: { "archicrat-ia/chapitre-4": { ids:[...]} } }
-  if (j?.pages && typeof j.pages === "object") {
-    const pg = j.pages[pageKey];
-    if (Array.isArray(pg?.ids)) return pg.ids.map(String);
-    if (Array.isArray(pg?.paras)) return pg.paras.map(String);
-  }
-
-  return null;
-}
-
-async function tryVerifyAnchor(pageKey, anchorId) {
-  // 1) dist/para-index.json
-  const order = await loadParaOrderFromDist(pageKey);
-  if (order) return order.includes(anchorId);
-
-  // 2) tests/anchors-baseline.json (fallback)
-  const base = path.join(CWD, "tests", "anchors-baseline.json");
-  if (await exists(base)) {
-    try {
-      const j = JSON.parse(await fs.readFile(base, "utf8"));
-      const candidates = [];
-      if (j?.pages && typeof j.pages === "object") {
-        for (const [k, v] of Object.entries(j.pages)) {
-          if (!Array.isArray(v)) continue;
-          if (String(k).includes(pageKey)) candidates.push(...v);
-        }
-      }
-      if (Array.isArray(j?.entries)) {
-        for (const it of j.entries) {
-          const p = String(it?.page || "");
-          const ids = it?.ids;
-          if (Array.isArray(ids) && p.includes(pageKey)) candidates.push(...ids);
-        }
-      }
-      if (candidates.length) return candidates.some((x) => String(x) === anchorId);
-    } catch {
-      // ignore
-    }
-  }
-
-  return null; // cannot verify
-}
-
-/* ----------------------------- deep merge helpers (non destructive) ----------------------------- */
-
-function keyMedia(x) {
-  return String(x?.src || "");
-}
-function keyRef(x) {
-  return `${x?.url || ""}||${x?.label || ""}||${x?.kind || ""}||${x?.citation || ""}`;
-}
-function keyComment(x) {
-  return String(x?.text || "").trim();
-}
-
-function uniqUnion(dstArr, srcArr, keyFn) {
-  const out = Array.isArray(dstArr) ? [...dstArr] : [];
-  const seen = new Set(out.map((x) => keyFn(x)));
-  for (const it of (Array.isArray(srcArr) ? srcArr : [])) {
-    const k = keyFn(it);
-    if (!k) continue;
-    if (!seen.has(k)) {
-      seen.add(k);
-      out.push(it);
-    }
-  }
-  return out;
-}
-
-function deepMergeEntry(dst, src) {
-  if (!isPlainObject(dst) || !isPlainObject(src)) return;
-
-  for (const [k, v] of Object.entries(src)) {
-    if (k === "media" && Array.isArray(v)) {
-      dst.media = uniqUnion(dst.media, v, keyMedia);
-      continue;
-    }
-    if (k === "refs" && Array.isArray(v)) {
-      dst.refs = uniqUnion(dst.refs, v, keyRef);
-      continue;
-    }
-    if (k === "comments_editorial" && Array.isArray(v)) {
-      dst.comments_editorial = uniqUnion(dst.comments_editorial, v, keyComment);
-      continue;
-    }
-
-    if (isPlainObject(v)) {
-      if (!isPlainObject(dst[k])) dst[k] = {};
-      deepMergeEntry(dst[k], v);
-      continue;
-    }
-
-    if (Array.isArray(v)) {
-      // fallback: union by JSON string
-      const cur = Array.isArray(dst[k]) ? dst[k] : [];
-      const seen = new Set(cur.map((x) => JSON.stringify(x)));
-      const out = [...cur];
-      for (const it of v) {
-        const s = JSON.stringify(it);
-        if (!seen.has(s)) {
-          seen.add(s);
-          out.push(it);
-        }
-      }
-      dst[k] = out;
-      continue;
-    }
-
-    // scalar: set only if missing/empty
-    if (!(k in dst) || dst[k] == null || dst[k] === "") {
-      dst[k] = v;
-    }
-  }
-}
-
-function stableSortByTs(arr) {
-  if (!Array.isArray(arr)) return;
-  arr.sort((a, b) => {
-    const ta = Date.parse(a?.ts || "") || 0;
-    const tb = Date.parse(b?.ts || "") || 0;
-    if (ta !== tb) return ta - tb;
-    return JSON.stringify(a).localeCompare(JSON.stringify(b));
-  });
-}
-
-/* ----------------------------- annotations I/O ----------------------------- */
-
-async function loadAnnoDocYaml(fileAbs, pageKey) {
-  if (!(await exists(fileAbs))) {
-    return { schema: 1, page: pageKey, paras: {} };
-  }
-
-  const raw = await fs.readFile(fileAbs, "utf8");
-  let doc;
-  try {
-    doc = YAML.parse(raw);
-  } catch (e) {
-    throw new Error(`${path.relative(CWD, fileAbs)}: parse failed: ${String(e?.message ?? e)}`);
-  }
-
-  assert(isPlainObject(doc), `${path.relative(CWD, fileAbs)}: doc must be an object`, 2);
-  assert(doc.schema === 1, `${path.relative(CWD, fileAbs)}: schema must be 1`, 2);
-  assert(isPlainObject(doc.paras), `${path.relative(CWD, fileAbs)}: missing object key "paras"`, 2);
-
-  if (doc.page != null) {
-    const got = String(doc.page).replace(/^\/+/, "").replace(/\/+$/, "");
-    assert(got === pageKey, `${path.relative(CWD, fileAbs)}: page mismatch (page="${doc.page}" vs path="${pageKey}")`, 2);
-  } else {
-    doc.page = pageKey;
-  }
-
-  return doc;
-}
-
-function sortParasObject(paras, order) {
-  const keys = Object.keys(paras || {});
-  const idx = new Map();
-  if (Array.isArray(order)) {
-    order.forEach((id, i) => idx.set(String(id), i));
-  }
-
-  keys.sort((a, b) => {
-    const ha = idx.has(a);
-    const hb = idx.has(b);
-    if (ha && hb) return idx.get(a) - idx.get(b);
-    if (ha && !hb) return -1;
-    if (!ha && hb) return 1;
-
-    const ia = paraIndexFromId(a);
-    const ib = paraIndexFromId(b);
-    if (Number.isFinite(ia) && Number.isFinite(ib) && ia !== ib) return ia - ib;
-    return String(a).localeCompare(String(b));
-  });
-
-  const out = {};
-  for (const k of keys) out[k] = paras[k];
-  return out;
-}
-
-async function saveAnnoDocYaml(fileAbs, doc, order = null) {
-  await fs.mkdir(path.dirname(fileAbs), { recursive: true });
-  doc.paras = sortParasObject(doc.paras, order);
-
-  // also sort known lists inside each para for stable diffs
-  for (const e of Object.values(doc.paras || {})) {
-    if (!isPlainObject(e)) continue;
-    stableSortByTs(e.media);
-    stableSortByTs(e.refs);
-    stableSortByTs(e.comments_editorial);
-  }
-
-  const out = YAML.stringify(doc);
-  await fs.writeFile(fileAbs, out, "utf8");
-}
-
-/* ------------------------------ gitea helpers ------------------------------ */
-
-function apiBaseNorm(forgeApiBase) {
-  return forgeApiBase.replace(/\/+$/, "");
-}
-
-async function giteaGET(url, token) {
-  const res = await fetch(url, {
-    headers: {
-      Authorization: `token ${token}`,
-      Accept: "application/json",
-      "User-Agent": "archicratie-apply-annotation/1.0",
-    },
-  });
-  if (!res.ok) {
-    const t = await res.text().catch(() => "");
-    throw new Error(`HTTP ${res.status} GET ${url}\n${t}`);
-  }
-  return await res.json();
-}
-
-async function fetchIssue({ forgeApiBase, owner, repo, token, issueNum }) {
-  const url = `${apiBaseNorm(forgeApiBase)}/api/v1/repos/${owner}/${repo}/issues/${issueNum}`;
-  return await giteaGET(url, token);
-}
-
-async function fetchIssueAssets({ forgeApiBase, owner, repo, token, issueNum }) {
-  // Gitea: /issues/{index}/assets
-  const url = `${apiBaseNorm(forgeApiBase)}/api/v1/repos/${owner}/${repo}/issues/${issueNum}/assets`;
-  try {
-    const json = await giteaGET(url, token);
-    return Array.isArray(json) ? json : [];
-  } catch {
-    return [];
-  }
-}
-
-async function postIssueComment({ forgeApiBase, owner, repo, token, issueNum, comment }) {
-  const url = `${apiBaseNorm(forgeApiBase)}/api/v1/repos/${owner}/${repo}/issues/${issueNum}/comments`;
-  const res = await fetch(url, {
-    method: "POST",
-    headers: {
-      Authorization: `token ${token}`,
-      Accept: "application/json",
-      "Content-Type": "application/json",
-      "User-Agent": "archicratie-apply-annotation/1.0",
-    },
-    body: JSON.stringify({ body: comment }),
-  });
-  if (!res.ok) {
-    const t = await res.text().catch(() => "");
-    throw new Error(`HTTP ${res.status} POST comment ${url}\n${t}`);
-  }
-}
-
-async function closeIssue({ forgeApiBase, owner, repo, token, issueNum, comment }) {
-  if (comment) await postIssueComment({ forgeApiBase, owner, repo, token, issueNum, comment });
-
-  const url = `${apiBaseNorm(forgeApiBase)}/api/v1/repos/${owner}/${repo}/issues/${issueNum}`;
-  const res = await fetch(url, {
-    method: "PATCH",
-    headers: {
-      Authorization: `token ${token}`,
-      Accept: "application/json",
-      "Content-Type": "application/json",
-      "User-Agent": "archicratie-apply-annotation/1.0",
-    },
-    body: JSON.stringify({ state: "closed" }),
-  });
-  if (!res.ok) {
-    const t = await res.text().catch(() => "");
-    throw new Error(`HTTP ${res.status} closing issue: ${url}\n${t}`);
-  }
-}
-
-/* ------------------------------ media helpers ------------------------------ */
-
-function inferMediaTypeFromFilename(name) {
-  const n = String(name || "").toLowerCase();
-  if (/\.(png|jpe?g|webp|gif|svg)$/.test(n)) return "image";
-  if (/\.(mp4|webm|mov|m4v)$/.test(n)) return "video";
-  if (/\.(mp3|wav|ogg|m4a)$/.test(n)) return "audio";
-  return "link";
-}
-
-function sanitizeFilename(name) {
-  return String(name || "file")
-    .replace(/[\/\\]/g, "_")
-    .replace(/[^\w.\-]+/g, "_")
-    .replace(/_+/g, "_")
-    .slice(0, 180);
-}
-
-async function downloadToFile(url, token, destAbs) {
-  const res = await fetch(url, {
-    headers: {
-      Authorization: `token ${token}`,
-      "User-Agent": "archicratie-apply-annotation/1.0",
-    },
-    redirect: "follow",
-  });
-  if (!res.ok) {
-    const t = await res.text().catch(() => "");
-    throw new Error(`download failed HTTP ${res.status}: ${url}\n${t}`);
-  }
-  const buf = Buffer.from(await res.arrayBuffer());
-  await fs.mkdir(path.dirname(destAbs), { recursive: true });
-  await fs.writeFile(destAbs, buf);
-  return buf.length;
-}
-
-/* ------------------------------ type parsers ------------------------------ */
-
-function parseReferenceBlock(body) {
-  const block =
-    pickSection(body, ["Référence (à compléter):", "Reference (à compléter):"]) ||
-    pickSection(body, ["Référence:", "Reference:"]);
-
-  const lines = String(block || "").split(/\r?\n/).map((l) => l.trim());
-  const get = (k) => {
-    const re = new RegExp(`^[-*]\\s*${escapeRegExp(k)}\\s*:\\s*(.*)$`, "i");
-    const m = lines.map((l) => l.match(re)).find(Boolean);
