ops(diag): add archicratie deploy/edge diagnostic script

.gitea/ISSUE_TEMPLATE/correction-paragraphe.md

@@ -3,7 +3,7 @@ name: "Correction paragraphe"
 about: "Proposer une correction ciblée (un paragraphe) avec justification."
 ---
 
-## Chemin (ex: /archicrat-ia/prologue/)
+## Chemin (ex: /archicratie/prologue/)
 <!-- obligatoire -->
 /...
 

.gitea/ISSUE_TEMPLATE/verification-factuelle.md

@@ -3,7 +3,7 @@ name: "Vérification factuelle / sources"
 about: "Signaler une assertion à sourcer ou à corriger (preuves, références)."
 ---
 
-## Chemin (ex: /archicrat-ia/prologue/)
+## Chemin (ex: /archicratie/prologue/)
 <!-- obligatoire -->
 /...
 

.gitea/workflows/anno-apply-pr.yml

@@ -1,449 +0,0 @@
-name: Anno Apply (PR)
-
-on:
-  issues:
-    types: [labeled]
-  workflow_dispatch:
-    inputs:
-      issue:
-        description: "Issue number to apply"
-        required: true
-
-env:
-  NODE_OPTIONS: --dns-result-order=ipv4first
-
-defaults:
-  run:
-    shell: bash
-
-concurrency:
-  group: anno-apply-${{ github.event.issue.number || github.event.issue.index || inputs.issue || 'manual' }}
-  cancel-in-progress: true
-
-jobs:
-  apply-approved:
-    runs-on: mac-ci
-    container:
-      image: mcr.microsoft.com/devcontainers/javascript-node:22-bookworm
-
-    steps:
-      - name: Tools sanity
-        run: |
-          set -euo pipefail
-          git --version
-          node --version
-          npm --version
-
-      - name: Derive context (event.json / workflow_dispatch)
-        env:
-          INPUT_ISSUE: ${{ inputs.issue }}
-          FORGE_API: ${{ vars.FORGE_API || vars.FORGE_BASE || vars.FORGE_BASE_URL }}
-        run: |
-          set -euo pipefail
-          export EVENT_JSON="/var/run/act/workflow/event.json"
-          test -f "$EVENT_JSON" || { echo "❌ Missing $EVENT_JSON"; exit 1; }
-
-          node --input-type=module - <<'NODE' > /tmp/anno.env
-          import fs from "node:fs";
-
-          const ev = JSON.parse(fs.readFileSync(process.env.EVENT_JSON, "utf8"));
-          const repoObj = ev?.repository || {};
-
-          const cloneUrl =
-            repoObj?.clone_url ||
-            (repoObj?.html_url ? (repoObj.html_url.replace(/\/$/,"") + ".git") : "");
-
-          if (!cloneUrl) throw new Error("No repository clone_url/html_url in event.json");
-
-          let owner =
-            repoObj?.owner?.login ||
-            repoObj?.owner?.username ||
-            (repoObj?.full_name ? repoObj.full_name.split("/")[0] : "");
-
-          let repo =
-            repoObj?.name ||
-            (repoObj?.full_name ? repoObj.full_name.split("/")[1] : "");
-
-          if (!owner || !repo) {
-            const m = cloneUrl.match(/[:/](?<o>[^/]+)\/(?<r>[^/]+?)(?:\.git)?$/);
-            if (m?.groups) { owner = owner || m.groups.o; repo = repo || m.groups.r; }
-          }
-          if (!owner || !repo) throw new Error("Cannot infer owner/repo");
-
-          const defaultBranch = repoObj?.default_branch || "main";
-
-          const issueNumber =
-            ev?.issue?.number ||
-            ev?.issue?.index ||
-            (process.env.INPUT_ISSUE ? Number(process.env.INPUT_ISSUE) : 0);
-
-          if (!issueNumber || !Number.isFinite(Number(issueNumber))) {
-            throw new Error("No issue number in event.json or workflow_dispatch input");
-          }
-
-          // label name: best-effort (non-bloquant)
-          let labelName = "workflow_dispatch";
-          const lab = ev?.label;
-          if (typeof lab === "string") labelName = lab;
-          else if (lab && typeof lab === "object" && typeof lab.name === "string") labelName = lab.name;
-          else if (ev?.label?.name) labelName = ev.label.name;
-
-          const u = new URL(cloneUrl);
-          const origin = u.origin;
-
-          const apiBase = (process.env.FORGE_API && String(process.env.FORGE_API).trim())
-            ? String(process.env.FORGE_API).trim().replace(/\/+$/,"")
-            : origin;
-
-          function sh(s){ return JSON.stringify(String(s)); }
-
-          process.stdout.write([
-            `CLONE_URL=${sh(cloneUrl)}`,
-            `OWNER=${sh(owner)}`,
-            `REPO=${sh(repo)}`,
-            `DEFAULT_BRANCH=${sh(defaultBranch)}`,
-            `ISSUE_NUMBER=${sh(issueNumber)}`,
-            `LABEL_NAME=${sh(labelName)}`,
-            `API_BASE=${sh(apiBase)}`
-          ].join("\n") + "\n");
-          NODE
-
-          echo "✅ context:"
-          sed -n '1,120p' /tmp/anno.env
-
-      - name: Early gate (label event fast-skip, but tolerant)
-        run: |
-          set -euo pipefail
-          source /tmp/anno.env
-
-          echo "ℹ️ event label = $LABEL_NAME"
-
-          # Fast skip on obvious non-approved label events (avoid noise),
-          # BUT do NOT skip if label payload is weird/unknown.
-          if [[ "$LABEL_NAME" != "state/approved" && "$LABEL_NAME" != "workflow_dispatch" && "$LABEL_NAME" != "" && "$LABEL_NAME" != "[object Object]" ]]; then
-            echo "ℹ️ label=$LABEL_NAME => skip early"
-            echo "SKIP=1" >> /tmp/anno.env
-            echo "SKIP_REASON=\"label_not_approved_event\"" >> /tmp/anno.env
-            exit 0
-          fi
-
-          echo "✅ continue to API gating (issue=$ISSUE_NUMBER)"
-
-      - name: Fetch issue + hard gate on labels + Type
-        env:
-          FORGE_TOKEN: ${{ secrets.FORGE_TOKEN }}
-        run: |
-          set -euo pipefail
-          source /tmp/anno.env
-          [[ "${SKIP:-0}" != "1" ]] || { echo "ℹ️ skipped"; exit 0; }
-
-          test -n "${FORGE_TOKEN:-}" || { echo "❌ Missing secret FORGE_TOKEN"; exit 1; }
-
-          curl -fsS \
-            -H "Authorization: token $FORGE_TOKEN" \
-            -H "Accept: application/json" \
-            "$API_BASE/api/v1/repos/$OWNER/$REPO/issues/$ISSUE_NUMBER" \
-            -o /tmp/issue.json
-
-          node --input-type=module - <<'NODE' >> /tmp/anno.env
-          import fs from "node:fs";
-
-          const issue = JSON.parse(fs.readFileSync("/tmp/issue.json","utf8"));
-          const title = String(issue.title || "");
-          const body = String(issue.body || "").replace(/\r\n/g, "\n");
-
-          const labels = Array.isArray(issue.labels) ? issue.labels.map(l => String(l.name || "")).filter(Boolean) : [];
-          const hasApproved = labels.includes("state/approved");
-
-          function pickLine(key) {
-            const re = new RegExp(`^\\s*${key}\\s*:\\s*([^\\n\\r]+)`, "mi");
-            const m = body.match(re);
-            return m ? m[1].trim() : "";
-          }
-
-          const typeRaw = pickLine("Type");
-          const type = String(typeRaw || "").trim().toLowerCase();
-
-          const allowed = new Set(["type/media","type/reference","type/comment"]);
-          const proposer = new Set(["type/correction","type/fact-check"]);
-
-          const out = [];
-          out.push(`ISSUE_TITLE=${JSON.stringify(title)}`);
-          out.push(`ISSUE_TYPE=${JSON.stringify(type)}`);
-
-          // HARD gate: must currently have state/approved (avoids depending on event payload)
-          if (!hasApproved) {
-            out.push(`SKIP=1`);
-            out.push(`SKIP_REASON=${JSON.stringify("not_approved_label_present")}`);
-            process.stdout.write(out.join("\n") + "\n");
-            process.exit(0);
-          }
-
-          if (!type) {
-            out.push(`SKIP=1`);
-            out.push(`SKIP_REASON=${JSON.stringify("missing_type")}`);
-          } else if (allowed.has(type)) {
-            // proceed
-          } else if (proposer.has(type)) {
-            out.push(`SKIP=1`);
-            out.push(`SKIP_REASON=${JSON.stringify("proposer_type:"+type)}`);
-          } else {
-            out.push(`SKIP=1`);
-            out.push(`SKIP_REASON=${JSON.stringify("unsupported_type:"+type)}`);
-          }
-
-          process.stdout.write(out.join("\n") + "\n");
-          NODE
-
-          echo "✅ gating result:"
-          grep -E '^(ISSUE_TYPE|SKIP|SKIP_REASON)=' /tmp/anno.env || true
-
-      - name: Comment issue if skipped (Proposer / unsupported / missing Type)
-        if: ${{ always() }}
-        env:
-          FORGE_TOKEN: ${{ secrets.FORGE_TOKEN }}
-        run: |
-          set -euo pipefail
-          source /tmp/anno.env || true
-
-          [[ "${SKIP:-0}" == "1" ]] || exit 0
-
-          # IMPORTANT: do NOT comment for "not_approved_label_present" (avoid spam on other label events)
-          if [[ "${SKIP_REASON:-}" == "not_approved_label_present" || "${SKIP_REASON:-}" == "label_not_approved_event" ]]; then
-            echo "ℹ️ skip reason=${SKIP_REASON} -> no comment"
-            exit 0
-          fi
-
-          test -n "${FORGE_TOKEN:-}" || exit 0
-
-          REASON="${SKIP_REASON:-}"
-          TYPE="${ISSUE_TYPE:-}"
-
-          if [[ "$REASON" == proposer_type:* ]]; then
-            MSG="ℹ️ Ticket #${ISSUE_NUMBER} détecté comme **Proposer** (${TYPE}).\n\n- Ce type est **traité manuellement par les editors**.\n✅ Aucun traitement automatique."
-          elif [[ "$REASON" == unsupported_type:* ]]; then
-            MSG="ℹ️ Ticket #${ISSUE_NUMBER} ignoré : Type non supporté par le bot (${TYPE}).\n\nTypes supportés : type/media, type/reference, type/comment."
-          else
-            MSG="ℹ️ Ticket #${ISSUE_NUMBER} ignoré : champ 'Type:' manquant ou illisible.\n\nAjoute : Type: type/media|type/reference|type/comment"
-          fi
-
-          PAYLOAD="$(node --input-type=module -e 'console.log(JSON.stringify({body: process.argv[1]||""}))' "$MSG")"
-
-          curl -fsS -X POST \
-            -H "Authorization: token $FORGE_TOKEN" \
-            -H "Content-Type: application/json" \
-            "$API_BASE/api/v1/repos/$OWNER/$REPO/issues/$ISSUE_NUMBER/comments" \
-            --data-binary "$PAYLOAD"
-
-      - name: Checkout default branch
-        run: |
-          set -euo pipefail
-          source /tmp/anno.env
-          [[ "${SKIP:-0}" != "1" ]] || { echo "ℹ️ skipped"; exit 0; }
-
-          rm -rf .git
-          git init -q
-          git remote add origin "$CLONE_URL"
-          git fetch --depth 1 origin "$DEFAULT_BRANCH"
-          git -c advice.detachedHead=false checkout -q FETCH_HEAD
-          git log -1 --oneline
-
-      - name: Install deps
-        run: |
-          set -euo pipefail
-          source /tmp/anno.env
-          [[ "${SKIP:-0}" != "1" ]] || { echo "ℹ️ skipped"; exit 0; }
-          npm ci --no-audit --no-fund
-
-      - name: Check apply script exists
-        run: |
-          set -euo pipefail
-          source /tmp/anno.env
-          [[ "${SKIP:-0}" != "1" ]] || { echo "ℹ️ skipped"; exit 0; }
-          test -f scripts/apply-annotation-ticket.mjs || {
-            echo "❌ missing scripts/apply-annotation-ticket.mjs on $DEFAULT_BRANCH"
-            ls -la scripts | sed -n '1,200p' || true
-            exit 1
-          }
-
-      - name: Build dist (needed for --verify)
-        run: |
-          set -euo pipefail
-          source /tmp/anno.env
-          [[ "${SKIP:-0}" != "1" ]] || { echo "ℹ️ skipped"; exit 0; }
-
-          npm run build
-
-          test -f dist/para-index.json || {
-            echo "❌ missing dist/para-index.json after build"
-            ls -la dist | sed -n '1,200p' || true
-            exit 1
-          }
-          echo "✅ dist/para-index.json present"
-
-      - name: Apply ticket on bot branch (strict+verify, commit)
-        continue-on-error: true
-        env:
-          FORGE_TOKEN: ${{ secrets.FORGE_TOKEN }}
-          BOT_GIT_NAME: ${{ secrets.BOT_GIT_NAME }}
-          BOT_GIT_EMAIL: ${{ secrets.BOT_GIT_EMAIL }}
-        run: |
-          set -euo pipefail
-          source /tmp/anno.env
-          [[ "${SKIP:-0}" != "1" ]] || { echo "ℹ️ skipped"; exit 0; }
-          test -d .git || { echo "❌ not a git repo (checkout failed)"; echo "APPLY_RC=90" >> /tmp/anno.env; exit 0; }
-
-          test -n "${FORGE_TOKEN:-}" || { echo "❌ Missing secret FORGE_TOKEN"; exit 1; }
-
-          git config user.name  "${BOT_GIT_NAME:-archicratie-bot}"
-          git config user.email "${BOT_GIT_EMAIL:-bot@archicratie.local}"
-
-          START_SHA="$(git rev-parse HEAD)"
-          TS="$(date -u +%Y%m%d-%H%M%S)"
-          BR="bot/anno-${ISSUE_NUMBER}-${TS}"
-          echo "BRANCH=$BR" >> /tmp/anno.env
-          git checkout -b "$BR"
-
-          export FORGE_API="$API_BASE"
-          export GITEA_OWNER="$OWNER"
-          export GITEA_REPO="$REPO"
-
-          LOG="/tmp/apply.log"
-          set +e
-          node scripts/apply-annotation-ticket.mjs "$ISSUE_NUMBER" --strict --verify --commit >"$LOG" 2>&1
-          RC=$?
-          set -e
-
-          echo "APPLY_RC=$RC" >> /tmp/anno.env
-
-          echo "== apply log (tail) =="
-          tail -n 180 "$LOG" || true
-
-          END_SHA="$(git rev-parse HEAD)"
-
-          if [[ "$RC" -ne 0 ]]; then
-            echo "NOOP=0" >> /tmp/anno.env
-            exit 0
-          fi
-
-          if [[ "$START_SHA" == "$END_SHA" ]]; then
-            echo "NOOP=1" >> /tmp/anno.env
-          else
-            echo "NOOP=0" >> /tmp/anno.env
-            echo "END_SHA=$END_SHA" >> /tmp/anno.env
-          fi
-
-      - name: Comment issue on failure (strict/verify/etc)
-        if: ${{ always() }}
-        env:
-          FORGE_TOKEN: ${{ secrets.FORGE_TOKEN }}
-        run: |
-          set -euo pipefail
-          source /tmp/anno.env || true
-          [[ "${SKIP:-0}" != "1" ]] || { echo "ℹ️ skipped"; exit 0; }
-
-          RC="${APPLY_RC:-0}"
-          if [[ "$RC" == "0" ]]; then
-            echo "ℹ️ no failure detected"
-            exit 0
-          fi
-
-          test -n "${FORGE_TOKEN:-}" || exit 0
-
-          if [[ -f /tmp/apply.log ]]; then
-            BODY="$(tail -n 160 /tmp/apply.log | sed 's/\r$//')"
-          else
-            BODY="(no apply log found)"
-          fi
-
-          MSG="❌ apply-annotation-ticket a échoué (rc=${RC}).\n\n\`\`\`\n${BODY}\n\`\`\`\n"
-          PAYLOAD="$(node --input-type=module -e 'console.log(JSON.stringify({body: process.argv[1]||""}))' "$MSG")"
-
-          curl -fsS -X POST \
-            -H "Authorization: token $FORGE_TOKEN" \
-            -H "Content-Type: application/json" \
-            "$API_BASE/api/v1/repos/$OWNER/$REPO/issues/$ISSUE_NUMBER/comments" \
-            --data-binary "$PAYLOAD"
-
-      - name: Push bot branch
-        if: ${{ always() }}
-        env:
-          FORGE_TOKEN: ${{ secrets.FORGE_TOKEN }}
-        run: |
-          set -euo pipefail
-          source /tmp/anno.env || true
-          [[ "${SKIP:-0}" != "1" ]] || exit 0
-
-          [[ "${APPLY_RC:-0}" == "0" ]] || { echo "ℹ️ apply failed -> skip push"; exit 0; }
-          [[ "${NOOP:-0}" == "0" ]] || { echo "ℹ️ no-op -> skip push"; exit 0; }
-          test -d .git || { echo "ℹ️ no git repo -> skip push"; exit 0; }
-
-          AUTH_URL="$(node --input-type=module -e '
-            const [clone, tok] = process.argv.slice(1);
-            const u = new URL(clone);
-            u.username = "oauth2";
-            u.password = tok;
-            console.log(u.toString());
-          ' "$CLONE_URL" "$FORGE_TOKEN")"
-
-          git remote set-url origin "$AUTH_URL"
-          git push -u origin "$BRANCH"
-
-      - name: Create PR + comment issue
-        if: ${{ always() }}
-        env:
-          FORGE_TOKEN: ${{ secrets.FORGE_TOKEN }}
-        run: |
-          set -euo pipefail
-          source /tmp/anno.env || true
-          [[ "${SKIP:-0}" != "1" ]] || exit 0
-
-          [[ "${APPLY_RC:-0}" == "0" ]] || { echo "ℹ️ apply failed -> skip PR"; exit 0; }
-          [[ "${NOOP:-0}" == "0" ]] || { echo "ℹ️ no-op -> skip PR"; exit 0; }
-
-          PR_TITLE="anno: apply ticket #${ISSUE_NUMBER}"
-          PR_BODY="PR auto depuis ticket #${ISSUE_NUMBER} (state/approved).\n\n- Branche: ${BRANCH}\n- Commit: ${END_SHA}\n\nMerge si CI OK."
-
-          PR_PAYLOAD="$(node --input-type=module -e '
-            const [title, body, base, head] = process.argv.slice(1);
-            console.log(JSON.stringify({ title, body, base, head, allow_maintainer_edit: true }));
-          ' "$PR_TITLE" "$PR_BODY" "$DEFAULT_BRANCH" "${OWNER}:${BRANCH}")"
-
-          PR_JSON="$(curl -fsS -X POST \
-            -H "Authorization: token $FORGE_TOKEN" \
-            -H "Content-Type: application/json" \
-            "$API_BASE/api/v1/repos/$OWNER/$REPO/pulls" \
-            --data-binary "$PR_PAYLOAD")"
-
-          PR_URL="$(node --input-type=module -e '
-            const pr = JSON.parse(process.argv[1] || "{}");
-            console.log(pr.html_url || pr.url || "");
-          ' "$PR_JSON")"
-
-          test -n "$PR_URL" || { echo "❌ PR URL missing. Raw: $PR_JSON"; exit 1; }
-
-          MSG="✅ PR créée pour ticket #${ISSUE_NUMBER} : ${PR_URL}"
-          C_PAYLOAD="$(node --input-type=module -e 'console.log(JSON.stringify({body: process.argv[1]||""}))' "$MSG")"
-
-          curl -fsS -X POST \
-            -H "Authorization: token $FORGE_TOKEN" \
-            -H "Content-Type: application/json" \
-            "$API_BASE/api/v1/repos/$OWNER/$REPO/issues/$ISSUE_NUMBER/comments" \
-            --data-binary "$C_PAYLOAD"
-
-          echo "✅ PR: $PR_URL"
-
-      - name: Finalize (fail job if apply failed)
-        if: ${{ always() }}
-        run: |
-          set -euo pipefail
-          source /tmp/anno.env || true
-
-          [[ "${SKIP:-0}" != "1" ]] || { echo "ℹ️ skipped"; exit 0; }
-
-          RC="${APPLY_RC:-0}"
-          if [[ "$RC" != "0" ]]; then
-            echo "❌ apply failed (rc=$RC)"
-            exit "$RC"
-          fi
-          echo "✅ apply ok"