-    return (m?.[1] ?? "").trim();
-  };
-
-  return {
-    url: get("URL") || "",
-    label: get("Label") || "",
-    kind: get("Kind") || "",
-    citation: get("Citation") || get("Passage") || get("Extrait") || "",
-    rawBlock: block || "",
-  };
-}
-
-/* ----------------------------------- main ---------------------------------- */
-
-async function main() {
-  const token = getEnv("FORGE_TOKEN");
-  assert(token, "❌ FORGE_TOKEN manquant.", 2);
-
-  const forgeApiBase = getEnv("FORGE_API") || getEnv("FORGE_BASE");
-  assert(forgeApiBase, "❌ FORGE_API (ou FORGE_BASE) manquant.", 2);
-
-  const inferred = inferOwnerRepoFromGit() || {};
-  const owner = getEnv("GITEA_OWNER", inferred.owner || "");
-  const repo = getEnv("GITEA_REPO", inferred.repo || "");
-  assert(owner && repo, "❌ Impossible de déterminer owner/repo. Fix: export GITEA_OWNER=... GITEA_REPO=...", 2);
-
-  console.log(`🔎 Fetch ticket #${issueNum} from ${owner}/${repo} …`);
-  const issue = await fetchIssue({ forgeApiBase, owner, repo, token, issueNum });
-
-  if (issue?.pull_request) {
-    console.error(`❌ #${issueNum} est une Pull Request, pas un ticket annotations.`);
-    process.exit(2);
-  }
-
-  const body = String(issue.body || "").replace(/\r\n/g, "\n");
-  const title = String(issue.title || "");
-
-  const type = pickLine(body, "Type").toLowerCase();
-  const chemin = normalizeChemin(pickLine(body, "Chemin"));
-  const ancre = normalizeAnchorId(pickLine(body, "Ancre"));
-
-  assert(chemin, "Ticket: Chemin manquant.", 2);
-  assert(ancre && /^p-\d+-/i.test(ancre), `Ticket: Ancre invalide ("${ancre}")`, 2);
-  assert(type, "Ticket: Type manquant.", 2);
-
-  const pageKey = normalizePageKeyFromChemin(chemin);
-  assert(pageKey, "Ticket: impossible de dériver pageKey.", 2);
-
-  // para order (used for verify + sorting)
-  const paraOrder = DO_VERIFY ? await loadParaOrderFromDist(pageKey) : null;
-
-  if (DO_VERIFY) {
-    const ok = await tryVerifyAnchor(pageKey, ancre);
-    if (ok === false) {
-      throw Object.assign(new Error(`Ticket verify: ancre introuvable pour page "${pageKey}" => ${ancre}`), { __exitCode: 2 });
-    }
-    if (ok === null) {
-      if (STRICT) throw Object.assign(new Error(`Ticket verify (strict): impossible de vérifier (pas de dist/para-index.json ou baseline)`), { __exitCode: 2 });
-      console.warn("⚠️  verify: impossible de vérifier (pas de dist/para-index.json ou baseline) — on continue.");
-    }
-  }
-
-  // ✅ SHARD FILE: src/annotations/<pageKey>/<paraId>.yml
-  const annoShardFileAbs = path.join(ANNO_DIR, pageKey, `${ancre}.yml`);
-  const annoShardFileRel = path.relative(CWD, annoShardFileAbs).replace(/\\/g, "/");
-
-  // legacy (read-only, used as base to avoid losing previously stored data)
-  const annoLegacyFileAbs = path.join(ANNO_DIR, `${pageKey}.yml`);
-
-  console.log("✅ Parsed:", {
-    type,
-    chemin,
-    ancre: `#${ancre}`,
-    pageKey,
-    annoFile: annoShardFileRel,
-  });
-
-  // load shard doc
-  const doc = await loadAnnoDocYaml(annoShardFileAbs, pageKey);
-
-  // merge legacy para into shard as base (non destructive)
-  if (await exists(annoLegacyFileAbs)) {
-    try {
-      const legacy = await loadAnnoDocYaml(annoLegacyFileAbs, pageKey);
-      const legacyEntry = legacy?.paras?.[ancre];
-      if (isPlainObject(legacyEntry)) {
-        if (!isPlainObject(doc.paras[ancre])) doc.paras[ancre] = {};
-        deepMergeEntry(doc.paras[ancre], legacyEntry);
-      }
-    } catch {
-      // ignore legacy parse issues (shard still works)
-    }
-  }
-
-  if (!isPlainObject(doc.paras[ancre])) doc.paras[ancre] = {};
-  const entry = doc.paras[ancre];
-
-  const touchedFiles = [];
-  const notes = [];
-  let changed = false;
-  const nowIso = new Date().toISOString();
-
-  if (type === "type/comment") {
-    const comment = pickSection(body, ["Commentaire:", "Comment:", "Commentaires:"]) || "";
-    const text = comment.trim();
-    assert(text.length >= 3, "Ticket comment: bloc 'Commentaire:' introuvable ou trop court.", 2);
-
-    if (!Array.isArray(entry.comments_editorial)) entry.comments_editorial = [];
-    const item = { text, status: "new", ts: nowIso, fromIssue: issueNum };
-
-    const before = entry.comments_editorial.length;
-    entry.comments_editorial = uniqUnion(entry.comments_editorial, [item], keyComment);
-    changed = changed || entry.comments_editorial.length !== before;
-
-    stableSortByTs(entry.comments_editorial);
-    notes.push(changed ? `+ comment added (len=${text.length})` : `~ comment already present (dedup)`);
-  }
-
-  else if (type === "type/reference") {
-    const ref = parseReferenceBlock(body);
-    assert(ref.url || ref.label, "Ticket reference: renseigne au moins - URL: ou - Label: dans le ticket.", 2);
-
-    if (STRICT && ref.url && !isHttpUrl(ref.url)) {
-      throw Object.assign(new Error(`Ticket reference (strict): URL invalide (http/https requis): "${ref.url}"`), { __exitCode: 2 });
-    }
-
-    if (!Array.isArray(entry.refs)) entry.refs = [];
-    const item = {
-      url: ref.url || "",
-      label: ref.label || (ref.url ? ref.url : "Référence"),
-      kind: ref.kind || "",
-      ts: nowIso,
-      fromIssue: issueNum,
-    };
-    if (ref.citation) item.citation = ref.citation;
-
-    const before = entry.refs.length;
-    entry.refs = uniqUnion(entry.refs, [item], keyRef);
-    changed = changed || entry.refs.length !== before;
-
-    stableSortByTs(entry.refs);
-    notes.push(changed ? `+ reference added (${item.url ? "url" : "label"})` : `~ reference already present (dedup)`);
-  }
-
-  else if (type === "type/media") {
-    if (!Array.isArray(entry.media)) entry.media = [];
-
-    const atts = NO_DOWNLOAD ? [] : await fetchIssueAssets({ forgeApiBase, owner, repo, token, issueNum });
-    if (!atts.length) notes.push("! no assets found (nothing to download).");
-
-    for (const a of atts) {
-      const name = sanitizeFilename(a?.name || `asset-${a?.id || "x"}`);
-      const dl = a?.browser_download_url || a?.download_url || "";
-      if (!dl) { notes.push(`! asset missing download url: ${name}`); continue; }
-
-      const caption = (title || "").trim();
-      if (STRICT && !caption) {
-        throw Object.assign(new Error("Ticket media (strict): caption vide (titre de ticket requis)."), { __exitCode: 2 });
-      }
-      const captionFinal = caption || ".";
-
-      const mediaDirAbs = path.join(PUBLIC_DIR, "media", pageKey, ancre);
-      const destAbs = path.join(mediaDirAbs, name);
-      const urlPath = `${MEDIA_URL_ROOT}/${pageKey}/${ancre}/${name}`.replace(/\/{2,}/g, "/");
-
-      if (await exists(destAbs)) {
-        notes.push(`~ media already exists: ${urlPath}`);
-      } else if (!DRY_RUN) {
-        const bytes = await downloadToFile(dl, token, destAbs);
-        notes.push(`+ downloaded ${name} (${bytes} bytes) -> ${urlPath}`);
-        touchedFiles.push(path.relative(CWD, destAbs).replace(/\\/g, "/"));
-        changed = true;
-      } else {
-        notes.push(`(dry) would download ${name} -> ${urlPath}`);
-        changed = true;
-      }
-
-      const item = {
-        type: inferMediaTypeFromFilename(name),
-        src: urlPath,
-        caption: captionFinal,
-        credit: "",
-        ts: nowIso,
-        fromIssue: issueNum,
-      };
-
-      const before = entry.media.length;
-      entry.media = uniqUnion(entry.media, [item], keyMedia);
-      if (entry.media.length !== before) changed = true;
-    }
-
-    stableSortByTs(entry.media);
-  }
-
-  else {
-    throw Object.assign(new Error(`Type non supporté: "${type}"`), { __exitCode: 2 });
-  }
-
-  if (!changed) {
-    console.log("ℹ️  No changes to apply.");
-    for (const n of notes) console.log("  ", n);
-    return;
-  }
-
-  if (DRY_RUN) {
-    console.log("\n--- DRY RUN (no write) ---");
-    console.log(`Would update: ${annoShardFileRel}`);
-    for (const n of notes) console.log("  ", n);
-    console.log("\nExcerpt (resulting entry):");
-    console.log(YAML.stringify({ [ancre]: doc.paras[ancre] }).trimEnd());
-    console.log("\n✅ Dry-run terminé.");
-    return;
-  }
-
-  await saveAnnoDocYaml(annoShardFileAbs, doc, paraOrder);
-  touchedFiles.unshift(annoShardFileRel);
-
-  console.log(`✅ Updated: ${annoShardFileRel}`);
-  for (const n of notes) console.log("  ", n);
-
-  if (DO_COMMIT) {
-    run("git", ["add", ...touchedFiles], { cwd: CWD });
-
-    if (!gitHasStagedChanges()) {
-      console.log("ℹ️ Nothing to commit (aucun changement staged).");
-      return;
-    }
-
-    const msg = `anno: apply ticket #${issueNum} (${pageKey}#${ancre} ${type})`;
-    run("git", ["commit", "-m", msg], { cwd: CWD });
-
-    const sha = runQuiet("git", ["rev-parse", "--short", "HEAD"], { cwd: CWD }).trim();
-    console.log(`✅ Committed: ${msg} (${sha})`);
-
-    if (DO_CLOSE) {
-      const comment = `✅ Appliqué par apply-annotation-ticket.\nCommit: ${sha}`;
-      await closeIssue({ forgeApiBase, owner, repo, token, issueNum, comment });
-      console.log(`✅ Ticket #${issueNum} fermé.`);
-    }
-  } else {
-    console.log("\nNext (manuel) :");
-    console.log(`  git diff -- ${touchedFiles[0]}`);
-    console.log(`  git add ${touchedFiles.join(" ")}`);
-    console.log(`  git commit -m "anno: apply ticket #${issueNum} (${pageKey}#${ancre} ${type})"`);
-  }
-}
-
-main().catch((e) => {
-  const code = e?.__exitCode || 1;
-  console.error("💥", e?.message || e);
-  process.exit(code);
-});
--- a/scripts/check-annotations.mjs
+++ b/scripts/check-annotations.mjs
@@ -60,12 +60,10 @@ function getAlias(aliases, pageKey, oldId) {
  // supporte:
  // 1) { "<pageKey>": { "<old>": "<new>" } }
  // 2) { "<old>": "<new>" }
-  const k1 = String(pageKey || "");
-  const k2 = k1 ? ("/" + k1.replace(/^\/+|\/+$/g, "") + "/") : "";
-  const a1 = (aliases?.[k1]?.[oldId]) || (k2 ? aliases?.[k2]?.[oldId] : "");
-  if (a1) return String(a1);
+  const a1 = aliases?.[pageKey]?.[oldId];
+  if (a1) return a1;
  const a2 = aliases?.[oldId];
-  if (a2) return String(a2);
+  if (a2) return a2;
  return "";
 }