.gitea/workflows/anno-reject.yml

@@ -1,181 +0,0 @@
-name: Anno Reject (close issue)
-
-on:
-  issues:
-    types: [labeled]
-  workflow_dispatch:
-    inputs:
-      issue:
-        description: "Issue number to reject/close"
-        required: true
-
-env:
-  NODE_OPTIONS: --dns-result-order=ipv4first
-
-defaults:
-  run:
-    shell: bash
-
-concurrency:
-  group: anno-reject-${{ github.event.issue.number || github.event.issue.index || inputs.issue || 'manual' }}
-  cancel-in-progress: true
-
-jobs:
-  reject:
-    runs-on: mac-ci
-    container:
-      image: mcr.microsoft.com/devcontainers/javascript-node:22-bookworm
-
-    steps:
-      - name: Tools sanity
-        run: |
-          set -euo pipefail
-          node --version
-
-      - name: Derive context (event.json / workflow_dispatch)
-        env:
-          INPUT_ISSUE: ${{ inputs.issue }}
-          FORGE_API: ${{ vars.FORGE_API || vars.FORGE_BASE || vars.FORGE_BASE_URL }}
-        run: |
-          set -euo pipefail
-          export EVENT_JSON="/var/run/act/workflow/event.json"
-          test -f "$EVENT_JSON" || { echo "❌ Missing $EVENT_JSON"; exit 1; }
-
-          node --input-type=module - <<'NODE' > /tmp/reject.env
-          import fs from "node:fs";
-
-          const ev = JSON.parse(fs.readFileSync(process.env.EVENT_JSON, "utf8"));
-          const repoObj = ev?.repository || {};
-
-          const cloneUrl =
-            repoObj?.clone_url ||
-            (repoObj?.html_url ? (repoObj.html_url.replace(/\/$/,"") + ".git") : "");
-
-          let owner =
-            repoObj?.owner?.login ||
-            repoObj?.owner?.username ||
-            (repoObj?.full_name ? repoObj.full_name.split("/")[0] : "");
-
-          let repo =
-            repoObj?.name ||
-            (repoObj?.full_name ? repoObj.full_name.split("/")[1] : "");
-
-          if ((!owner || !repo) && cloneUrl) {
-            const m = cloneUrl.match(/[:/](?<o>[^/]+)\/(?<r>[^/]+?)(?:\.git)?$/);
-            if (m?.groups) { owner = owner || m.groups.o; repo = repo || m.groups.r; }
-          }
-          if (!owner || !repo) throw new Error("Cannot infer owner/repo");
-
-          const issueNumber =
-            ev?.issue?.number ||
-            ev?.issue?.index ||
-            (process.env.INPUT_ISSUE ? Number(process.env.INPUT_ISSUE) : 0);
-
-          if (!issueNumber || !Number.isFinite(Number(issueNumber))) {
-            throw new Error("No issue number in event.json or workflow_dispatch input");
-          }
-
-          // label name: best-effort (non-bloquant)
-          let labelName = "workflow_dispatch";
-          const lab = ev?.label;
-          if (typeof lab === "string") labelName = lab;
-          else if (lab && typeof lab === "object" && typeof lab.name === "string") labelName = lab.name;
-
-          let apiBase = "";
-          if (process.env.FORGE_API && String(process.env.FORGE_API).trim()) {
-            apiBase = String(process.env.FORGE_API).trim().replace(/\/+$/,"");
-          } else if (cloneUrl) {
-            apiBase = new URL(cloneUrl).origin;
-          } else {
-            apiBase = "";
-          }
-
-          function sh(s){ return JSON.stringify(String(s)); }
-
-          process.stdout.write([
-            `OWNER=${sh(owner)}`,
-            `REPO=${sh(repo)}`,
-            `ISSUE_NUMBER=${sh(issueNumber)}`,
-            `LABEL_NAME=${sh(labelName)}`,
-            `API_BASE=${sh(apiBase)}`
-          ].join("\n") + "\n");
-          NODE
-
-          echo "✅ context:"
-          sed -n '1,120p' /tmp/reject.env
-
-      - name: Early gate (fast-skip, tolerant)
-        run: |
-          set -euo pipefail
-          source /tmp/reject.env
-          echo "ℹ️ event label = $LABEL_NAME"
-
-          if [[ "$LABEL_NAME" != "state/rejected" && "$LABEL_NAME" != "workflow_dispatch" && "$LABEL_NAME" != "" && "$LABEL_NAME" != "[object Object]" ]]; then
-            echo "ℹ️ label=$LABEL_NAME => skip early"
-            echo "SKIP=1" >> /tmp/reject.env
-            echo "SKIP_REASON=\"label_not_rejected_event\"" >> /tmp/reject.env
-            exit 0
-          fi
-
-      - name: Comment + close (only if label state/rejected is PRESENT now, and no conflict)
-        env:
-          FORGE_TOKEN: ${{ secrets.FORGE_TOKEN }}
-        run: |
-          set -euo pipefail
-          source /tmp/reject.env
-          [[ "${SKIP:-0}" != "1" ]] || { echo "ℹ️ skipped"; exit 0; }
-
-          test -n "${FORGE_TOKEN:-}" || { echo "❌ Missing secret FORGE_TOKEN"; exit 1; }
-          test -n "${API_BASE:-}" || { echo "❌ Missing API_BASE"; exit 1; }
-
-          curl -fsS \
-            -H "Authorization: token $FORGE_TOKEN" \
-            -H "Accept: application/json" \
-            "$API_BASE/api/v1/repos/$OWNER/$REPO/issues/$ISSUE_NUMBER" \
-            -o /tmp/reject.issue.json
-
-          node --input-type=module - <<'NODE' > /tmp/reject.flags
-          import fs from "node:fs";
-          const issue = JSON.parse(fs.readFileSync("/tmp/reject.issue.json","utf8"));
-          const labels = Array.isArray(issue.labels) ? issue.labels.map(l => String(l.name || "")).filter(Boolean) : [];
-          const hasApproved = labels.includes("state/approved");
-          const hasRejected = labels.includes("state/rejected");
-          process.stdout.write(`HAS_APPROVED=${hasApproved ? "1":"0"}\nHAS_REJECTED=${hasRejected ? "1":"0"}\n`);
-          NODE
-
-          source /tmp/reject.flags
-
-          # Do nothing unless state/rejected is truly present now (anti payload weird)
-          if [[ "${HAS_REJECTED:-0}" != "1" ]]; then
-            echo "ℹ️ state/rejected not present -> skip"
-            exit 0
-          fi
-
-          if [[ "${HAS_APPROVED:-0}" == "1" && "${HAS_REJECTED:-0}" == "1" ]]; then
-            MSG="⚠️ Conflit d'état sur le ticket #${ISSUE_NUMBER} : labels **state/approved** et **state/rejected** présents.\n\n➡️ Action manuelle requise : retirer l'un des deux labels avant relance."
-            PAYLOAD="$(node --input-type=module -e 'console.log(JSON.stringify({body: process.argv[1]||""}))' "$MSG")"
-            curl -fsS -X POST \
-              -H "Authorization: token $FORGE_TOKEN" \
-              -H "Content-Type: application/json" \
-              "$API_BASE/api/v1/repos/$OWNER/$REPO/issues/$ISSUE_NUMBER/comments" \
-              --data-binary "$PAYLOAD"
-            echo "ℹ️ conflict => stop"
-            exit 0
-          fi
-
-          MSG="❌ Ticket #${ISSUE_NUMBER} refusé (label state/rejected)."
-          PAYLOAD="$(node --input-type=module -e 'console.log(JSON.stringify({body: process.argv[1]||""}))' "$MSG")"
-
-          curl -fsS -X POST \
-            -H "Authorization: token $FORGE_TOKEN" \
-            -H "Content-Type: application/json" \
-            "$API_BASE/api/v1/repos/$OWNER/$REPO/issues/$ISSUE_NUMBER/comments" \
-            --data-binary "$PAYLOAD"
-
-          curl -fsS -X PATCH \
-            -H "Authorization: token $FORGE_TOKEN" \
-            -H "Content-Type: application/json" \
-            "$API_BASE/api/v1/repos/$OWNER/$REPO/issues/$ISSUE_NUMBER" \
-            --data-binary '{"state":"closed"}'
-
-          echo "✅ rejected+closed"

.gitea/workflows/auto-label-issues.yml

@@ -4,37 +4,22 @@ on:
   issues:
     types: [opened, edited]
 
-concurrency:
-  group: auto-label-${{ github.event.issue.number || github.event.issue.index || 'manual' }}
-  cancel-in-progress: true
-
 jobs:
   label:
-    runs-on: mac-ci
-    container:
-      image: mcr.microsoft.com/devcontainers/javascript-node:22-bookworm
-
+    runs-on: ubuntu-latest
     steps:
       - name: Apply labels from Type/State/Category
         env:
-          # IMPORTANT: préfère FORGE_BASE (LAN) si défini, sinon FORGE_API
-          FORGE_BASE: ${{ vars.FORGE_BASE || vars.FORGE_API || vars.FORGE_API_BASE }}
+          FORGE_BASE: ${{ vars.FORGE_API || vars.FORGE_BASE }}
           FORGE_TOKEN: ${{ secrets.FORGE_TOKEN }}
           REPO_FULL: ${{ gitea.repository }}
           EVENT_PATH: ${{ github.event_path }}
-          NODE_OPTIONS: --dns-result-order=ipv4first
         run: |
           python3 - <<'PY'
-          import json, os, re, time, urllib.request, urllib.error, socket
-
-          forge = (os.environ.get("FORGE_BASE") or "").rstrip("/")
-          if not forge:
-              raise SystemExit("Missing FORGE_BASE/FORGE_API repo variable (e.g. http://192.168.1.20:3000)")
-
-          token = os.environ.get("FORGE_TOKEN") or ""
-          if not token:
-              raise SystemExit("Missing secret FORGE_TOKEN")
+          import json, os, re, urllib.request, urllib.error
 
+          forge = os.environ["FORGE_BASE"].rstrip("/")
+          token = os.environ["FORGE_TOKEN"]
           owner, repo = os.environ["REPO_FULL"].split("/", 1)
           event_path = os.environ["EVENT_PATH"]
 
@@ -61,9 +46,12 @@ jobs:
           print("PARSED:", {"Type": t, "State": s, "Category": c})
 
           # 1) explicite depuis le body
-          if t: desired.add(t)
-          if s: desired.add(s)
-          if c: desired.add(c)
+          if t:
+              desired.add(t)
+          if s:
+              desired.add(s)
+          if c:
+              desired.add(c)
 
           # 2) fallback depuis le titre si Type absent
           if not t:
@@ -88,56 +76,42 @@ jobs:
               "Authorization": f"token {token}",
               "Accept": "application/json",
               "Content-Type": "application/json",
-              "User-Agent": "archicratie-auto-label/1.1",
+              "User-Agent": "archicratie-auto-label/1.0",
           }
 
-          def jreq(method, url, payload=None, timeout=60, retries=4, backoff=2.0):
+          def jreq(method, url, payload=None):
               data = None if payload is None else json.dumps(payload).encode("utf-8")
-              last_err = None
-              for i in range(retries):
-                  req = urllib.request.Request(url, data=data, headers=headers, method=method)
-                  try:
-                      with urllib.request.urlopen(req, timeout=timeout) as r:
-                          b = r.read()
-                          return json.loads(b.decode("utf-8")) if b else None
-                  except urllib.error.HTTPError as e:
-                      b = e.read().decode("utf-8", errors="replace")
-                      raise RuntimeError(f"HTTP {e.code} {method} {url}\n{b}") from e
-                  except (TimeoutError, socket.timeout, urllib.error.URLError) as e:
-                      last_err = e
-                      # retry only on network/timeout
-                      time.sleep(backoff * (i + 1))
-              raise RuntimeError(f"Network/timeout after retries: {method} {url}\n{last_err}")
+              req = urllib.request.Request(url, data=data, headers=headers, method=method)
+              try:
+                  with urllib.request.urlopen(req, timeout=20) as r:
+                      b = r.read()
+                      return json.loads(b.decode("utf-8")) if b else None
+              except urllib.error.HTTPError as e:
+                  b = e.read().decode("utf-8", errors="replace")
+                  raise RuntimeError(f"HTTP {e.code} {method} {url}\n{b}") from e
 
           # labels repo
-          labels = jreq("GET", f"{api}/repos/{owner}/{repo}/labels?limit=1000", timeout=60) or []
+          labels = jreq("GET", f"{api}/repos/{owner}/{repo}/labels?limit=1000") or []
           name_to_id = {x.get("name"): x.get("id") for x in labels}
 
           missing = [x for x in desired if x not in name_to_id]
           if missing:
               raise SystemExit("Missing labels in repo: " + ", ".join(sorted(missing)))
 
-          wanted_ids = sorted({int(name_to_id[x]) for x in desired})
+          wanted_ids = [name_to_id[x] for x in desired]
 
           # labels actuels de l'issue
-          current = jreq("GET", f"{api}/repos/{owner}/{repo}/issues/{number}/labels", timeout=60) or []
-          current_ids = {int(x.get("id")) for x in current if x.get("id") is not None}
+          current = jreq("GET", f"{api}/repos/{owner}/{repo}/issues/{number}/labels") or []
+          current_ids = {x.get("id") for x in current if x.get("id") is not None}
 
           final_ids = sorted(current_ids.union(wanted_ids))
 
-          # Replace labels = union (n'enlève rien)
+          # set labels = union (n'enlève rien)
           url = f"{api}/repos/{owner}/{repo}/issues/{number}/labels"
-
-          # IMPORTANT: on n'envoie JAMAIS une liste brute ici (ça a causé le 422)
-          jreq("PUT", url, {"labels": final_ids}, timeout=90, retries=4)
-
-          # vérif post-apply (anti "timeout mais appliqué")
-          post = jreq("GET", f"{api}/repos/{owner}/{repo}/issues/{number}/labels", timeout=60) or []
-          post_ids = {int(x.get("id")) for x in post if x.get("id") is not None}
-
-          missing_ids = [i for i in wanted_ids if i not in post_ids]
-          if missing_ids:
-              raise RuntimeError(f"Labels not applied after PUT (missing ids): {missing_ids}")
+          try:
+              jreq("PUT", url, {"labels": final_ids})
+          except Exception:
+              jreq("PUT", url, final_ids)
 
           print(f"OK labels #{number}: {sorted(desired)}")
           PY

.gitea/workflows/ci.yaml

@@ -3,7 +3,7 @@ name: CI
 on:
   push:
   pull_request:
-    branches: [main]
+    branches: [master]
   workflow_dispatch:
 
 env:
@@ -15,7 +15,7 @@ defaults:
 
 jobs:
   build-and-anchors:
-    runs-on: mac-ci
+    runs-on: ubuntu-latest
     container:
       image: mcr.microsoft.com/devcontainers/javascript-node:22-bookworm
 
@@ -79,7 +79,22 @@ jobs:
           set -euo pipefail
           npm ci
 
-      - name: Full test suite (CI=1)
+      - name: Inline scripts syntax check
         run: |
           set -euo pipefail
-          npm run ci
+          node scripts/check-inline-js.mjs
+
+      - name: Build (includes postbuild injection + pagefind)
+        run: |
+          set -euo pipefail
+          npm run build
+
+      - name: Anchors contract
+        run: |
+          set -euo pipefail
+          npm run test:anchors
+
+      - name: Verify anchor aliases injected in dist
+        run: |
+          set -euo pipefail
+          node scripts/verify-anchor-aliases-in-dist.mjs