--- a/scripts/inject-anchor-aliases.mjs
+++ b/scripts/inject-anchor-aliases.mjs
@@ -14,24 +14,6 @@ const STRICT = argv.includes("--strict") || process.env.CI === "1" || process.en
 function escRe(s) {
  return String(s).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-
-async function exists(p) {
-  try {
-    await fs.access(p);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-function normalizeRoute(route) {
-  let r = String(route || "").trim();
-  if (!r.startsWith("/")) r = "/" + r;
-  if (!r.endsWith("/")) r = r + "/";
-  r = r.replace(/\/{2,}/g, "/");
-  return r;
-}
-
 function countIdAttr(html, id) {
  const re = new RegExp(`\\bid=(["'])${escRe(id)}\\1`, "gi");
  let c = 0;
@@ -40,6 +22,7 @@ function countIdAttr(html, id) {
 }

 function findStartTagWithId(html, id) {
+  // 1er élément qui porte id="..."
  const re = new RegExp(
    `<([a-zA-Z0-9:-]+)\\b[^>]*\\bid=(["'])${escRe(id)}\\2[^>]*>`,
    "i"
@@ -53,10 +36,34 @@ function isInjectedAliasSpan(html, id) {
  const found = findStartTagWithId(html, id);
  if (!found) return false;
  if (found.tagName !== "span") return false;
+  // class="... para-alias ..."
  return /\bclass=(["'])(?:(?!\1).)*\bpara-alias\b(?:(?!\1).)*\1/i.test(found.tag);
 }
+  
+function normalizeRoute(route) {
+  let r = String(route || "").trim();
+  if (!r.startsWith("/")) r = "/" + r;
+  if (!r.endsWith("/")) r = r + "/";
+  r = r.replace(/\/{2,}/g, "/");
+  return r;
+}
+
+async function exists(p) {
+  try {
+    await fs.access(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function hasId(html, id) {
+  const re = new RegExp(`\\bid=(["'])${escRe(id)}\\1`, "i");
+  return re.test(html);
+}