.gitea/workflows/ci.yml

@@ -0,0 +1,103 @@
+name: CI
+
+on:
+  push: {}
+  pull_request:
+    branches: ["master"]
+  workflow_dispatch: {}
+
+env:
+  NODE_OPTIONS: --dns-result-order=ipv4first
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  build-and-anchors:
+    runs-on: ubuntu-latest
+    container:
+      image: mcr.microsoft.com/devcontainers/javascript-node:22-bookworm
+
+    steps:
+      - name: Tools sanity
+        run: |
+          set -euo pipefail
+          git --version
+          node --version
+          npm --version
+          npm ping --registry=https://registry.npmjs.org
+
+      - name: Checkout (from event.json, no external actions)
+        run: |
+          set -euo pipefail
+          EVENT_JSON="/var/run/act/workflow/event.json"
+          test -f "$EVENT_JSON" || (echo "❌ Missing $EVENT_JSON" && exit 1)
+
+          eval "$(node - <<'NODE'
+          import fs from "node:fs";
+          const ev = JSON.parse(fs.readFileSync("/var/run/act/workflow/event.json","utf8"));
+          const repo =
+            ev?.repository?.clone_url ||
+            (ev?.repository?.html_url ? (ev.repository.html_url.replace(/\/$/,'') + ".git") : "");
+          const sha =
+            ev?.after ||
+            ev?.pull_request?.head?.sha ||
+            ev?.head_commit?.id ||
+            ev?.sha ||
+            "";
+          if (!repo) { console.error("No repository.clone_url/html_url in event.json"); process.exit(1); }
+          if (!sha)  { console.error("No sha/after/pull_request.head.sha in event.json"); process.exit(1); }
+          console.log(`REPO_URL=${JSON.stringify(repo)}`);
+          console.log(`SHA=${JSON.stringify(sha)}`);
+NODE
+          )"
+
+          echo "Repo URL: $REPO_URL"
+          echo "SHA:      $SHA"
+
+          rm -rf .git
+          git init
+          git remote add origin "$REPO_URL"
+          git fetch --depth 1 origin "$SHA"
+          git checkout -q FETCH_HEAD
+          git log -1 --oneline
+
+      - name: Anchor aliases schema
+        run: |
+          set -euo pipefail
+          node scripts/check-anchor-aliases.mjs
+
+      - name: NPM harden
+        run: |
+          set -euo pipefail
+          npm config set fetch-retries 5
+          npm config set fetch-retry-mintimeout 20000
+          npm config set fetch-retry-maxtimeout 120000
+          npm config set registry https://registry.npmjs.org
+          npm config get registry
+
+      - name: Install deps
+        run: |
+          set -euo pipefail
+          npm ci
+
+      - name: Inline scripts syntax check
+        run: |
+          set -euo pipefail
+          node scripts/check-inline-js.mjs
+
+      - name: Build (includes postbuild injection + pagefind)
+        run: |
+          set -euo pipefail
+          npm run build
+
+      - name: Anchors contract
+        run: |
+          set -euo pipefail
+          npm run test:anchors
+
+      - name: Verify anchor aliases injected in dist
+        run: |
+          set -euo pipefail
+          node scripts/verify-anchor-aliases-in-dist.mjs

.gitea/workflows/deploy-staging-live.yml

@@ -1,577 +0,0 @@
-name: Deploy staging+live (annotations)
-
-on:
-  push:
-    branches: [main]
-  workflow_dispatch:
-    inputs:
-      force:
-        description: "Force FULL deploy (rebuild+restart) even if gate would hotpatch-only (1=yes, 0=no)"
-        required: false
-        default: "0"
-
-env:
-  NODE_OPTIONS: --dns-result-order=ipv4first
-  DOCKER_API_VERSION: "1.43"
-  COMPOSE_VERSION: "2.29.7"
-  ASTRO_TELEMETRY_DISABLED: "1"
-
-defaults:
-  run:
-    shell: bash
-
-concurrency:
-  group: deploy-staging-live-main
-  cancel-in-progress: false
-
-jobs:
-  deploy:
-    runs-on: nas-deploy
-    container:
-      image: localhost:5000/archicratie/nas-deploy-node22@sha256:fefa8bb307005cebec07796661ab25528dc319c33a8f1e480e1d66f90cd5cff6
-
-    steps:
-      - name: Tools sanity
-        run: |
-          set -euo pipefail
-          git --version
-          node --version
-          npm --version
-
-      - name: Checkout (push or workflow_dispatch, no external actions)
-        env:
-          EVENT_JSON: /var/run/act/workflow/event.json
-        run: |
-          set -euo pipefail
-          test -f "$EVENT_JSON" || { echo "❌ Missing $EVENT_JSON"; exit 1; }
-
-          node --input-type=module <<'NODE'
-          import fs from "node:fs";
-
-          const ev = JSON.parse(fs.readFileSync(process.env.EVENT_JSON, "utf8"));
-          const repoObj = ev?.repository || {};
-
-          const cloneUrl =
-            repoObj?.clone_url ||
-            (repoObj?.html_url ? (repoObj.html_url.replace(/\/$/,"") + ".git") : "");
-          if (!cloneUrl) throw new Error("No repository clone_url/html_url in event.json");
-
-          const defaultBranch = repoObj?.default_branch || "main";
-
-          // Push-range (most reliable for change detection)
-          const before = String(ev?.before || "").trim();
-          const after =
-            (process.env.GITHUB_SHA && String(process.env.GITHUB_SHA).trim()) ||
-            String(ev?.after || ev?.sha || ev?.head_commit?.id || ev?.pull_request?.head?.sha || "").trim();
-
-          const shq = (s) => "'" + String(s).replace(/'/g, "'\\''") + "'";
-
-          fs.writeFileSync("/tmp/deploy.env", [
-            `REPO_URL=${shq(cloneUrl)}`,
-            `DEFAULT_BRANCH=${shq(defaultBranch)}`,
-            `BEFORE=${shq(before)}`,
-            `AFTER=${shq(after)}`
-          ].join("\n") + "\n");
-          NODE
-
-          source /tmp/deploy.env
-          echo "Repo URL:       $REPO_URL"
-          echo "Default branch: $DEFAULT_BRANCH"
-          echo "BEFORE:         ${BEFORE:-<empty>}"
-          echo "AFTER:          ${AFTER:-<empty>}"
-
-          rm -rf .git
-          git init -q
-          git remote add origin "$REPO_URL"
-
-          # Checkout AFTER (or default branch if missing)
-          if [[ -n "${AFTER:-}" ]]; then
-            git fetch --depth 50 origin "$AFTER"
-            git -c advice.detachedHead=false checkout -q FETCH_HEAD
-          else
-            git fetch --depth 50 origin "$DEFAULT_BRANCH"
-            git -c advice.detachedHead=false checkout -q "origin/$DEFAULT_BRANCH"
-            AFTER="$(git rev-parse HEAD)"
-            echo "AFTER='$AFTER'" >> /tmp/deploy.env
-            echo "Resolved AFTER: $AFTER"
-          fi
-
-          git log -1 --oneline
-
-      - name: Gate — decide SKIP vs HOTPATCH vs FULL rebuild
-        env:
-          INPUT_FORCE: ${{ inputs.force }}
-          EVENT_JSON: /var/run/act/workflow/event.json
-        run: |
-          set -euo pipefail
-          source /tmp/deploy.env
-
-          FORCE="${INPUT_FORCE:-0}"
-
-          # Lire before/after du push depuis event.json (merge-proof)
-          node --input-type=module <<'NODE'
-          import fs from "node:fs";
-          const ev = JSON.parse(fs.readFileSync(process.env.EVENT_JSON, "utf8"));
-          const before = ev?.before || "";
-          const after  = ev?.after  || ev?.sha || "";
-          const shq = (s) => "'" + String(s).replace(/'/g, "'\\''") + "'";
-          fs.writeFileSync("/tmp/gate.env", [
-            `EV_BEFORE=${shq(before)}`,
-            `EV_AFTER=${shq(after)}`
-          ].join("\n") + "\n");
-          NODE
-
-          source /tmp/gate.env
-
-          BEFORE="${EV_BEFORE:-}"
-          AFTER="${EV_AFTER:-}"
-          if [[ -z "${AFTER:-}" ]]; then
-            AFTER="${SHA:-}"
-          fi
-
-          echo "Gate ctx: BEFORE=${BEFORE:-<empty>} AFTER=${AFTER:-<empty>} FORCE=${FORCE}"
-
-          # Produire une liste CHANGED fiable :
-          # - si BEFORE/AFTER valides -> git diff before..after
-          # - sinon fallback -> diff parent1..after ou show after
-          CHANGED=""
-          Z40="0000000000000000000000000000000000000000"
-
-          if [[ -n "${BEFORE:-}" && "${BEFORE}" != "${Z40}" ]] \
-             && git cat-file -e "${BEFORE}^{commit}" 2>/dev/null \
-             && git cat-file -e "${AFTER}^{commit}"  2>/dev/null; then
-            CHANGED="$(git diff --name-only "${BEFORE}" "${AFTER}" || true)"
-          else
-            P1="$(git rev-parse "${AFTER}^" 2>/dev/null || true)"
-            if [[ -n "${P1:-}" ]] && git cat-file -e "${P1}^{commit}" 2>/dev/null; then
-              CHANGED="$(git diff --name-only "${P1}" "${AFTER}" || true)"
-            else
-              CHANGED="$(git show --name-only --pretty="" "${AFTER}" | sed '/^$/d' || true)"
-            fi
-          fi
-
-          printf "%s\n" "${CHANGED}" > /tmp/changed.txt
-
-          echo "== changed files (first 200) =="
-          sed -n '1,200p' /tmp/changed.txt || true
-
-          # Flags
-          HAS_FULL=0
-          HAS_HOTPATCH=0
-
-          # HOTPATCH si annotations/media touchés
-          if grep -qE '^(src/annotations/|public/media/)' /tmp/changed.txt; then
-            HAS_HOTPATCH=1
-          fi
-
-          # FULL si build-impacting (robuste)
-          # 1) Tout src/ SAUF src/annotations/
-          if grep -qE '^src/' /tmp/changed.txt && grep -qEv '^src/annotations/' /tmp/changed.txt; then
-            HAS_FULL=1
-          fi
-
-          # 2) scripts/
-          if grep -qE '^scripts/' /tmp/changed.txt; then
-            HAS_FULL=1