 function injectBeforeId(html, newId, injectHtml) {
+  // insère juste avant la balise qui porte id="newId"
  const re = new RegExp(
    `(<[^>]+\\bid=(["'])${escRe(newId)}\\2[^>]*>)`,
    "i"
@@ -75,7 +82,6 @@ async function main() {
  }

  const raw = await fs.readFile(ALIASES_PATH, "utf-8");
-
  /** @type {Record<string, Record<string,string>>} */
  let aliases;
  try {
@@ -83,7 +89,6 @@ async function main() {
  } catch (e) {
    throw new Error(`JSON invalide: ${ALIASES_PATH} (${e?.message || e})`);
  }
-
  if (!aliases || typeof aliases !== "object" || Array.isArray(aliases)) {
    throw new Error(`Format invalide: attendu { route: { oldId: newId } } dans ${ALIASES_PATH}`);
  }
@@ -109,10 +114,10 @@ async function main() {
      console.log(msg);
      warnCount++;
    }
-
+    
    if (entries.length === 0) continue;

-    const rel = route.replace(/^\/+|\/+$/g, "");
+    const rel = route.replace(/^\/+|\/+$/g, ""); // sans slash
    const htmlPath = path.join(DIST_ROOT, rel, "index.html");

    if (!(await exists(htmlPath))) {
@@ -130,8 +135,24 @@ async function main() {
      if (!oldId || !newId) continue;

      const oldCount = countIdAttr(html, oldId);
+      if (oldCount > 0) {
+        // ✅ déjà injecté (idempotent)
+        if (isInjectedAliasSpan(html, oldId)) continue;