-          fi
-
-          # 3) Tout public/ SAUF public/media/
-          if grep -qE '^public/' /tmp/changed.txt && grep -qEv '^public/media/' /tmp/changed.txt; then
-            HAS_FULL=1
-          fi
-
-          # 4) fichiers racine qui changent le build / l’image
-          if grep -qE '^(package\.json|package-lock\.json|astro\.config\.mjs|tsconfig\.json|\.npmrc|\.nvmrc|Dockerfile|docker-compose\.yml|nginx\.conf)$' /tmp/changed.txt; then
-            HAS_FULL=1
-          fi
-
-          echo "Gate flags: HAS_FULL=${HAS_FULL} HAS_HOTPATCH=${HAS_HOTPATCH}"
-
-          # Décision
-          if [[ "${FORCE}" == "1" ]]; then
-            GO=1
-            MODE="full"
-            echo "✅ force=1 -> MODE=full (rebuild+restart)"
-          elif [[ "${HAS_FULL}" == "1" ]]; then
-            GO=1
-            MODE="full"
-            echo "✅ build-impacting change -> MODE=full (rebuild+restart)"
-          elif [[ "${HAS_HOTPATCH}" == "1" ]]; then
-            GO=1
-            MODE="hotpatch"
-            echo "✅ annotations/media change -> MODE=hotpatch"
-          else
-            GO=0
-            MODE="skip"
-            echo "ℹ️ no relevant change -> skip deploy"
-          fi
-
-          echo "GO=${GO}" >> /tmp/deploy.env
-          echo "MODE='${MODE}'" >> /tmp/deploy.env
-
-      - name: Toolchain sanity + resolve COMPOSE_PROJECT_NAME
-        run: |
-          set -euo pipefail
-          source /tmp/deploy.env
-          [[ "${GO:-0}" == "1" ]] || { echo "ℹ️ skipped"; exit 0; }
-
-          # tools are prebaked in the image
-          git --version
-          docker version
-          docker compose version
-          python3 -c 'import yaml; print("PyYAML OK")'
-
-          # Reuse existing compose project name if containers already exist
-          PROJ="$(docker inspect archicratie-web-blue --format '{{ index .Config.Labels "com.docker.compose.project" }}' 2>/dev/null || true)"
-          if [[ -z "${PROJ:-}" ]]; then
-            PROJ="$(docker inspect archicratie-web-green --format '{{ index .Config.Labels "com.docker.compose.project" }}' 2>/dev/null || true)"
-          fi
-          if [[ -z "${PROJ:-}" ]]; then PROJ="archicratie-web"; fi
-          echo "COMPOSE_PROJECT_NAME='$PROJ'" >> /tmp/deploy.env
-          echo "✅ Using COMPOSE_PROJECT_NAME=$PROJ"
-
-          # Assert target containers exist (hotpatch needs them)
-          for c in archicratie-web-blue archicratie-web-green; do
-            docker inspect "$c" >/dev/null 2>&1 || { echo "❌ missing container $c"; exit 5; }
-          done
-
-      - name: Assert required vars (PUBLIC_GITEA_*) — only needed for MODE=full
-        env:
-          PUBLIC_GITEA_BASE: ${{ vars.PUBLIC_GITEA_BASE }}
-          PUBLIC_GITEA_OWNER: ${{ vars.PUBLIC_GITEA_OWNER }}
-          PUBLIC_GITEA_REPO: ${{ vars.PUBLIC_GITEA_REPO }}
-        run: |
-          set -euo pipefail
-          source /tmp/deploy.env
-          [[ "${GO:-0}" == "1" ]] || { echo "ℹ️ skipped"; exit 0; }
-          [[ "${MODE:-hotpatch}" == "full" ]] || { echo "ℹ️ hotpatch mode -> vars not required"; exit 0; }
-
-          test -n "${PUBLIC_GITEA_BASE:-}"  || { echo "❌ missing repo var PUBLIC_GITEA_BASE"; exit 2; }
-          test -n "${PUBLIC_GITEA_OWNER:-}" || { echo "❌ missing repo var PUBLIC_GITEA_OWNER"; exit 2; }
-          test -n "${PUBLIC_GITEA_REPO:-}"  || { echo "❌ missing repo var PUBLIC_GITEA_REPO"; exit 2; }
-          echo "✅ vars OK"
-
-      - name: Assert deploy files exist — only needed for MODE=full
-        run: |
-          set -euo pipefail
-          source /tmp/deploy.env
-          [[ "${GO:-0}" == "1" ]] || { echo "ℹ️ skipped"; exit 0; }
-          [[ "${MODE:-hotpatch}" == "full" ]] || { echo "ℹ️ hotpatch mode -> files not required"; exit 0; }
-
-          test -f docker-compose.yml
-          test -f Dockerfile
-          test -f nginx.conf
-          echo "✅ deploy files OK"
-
-      - name: FULL — Build + deploy staging (blue) then warmup+smoke
-        env:
-          PUBLIC_GITEA_BASE: ${{ vars.PUBLIC_GITEA_BASE }}
-          PUBLIC_GITEA_OWNER: ${{ vars.PUBLIC_GITEA_OWNER }}
-          PUBLIC_GITEA_REPO: ${{ vars.PUBLIC_GITEA_REPO }}
-        run: |
-          set -euo pipefail
-          source /tmp/deploy.env
-          [[ "${GO:-0}" == "1" ]] || { echo "ℹ️ skipped"; exit 0; }
-          [[ "${MODE:-hotpatch}" == "full" ]] || { echo "ℹ️ MODE=$MODE -> skip full rebuild"; exit 0; }
-
-          PROJ="${COMPOSE_PROJECT_NAME:-archicratie-web}"
-
-          wait_url() {
-            local url="$1"
-            local label="$2"
-            local tries="${3:-60}"
-            for i in $(seq 1 "$tries"); do
-              if curl -fsS --max-time 4 "$url" >/dev/null; then
-                echo "✅ $label OK ($url)"
-                return 0
-              fi
-              echo "… warmup $label ($i/$tries)"
-              sleep 1
-            done
-            echo "❌ timeout $label ($url)"
-            return 1
-          }
-
-          TS="$(date -u +%Y%m%d-%H%M%S)"
-          echo "TS='$TS'" >> /tmp/deploy.env
-          docker image tag archicratie-web:blue  "archicratie-web:blue.BAK.${TS}"  || true
-          docker image tag archicratie-web:green "archicratie-web:green.BAK.${TS}" || true
-
-          docker compose -p "$PROJ" -f docker-compose.yml build web_blue
-          docker rm -f archicratie-web-blue || true
-          docker compose -p "$PROJ" -f docker-compose.yml up -d --force-recreate --remove-orphans web_blue
-
-          # warmup endpoints
-          wait_url "http://127.0.0.1:8081/para-index.json"        "blue para-index"
-          wait_url "http://127.0.0.1:8081/annotations-index.json" "blue annotations-index"
-          wait_url "http://127.0.0.1:8081/pagefind/pagefind.js"   "blue pagefind.js"
-
-          CANON="$(curl -fsS --max-time 6 "http://127.0.0.1:8081/archicrat-ia/chapitre-1/" | grep -oE 'rel="canonical" href="[^"]+"' | head -n1 || true)"
-          echo "canonical(blue)=$CANON"
-          echo "$CANON" | grep -q 'https://staging\.archicratie\.trans-hands\.synology\.me/' || {
-            echo "❌ staging canonical mismatch"
-            docker logs --tail 120 archicratie-web-blue || true
-            exit 3