-      // ✅ déjà injecté => idempotent
+        // ⛔️ oldId existe déjà "en vrai" (ex: <p id="oldId">)
+        // => alias inutile / inversé / obsolète
+        const found = findStartTagWithId(html, oldId);
+        const where = found ? `<${found.tagName} … id="${oldId}" …>` : `id="${oldId}"`;
+        const msg =
+          `⚠️  alias inutile/inversé: oldId déjà présent dans la page (${where}). ` +
+          `Supprime l'alias ${oldId} -> ${newId} (ou corrige le sens) pour route=${route}`;
+        if (STRICT) throw new Error(msg);
+        console.log(msg);
+        warnCount++;
+        continue;
+      }
+
+      // juste après avoir calculé oldCount
      if (oldCount > 0 && isInjectedAliasSpan(html, oldId)) {
        if (STRICT && oldCount !== 1) {
          throw new Error(`oldId dupliqué (${oldCount}) alors qu'il est censé être unique: ${route} id=${oldId}`);
@@ -139,23 +160,18 @@ async function main() {
        continue;
      }

-      // ⛔️ oldId existe déjà "en vrai" => alias inutile/inversé
-      if (oldCount > 0) {
-        const found = findStartTagWithId(html, oldId);
-        const where = found ? `<${found.tagName} … id="${oldId}" …>` : `id="${oldId}"`;
-        const msg =
-          `⚠️  alias inutile/inversé: oldId déjà présent (${where}). ` +
-          `Supprime ${oldId} -> ${newId} (ou corrige le sens) pour route=${route}`;
+      // avant l'injection, après hasId(newId)
+      const newCount = countIdAttr(html, newId);
+      if (newCount !== 1) {
+        const msg = `⚠️  newId non-unique (${newCount}) : ${route} new=${newId} (injection ambiguë)`;
        if (STRICT) throw new Error(msg);
        console.log(msg);
        warnCount++;
        continue;
      }

-      // newId doit exister UNE fois (sinon injection ambiguë)
-      const newCount = countIdAttr(html, newId);
-      if (newCount !== 1) {
-        const msg = `⚠️  newId non-unique (${newCount}) : ${route} new=${newId} (injection ambiguë)`;
+      if (!hasId(html, newId)) {
+        const msg = `⚠️  newId introuvable: ${route} old=${oldId} -> new=${newId}`;
        if (STRICT) throw new Error(msg);
        console.log(msg);
        warnCount++;
--- a/scripts/purge-dist-dev-whoami.mjs
+++ b/scripts/purge-dist-dev-whoami.mjs
@@ -1,31 +0,0 @@
-// scripts/purge-dist-dev-whoami.mjs
-import fs from "node:fs/promises";
-import path from "node:path";
-
-const CWD = process.cwd();
-const targetDir = path.join(CWD, "dist", "_auth", "whoami");
-const targetIndex = path.join(CWD, "dist", "_auth", "whoami", "index.html");
-
-// Purge idempotente (force=true => pas d'erreur si absent)
-async function rmSafe(p) {
-  try {
-    await fs.rm(p, { recursive: true, force: true });
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-async function main() {
-  const removedIndex = await rmSafe(targetIndex);
-  const removedDir = await rmSafe(targetDir);
-
-  // Optionnel: si dist/_auth devient vide, on laisse tel quel (pas besoin de toucher)
-  const any = removedIndex || removedDir;
-  console.log(`✅ purge-dist-dev-whoami: ${any ? "purged" : "nothing to purge"}`);
-}
-
-main().catch((e) => {
-  console.error("❌ purge-dist-dev-whoami failed:", e);
-  process.exit(1);
-});
--- a/scripts/verify-anchor-aliases-in-dist.mjs
+++ b/scripts/verify-anchor-aliases-in-dist.mjs
@@ -205,7 +205,7 @@ for (const [route, mapping] of Object.entries(data)) {
        newId,
        htmlPath,
        msg:
-          `oldId present but is NOT an injected alias span (<span class="para-alias">).\n` +
+          `oldId present but is NOT an injected alias span (<span class="para-alias">).</n` +
          `Saw: ${seen}`,
      });
      continue;
--- a/scripts/write-dev-whoami.mjs
+++ b/scripts/write-dev-whoami.mjs
@@ -1,26 +0,0 @@
-import fs from "node:fs/promises";
-import path from "node:path";
-
-const OUT = path.join(process.cwd(), "public", "_auth", "whoami");
-
-const groupsRaw = process.env.PUBLIC_WHOAMI_GROUPS ?? "editors";
-const user = process.env.PUBLIC_WHOAMI_USER ?? "dev";
-const name = process.env.PUBLIC_WHOAMI_NAME ?? "Dev Local";
-const email = process.env.PUBLIC_WHOAMI_EMAIL ?? "area.technik@proton.me";
-
-const groups = groupsRaw
-  .split(/[;,]/)
-  .map((s) => s.trim())
-  .filter(Boolean)
-  .join(",");
-
-const body =
-  `Remote-User: ${user}\n` +
-  `Remote-Name: ${name}\n` +
-  `Remote-Email: ${email}\n` +
-  `Remote-Groups: ${groups}\n`;
-
-await fs.mkdir(path.dirname(OUT), { recursive: true });
-await fs.writeFile(OUT, body, "utf8");
-
-console.log(`✅ dev whoami written: ${path.relative(process.cwd(), OUT)} (${groups})`);
--- a/src/annotations/archicrat-ia/chapitre-4.yml
+++ b/src/annotations/archicrat-ia/chapitre-4.yml
@@ -1,30 +0,0 @@
-schema: 1
-page: archicrat-ia/chapitre-4
-paras:
-  p-2-31b12529:
-    media:
-      - type: image
-        src: /media/archicrat-ia/chapitre-4/p-2-31b12529/Capture_d_e_cran_2026-02-16_a_13.05.58.png
-        caption: "[Media] p-2-31b12529 — Chapitre 4 — Histoire archicratique des
-          révolutions industrielles"
-        credit: ""
-        ts: 2026-02-25T18:58:32.359Z
-        fromIssue: 115
-  p-7-1da4a458:
-    media:
-      - type: image
-        src: /media/archicrat-ia/chapitre-4/p-7-1da4a458/Capture_d_e_cran_2026-02-16_a_13.05.58.png
-        caption: "[Media] p-7-1da4a458 — Chapitre 4 — Histoire archicratique des
-          révolutions industrielles"
-        credit: ""
-        ts: 2026-02-25T19:11:32.634Z
-        fromIssue: 121
-  p-11-67c14c09:
-    media:
-      - type: image
-        src: /media/archicrat-ia/chapitre-4/p-11-67c14c09/Capture_d_e_cran_2026-02-16_a_13.07.35.png
-        caption: "[Media] p-11-67c14c09 — Chapitre 4 — Histoire archicratique des
-          révolutions industrielles"
-        credit: ""
-        ts: 2026-02-26T13:17:41.286Z
-        fromIssue: 129
--- a/src/annotations/archicrat-ia/prologue.yml
+++ b/src/annotations/archicrat-ia/prologue.yml
@@ -1,5 +1,8 @@
 schema: 1

+# optionnel (si présent, doit matcher le chemin du fichier)
+page: archicratie/archicrat-ia/prologue
+
 paras:
  p-0-d7974f88:
    refs:
@@ -47,4 +50,10 @@ paras:
      - text: "Si l’on voulait chercher quelque chose comme une vision du monde chez Kafka..."
        source: "Bernard Lahire, Franz Kafka, p.475+"

+    media:
+      - type: "video"
+        src: "/media/prologue/p-1-2ef25f29/bien_commun.mp4"
+        caption: "Entretien avec Bernard Lahire"
+        credit: "Cairn.info"
+
    comments_editorial: []
--- a/src/components/SidePanel.astro
+++ b/src/components/SidePanel.astro
@@ -144,14 +144,15 @@
    const canReaders = inGroup(groups, "readers");
    const canEditors = inGroup(groups, "editors");

-    const whoamiSkipped = Boolean(window.__archiFlags && window.__archiFlags.whoamiSkipped);
-    access.canUsers = Boolean((info?.ok && (canReaders || canEditors)) || whoamiSkipped);
+    access.canUsers = Boolean((info?.ok && (canReaders || canEditors)) || (isDev() && !info?.ok));
    access.ready = true;

    if (btnMediaSubmit) btnMediaSubmit.disabled = !access.canUsers;
    if (btnSend) btnSend.disabled = !access.canUsers;
+
    if (btnRefSubmit) btnRefSubmit.disabled = !access.canUsers;

+
    // si pas d'accès, on informe (soft)
    if (!access.canUsers) {
      if (msgHead) {
@@ -161,13 +162,12 @@
      }
    }
  }).catch(() => {
-    // fallback dev (cohérent: media + ref + comment)
+    // fallback dev
    access.ready = true;
-    if (Boolean(window.__archiFlags && window.__archiFlags.whoamiSkipped)) {
+    if (isDev()) {
      access.canUsers = true;
      if (btnMediaSubmit) btnMediaSubmit.disabled = false;
      if (btnSend) btnSend.disabled = false;
-      if (btnRefSubmit) btnRefSubmit.disabled = false;
    }
  });

@@ -209,12 +209,8 @@
  async function loadIndex() {
    if (_idxP) return _idxP;
    _idxP = (async () => {
-      try {
-        const res = await fetch("/annotations-index.json?_=" + Date.now(), { cache: "no-store" });
-        if (res && res.ok) return await res.json();
-      } catch {}
-      // ✅ antifragile: ne pas “cacher” un échec pour toujours (dev/HMR/boot race)
-      _idxP = null;
+      const res = await fetch("/annotations-index.json?_=" + Date.now(), { cache: "no-store" }).catch(() => null);
+      if (res && res.ok) return await res.json();
      return null;
    })();
    return _idxP;
@@ -568,14 +564,6 @@
    hideMsg(msgComment);

    const idx = await loadIndex();
-
-    // ✅ message soft si l’index est indisponible (sans écraser le message d’auth)
-    if (!idx && msgHead && msgHead.hidden) {
-      msgHead.hidden = false;
-      msgHead.textContent = "Index annotations indisponible (annotations-index.json).";
-      msgHead.dataset.kind = "info";
-    }
-
    const data = idx?.pages?.[pageKey]?.paras?.[currentParaId] || null;

    renderLevel2(data);
--- a/src/layouts/EditionLayout.astro
+++ b/src/layouts/EditionLayout.astro
@@ -30,13 +30,6 @@ const GITEA_REPO = import.meta.env.PUBLIC_GITEA_REPO ?? "";

 // ✅ OPTIONNEL : bridge serveur (proxy same-origin)
 const ISSUE_BRIDGE_PATH = import.meta.env.PUBLIC_ISSUE_BRIDGE_PATH ?? "";
-
-// ✅ Auth whoami (same-origin) — configurable, antifragile en dev
-const WHOAMI_PATH = import.meta.env.PUBLIC_WHOAMI_PATH ?? "/_auth/whoami";
-// Par défaut: en DEV local on SKIP pour éviter le spam 404.
-// Pour tester l’auth en dev: export PUBLIC_WHOAMI_IN_DEV=1
-const WHOAMI_IN_DEV = (import.meta.env.PUBLIC_WHOAMI_IN_DEV ?? "") === "1";
-const WHOAMI_FORCE_LOCALHOST = (import.meta.env.PUBLIC_WHOAMI_FORCE_LOCALHOST ?? "") === "1";
 ---

 <!doctype html>
@@ -59,104 +52,54 @@ const WHOAMI_FORCE_LOCALHOST = (import.meta.env.PUBLIC_WHOAMI_FORCE_LOCALHOST ??
    <meta data-pagefind-meta={`version:${String(version ?? "")}`} />

    {/* ✅ BOOT EARLY : SidePanel dépend de ces globals. */}
-    <script
-      is:inline
-      define:vars={{
-        IS_DEV,
-        GITEA_BASE,
-        GITEA_OWNER,
-        GITEA_REPO,
-        ISSUE_BRIDGE_PATH,
-        WHOAMI_PATH,
-        WHOAMI_IN_DEV,
-        WHOAMI_FORCE_LOCALHOST,
-      }}
-    >
+    <script is:inline define:vars={{ IS_DEV, GITEA_BASE, GITEA_OWNER, GITEA_REPO, ISSUE_BRIDGE_PATH }}>
 (() => {
-  // ✅ anti double-init (HMR / inclusion accidentelle)
-  if (window.__archiBootOnce === 1) return;
-  window.__archiBootOnce = 1;
+  const __DEV__ = Boolean(IS_DEV);
+  window.__archiFlags = Object.assign({}, window.__archiFlags, { dev: __DEV__ });

-  var __DEV__ = Boolean(IS_DEV);
+  const base = String(GITEA_BASE || "").replace(/\/+$/, "");
+  const owner = String(GITEA_OWNER || "");
+  const repo = String(GITEA_REPO || "");
+  const giteaReady = Boolean(base && owner && repo);
+  window.__archiGitea = { ready: giteaReady, base, owner, repo };

-  // ===== Gitea globals =====
-  var base = String(GITEA_BASE || "").replace(/\/+$/, "");
-  var owner = String(GITEA_OWNER || "");
-  var repo = String(GITEA_REPO || "");
-  window.__archiGitea = {
-    ready: Boolean(base && owner && repo),
-    base, owner, repo
-  };
-
-  // ===== optional issue bridge (same-origin proxy) =====
-  var rawBridge = String(ISSUE_BRIDGE_PATH || "").trim();
-  var normBridge = rawBridge
+  const rawBridge = String(ISSUE_BRIDGE_PATH || "").trim();
+  const normBridge = rawBridge
    ? (rawBridge.startsWith("/") ? rawBridge : ("/" + rawBridge.replace(/^\/+/, ""))).replace(/\/+$/, "")
    : "";
  window.__archiIssueBridge = { ready: Boolean(normBridge), path: normBridge };

-  // ===== whoami config =====
-  var __WHOAMI_PATH__ = String(WHOAMI_PATH || "/_auth/whoami");
-  var __WHOAMI_IN_DEV__ = Boolean(WHOAMI_IN_DEV);
-
-  // En dev: par défaut on SKIP (=> pas de spam 404). Override via PUBLIC_WHOAMI_IN_DEV=1.
-  var SHOULD_FETCH_WHOAMI = (!__DEV__) || __WHOAMI_IN_DEV__;
-
-  window.__archiFlags = Object.assign({}, window.__archiFlags, {
-    dev: __DEV__,
-    whoamiPath: __WHOAMI_PATH__,
-    whoamiInDev: __WHOAMI_IN_DEV__,
-    whoamiFetch: SHOULD_FETCH_WHOAMI,
-  });
-
-  var REQUIRED_GROUP = "editors";
-  var READ_GROUP = "readers";
+  const WHOAMI_PATH = "/_auth/whoami";
+  const REQUIRED_GROUP = "editors";
+  const READ_GROUP = "readers";

  function parseWhoamiLine(text, key) {
-    var re = new RegExp("^" + key + ":\\s*(.*)$", "mi");
-    var m = String(text || "").match(re);
-    return (m && m[1] ? m[1] : "").trim();
+    const re = new RegExp(`^${key}:\\s*(.*)$`, "mi");
+    const m = String(text || "").match(re);
+    return (m?.[1] ?? "").trim();
  }
-
  function inGroup(groups, g) {
-    var gg = String(g || "").toLowerCase();
+    const gg = String(g || "").toLowerCase();
    return Array.isArray(groups) && groups.some((x) => String(x).toLowerCase() === gg);
  }

-  // ===== Auth info promise (single source of truth) =====
  if (!window.__archiAuthInfoP) {
    window.__archiAuthInfoP = (async () => {
-      // ✅ dev default: skip
-      if (!SHOULD_FETCH_WHOAMI) {
-        return { ok: false, user: "", name: "", email: "", groups: [], raw: "" };
-      }
-
-      var res = null;
-      try {
-        res = await fetch(__WHOAMI_PATH__ + "?_=" + Date.now(), {
-          credentials: "include",
-          cache: "no-store",
-          redirect: "manual",
-          headers: { Accept: "text/plain" },
-        });
-      } catch {
-        res = null;
-      }
+      const res = await fetch(`${WHOAMI_PATH}?_=${Date.now()}`, {
+        credentials: "include",
+        cache: "no-store",
+        redirect: "manual",
+        headers: { Accept: "text/plain" },
+      }).catch(() => null);

      if (!res) return { ok: false, user: "", name: "", email: "", groups: [], raw: "" };
-      if (res.type === "opaqueredirect") return { ok: false, user: "", name: "", email: "", groups: [], raw: "" };
      if (res.status >= 300 && res.status < 400) return { ok: false, user: "", name: "", email: "", groups: [], raw: "" };
-      if (res.status === 404) return { ok: false, user: "", name: "", email: "", groups: [], raw: "" };

-      var text = "";
-      try { text = await res.text(); } catch { text = ""; }
+      const text = await res.text().catch(() => "");
+      const looksLikeWhoami = /Remote-(User|Groups|Email|Name)\s*:/i.test(text);
+      if (!res.ok || !looksLikeWhoami) return { ok: false, user: "", name: "", email: "", groups: [], raw: text };

-      var looksLikeWhoami = /Remote-(User|Groups|Email|Name)\s*:/i.test(text);
-      if (!res.ok || !looksLikeWhoami) {
-        return { ok: false, user: "", name: "", email: "", groups: [], raw: text };
-      }
-
-      var groups = parseWhoamiLine(text, "Remote-Groups")
+      const groups = parseWhoamiLine(text, "Remote-Groups")
        .split(/[;,]/)
        .map((s) => s.trim())
        .filter(Boolean)
@@ -173,22 +116,18 @@ const WHOAMI_FORCE_LOCALHOST = (import.meta.env.PUBLIC_WHOAMI_FORCE_LOCALHOST ??
    })().catch(() => ({ ok: false, user: "", name: "", email: "", groups: [], raw: "" }));
  }

-  // readers + editors (strict)
  if (!window.__archiCanReadP) {
    window.__archiCanReadP = window.__archiAuthInfoP.then((info) =>
-      Boolean(info && info.ok && (inGroup(info.groups, READ_GROUP) || inGroup(info.groups, REQUIRED_GROUP)))
+      Boolean(info.ok && (inGroup(info.groups, READ_GROUP) || inGroup(info.groups, REQUIRED_GROUP)))
    );
  }

-  // editors gate for "Proposer"
  if (!window.__archiIsEditorP) {
    window.__archiIsEditorP = window.__archiAuthInfoP
-      // ✅ DEV fallback: si whoami absent/KO => Proposer autorisé (comme ton intention initiale)
-      .then((info) => Boolean(inGroup(info.groups, REQUIRED_GROUP) || (__DEV__ && !(info && info.ok))))
-      .catch(() => Boolean(__DEV__));
+      .then((info) => Boolean(inGroup(info.groups, REQUIRED_GROUP) || (__DEV__ && !info.ok)))
+      .catch(() => false);
  }
 })();
-
    </script>
  </head>

@@ -1011,13 +950,11 @@ const WHOAMI_FORCE_LOCALHOST = (import.meta.env.PUBLIC_WHOAMI_FORCE_LOCALHOST ??

  safe("propose-gate", () => {
    if (!giteaReady) return;
-
    const p = window.__archiIsEditorP || Promise.resolve(false);
-
    p.then((ok) => {
      document.querySelectorAll(".para-propose").forEach((el) => {
        if (ok) showEl(el);
-        else hideEl(el); // ✅ jamais remove => antifragile
+        else el.remove();
      });
    }).catch((err) => {
      console.warn("[proposer] gate failed; keeping Proposer hidden", err);
--- a/src/pages/annotations-index.json.ts
+++ b/src/pages/annotations-index.json.ts
@@ -1,197 +0,0 @@
-import type { APIRoute } from "astro";
-import * as fs from "node:fs/promises";
-import * as path from "node:path";
-import { parse as parseYAML } from "yaml";
-
-const CWD = process.cwd();
-const ANNO_DIR = path.join(CWD, "src", "annotations");
-
-// Strict en CI (ou override explicite)
-const STRICT =
-  process.env.ANNOTATIONS_STRICT === "1" ||
-  process.env.CI === "1" ||
-  process.env.CI === "true";
-
-async function exists(p: string): Promise<boolean> {
-  try {
-    await fs.access(p);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-async function walk(dir: string): Promise<string[]> {
-  const out: string[] = [];
-  const ents = await fs.readdir(dir, { withFileTypes: true });
-  for (const e of ents) {
-    const p = path.join(dir, e.name);
-    if (e.isDirectory()) out.push(...(await walk(p)));
-    else out.push(p);
-  }
-  return out;
-}
-
-function isPlainObject(x: unknown): x is Record<string, unknown> {
-  return !!x && typeof x === "object" && !Array.isArray(x);
-}
-
-function normalizePageKey(s: unknown): string {
-  return String(s ?? "")
-    .replace(/^\/+/, "")
-    .replace(/\/+$/, "")
-    .trim();
-}
-
-function inferPageKeyFromFile(inDirAbs: string, fileAbs: string): string {
-  const rel = path.relative(inDirAbs, fileAbs).replace(/\\/g, "/");
-  return rel.replace(/\.(ya?ml|json)$/i, "");
-}
-
-function parseDoc(raw: string, fileAbs: string): unknown {
-  if (/\.json$/i.test(fileAbs)) return JSON.parse(raw);
-  return parseYAML(raw);
-}
-
-function hardFailOrCollect(errors: string[], msg: string): void {
-  if (STRICT) throw new Error(msg);
-  errors.push(msg);
-}
-
-function sanitizeEntry(
-  fileRel: string,
-  paraId: string,
-  entry: unknown,
-  errors: string[]
-): Record<string, unknown> {
-  if (entry == null) return {};
-
-  if (!isPlainObject(entry)) {
-    hardFailOrCollect(errors, `${fileRel}: paras.${paraId} must be an object`);
-    return {};
-  }
-
-  const e: Record<string, unknown> = { ...entry };
-
-  const arrayFields = [
-    "refs",
-    "authors",
-    "quotes",
-    "media",
-    "comments_editorial",
-  ] as const;
-
-  for (const k of arrayFields) {
-    if (e[k] == null) continue;
-    if (!Array.isArray(e[k])) {
-      errors.push(`${fileRel}: paras.${paraId}.${k} must be an array (coerced to [])`);
-      e[k] = [];
-    }
-  }
-
-  return e;
-}
-
-export const GET: APIRoute = async () => {
-  if (!(await exists(ANNO_DIR))) {
-    const out = {
-      schema: 1,
-      generatedAt: new Date().toISOString(),
-      pages: {},
-      stats: { pages: 0, paras: 0, errors: 0 },
-      errors: [] as string[],
-    };
-
-    return new Response(JSON.stringify(out), {
-      headers: {
-        "Content-Type": "application/json; charset=utf-8",
-        "Cache-Control": "no-store",
-      },
-    });
-  }
-
-  const files = (await walk(ANNO_DIR)).filter((p) => /\.(ya?ml|json)$/i.test(p));
-
-  const pages: Record<string, { paras: Record<string, Record<string, unknown>> }> =
-    Object.create(null);
-
-  const errors: string[] = [];
-  let paraCount = 0;
-
-  for (const f of files) {
-    const fileRel = path.relative(CWD, f).replace(/\\/g, "/");
-    const pageKey = normalizePageKey(inferPageKeyFromFile(ANNO_DIR, f));
-
-    if (!pageKey) {
-      hardFailOrCollect(errors, `${fileRel}: cannot infer page key`);
-      continue;
-    }
-
-    let doc: unknown;
-    try {
-      const raw = await fs.readFile(f, "utf8");
-      doc = parseDoc(raw, f);
-    } catch (e) {
-      hardFailOrCollect(errors, `${fileRel}: parse failed: ${String((e as any)?.message ?? e)}`);
-      continue;
-    }
-
-    if (!isPlainObject(doc) || (doc as any).schema !== 1) {
-      hardFailOrCollect(errors, `${fileRel}: schema must be 1`);
-      continue;
-    }
-
-    if ((doc as any).page != null) {
-      const declared = normalizePageKey((doc as any).page);
-      if (declared !== pageKey) {
-        hardFailOrCollect(
-          errors,
-          `${fileRel}: page mismatch (page="${declared}" vs path="${pageKey}")`
-        );
-      }
-    }
-
-    const parasAny = (doc as any).paras;
-    if (!isPlainObject(parasAny)) {
-      hardFailOrCollect(errors, `${fileRel}: missing object key "paras"`);
-      continue;
-    }
-
-    if (pages[pageKey]) {
-      hardFailOrCollect(errors, `${fileRel}: duplicate page "${pageKey}" (only one file per page)`);
-      continue;
-    }
-
-    const parasOut: Record<string, Record<string, unknown>> = Object.create(null);
-
-    for (const [paraId, entry] of Object.entries(parasAny)) {
-      if (!/^p-\d+-/i.test(paraId)) {
-        hardFailOrCollect(errors, `${fileRel}: invalid para id "${paraId}"`);
-        continue;
-      }
-      parasOut[paraId] = sanitizeEntry(fileRel, paraId, entry, errors);
-    }
-
-    pages[pageKey] = { paras: parasOut };
-    paraCount += Object.keys(parasOut).length;
-  }
-
-  const out = {
-    schema: 1,
-    generatedAt: new Date().toISOString(),
-    pages,
-    stats: {
-      pages: Object.keys(pages).length,
-      paras: paraCount,
-      errors: errors.length,
-    },
-    errors,
-  };
-
-  return new Response(JSON.stringify(out), {
-    headers: {
-      "Content-Type": "application/json; charset=utf-8",
-      "Cache-Control": "no-store",
-    },
-  });
-};
--- a/src/pages/para-index.json.ts
+++ b/src/pages/para-index.json.ts
@@ -1,42 +0,0 @@
-import type { APIRoute } from "astro";
-import * as fs from "node:fs/promises";
-import * as path from "node:path";
-
-export const prerender = true;
-
-async function exists(p: string) {
-  try { await fs.access(p); return true; } catch { return false; }
-}
-
-export const GET: APIRoute = async () => {
-  const distFile = path.join(process.cwd(), "dist", "para-index.json");
-
-  // Si dist existe (ex: après un build), on renvoie le vrai fichier.
-  if (await exists(distFile)) {
-    const raw = await fs.readFile(distFile, "utf8");
-    return new Response(raw, {
-      status: 200,
-      headers: {
-        "content-type": "application/json; charset=utf-8",
-        "cache-control": "no-store",
-      },
-    });
-  }
-
-  // Sinon stub (dev sans build) : pas d’erreur, pas de crash, pas de 404.
-  const stub = {
-    schema: 1,
-    generatedAt: new Date().toISOString(),
-    items: [],
-    byId: {},
-    note: "para-index not built yet (run: npm run build to generate dist/para-index.json)",
-  };
-
-  return new Response(JSON.stringify(stub), {
-    status: 200,
-    headers: {
-      "content-type": "application/json; charset=utf-8",
-      "cache-control": "no-store",
-    },
-  });
-};
--- a/tests/anchors-baseline.json
+++ b/tests/anchors-baseline.json
@@ -1,4 +1,8 @@
 {
+  "archicratie/00-demarrage/index.html": [
+    "p-0-d64c1c39",
+    "p-1-3f750540"
+  ],
  "archicrat-ia/chapitre-1/index.html": [
    "p-0-8d27a7f5",
    "p-1-8a6c18bf",