-          }
-
-          echo "✅ staging OK"
-
-      - name: FULL — Build + deploy live (green) then warmup+smoke + rollback if needed
-        env:
-          PUBLIC_GITEA_BASE: ${{ vars.PUBLIC_GITEA_BASE }}
-          PUBLIC_GITEA_OWNER: ${{ vars.PUBLIC_GITEA_OWNER }}
-          PUBLIC_GITEA_REPO: ${{ vars.PUBLIC_GITEA_REPO }}
-        run: |
-          set -euo pipefail
-          source /tmp/deploy.env
-          [[ "${GO:-0}" == "1" ]] || { echo "ℹ️ skipped"; exit 0; }
-          [[ "${MODE:-hotpatch}" == "full" ]] || { echo "ℹ️ MODE=$MODE -> skip full rebuild"; exit 0; }
-
-          PROJ="${COMPOSE_PROJECT_NAME:-archicratie-web}"
-          TS="${TS:-$(date -u +%Y%m%d-%H%M%S)}"
-
-          wait_url() {
-            local url="$1"
-            local label="$2"
-            local tries="${3:-60}"
-            for i in $(seq 1 "$tries"); do
-              if curl -fsS --max-time 4 "$url" >/dev/null; then
-                echo "✅ $label OK ($url)"
-                return 0
-              fi
-              echo "… warmup $label ($i/$tries)"
-              sleep 1
-            done
-            echo "❌ timeout $label ($url)"
-            return 1
-          }
-
-          rollback() {
-            echo "⚠️ rollback green -> previous image tag (best effort)"
-            docker image tag "archicratie-web:green.BAK.${TS}" archicratie-web:green || true
-            docker rm -f archicratie-web-green || true
-            docker compose -p "$PROJ" -f docker-compose.yml up -d --force-recreate --remove-orphans web_green || true
-          }
-
-          # build/restart green
-          if ! docker compose -p "$PROJ" -f docker-compose.yml build web_green; then
-            echo "❌ build green failed"; rollback; exit 4
-          fi
-
-          docker rm -f archicratie-web-green || true
-          docker compose -p "$PROJ" -f docker-compose.yml up -d --force-recreate --remove-orphans web_green
-
-          # warmup endpoints
-          if ! wait_url "http://127.0.0.1:8082/para-index.json"        "green para-index"; then rollback; exit 4; fi
-          if ! wait_url "http://127.0.0.1:8082/annotations-index.json" "green annotations-index"; then rollback; exit 4; fi
-          if ! wait_url "http://127.0.0.1:8082/pagefind/pagefind.js"   "green pagefind.js"; then rollback; exit 4; fi
-
-          CANON="$(curl -fsS --max-time 6 "http://127.0.0.1:8082/archicrat-ia/chapitre-1/" | grep -oE 'rel="canonical" href="[^"]+"' | head -n1 || true)"
-          echo "canonical(green)=$CANON"
-          echo "$CANON" | grep -q 'https://archicratie\.trans-hands\.synology\.me/' || {
-            echo "❌ live canonical mismatch"
-            docker logs --tail 120 archicratie-web-green || true
-            rollback
-            exit 4
-          }
-
-          echo "✅ live OK"
-
-      - name: HOTPATCH — deep merge shards -> annotations-index + copy changed media into blue+green
-        run: |
-          set -euo pipefail
-          source /tmp/deploy.env
-          [[ "${GO:-0}" == "1" ]] || { echo "ℹ️ skipped"; exit 0; }
-
-          python3 - <<'PY'
-          import os, re, json, glob
-          import yaml
-          import datetime as dt
-
-          ROOT = os.getcwd()
-          ANNO_ROOT = os.path.join(ROOT, "src", "annotations")
-
-          def is_obj(x): return isinstance(x, dict)
-          def is_arr(x): return isinstance(x, list)
-
-          def iso_dt(x):
-            if isinstance(x, dt.datetime):
-              if x.tzinfo is None:
-                return x.isoformat()
-              return x.astimezone(dt.timezone.utc).isoformat().replace("+00:00","Z")
-            if isinstance(x, dt.date):
-              return x.isoformat()
-            return None
-
-          def normalize(x):
-            s = iso_dt(x)
-            if s is not None: return s
-            if isinstance(x, dict):
-              return {str(k): normalize(v) for k, v in x.items()}
-            if isinstance(x, list):
-              return [normalize(v) for v in x]
-            return x
-
-          def key_media(it): return str((it or {}).get("src",""))
-          def key_ref(it):
-            it = it or {}
-            return "||".join([str(it.get("url","")), str(it.get("label","")), str(it.get("kind","")), str(it.get("citation",""))])
-          def key_comment(it): return str((it or {}).get("text","")).strip()
-
-          def dedup_extend(dst_list, src_list, key_fn):
-            seen = set(); out = []
-            for x in (dst_list or []):
-              x = normalize(x); k = key_fn(x)
-              if k and k not in seen: seen.add(k); out.append(x)
-            for x in (src_list or []):
-              x = normalize(x); k = key_fn(x)
-              if k and k not in seen: seen.add(k); out.append(x)
-            return out
-
-          def deep_merge(dst, src):
-            src = normalize(src)
-            for k, v in (src or {}).items():
-              if k in ("media","refs","comments_editorial") and is_arr(v):
-                if k == "media": dst[k] = dedup_extend(dst.get(k, []), v, key_media)
-                elif k == "refs": dst[k] = dedup_extend(dst.get(k, []), v, key_ref)
-                else: dst[k] = dedup_extend(dst.get(k, []), v, key_comment)
-                continue
-
-              if is_obj(v):
-                if not is_obj(dst.get(k)): dst[k] = {}
-                deep_merge(dst[k], v)
-                continue
-
-              if is_arr(v):
-                cur = dst.get(k, [])
-                if not is_arr(cur): cur = []
-                seen = set(); out = []
-                for x in cur:
-                  x = normalize(x)
-                  s = json.dumps(x, sort_keys=True, ensure_ascii=False)
-                  if s not in seen: seen.add(s); out.append(x)
-                for x in v:
-                  x = normalize(x)
-                  s = json.dumps(x, sort_keys=True, ensure_ascii=False)
-                  if s not in seen: seen.add(s); out.append(x)
-                dst[k] = out
-                continue
-
-              v = normalize(v)
-              if k not in dst or dst.get(k) in (None, ""):
-                dst[k] = v
-
-          def para_num(pid):
-            m = re.match(r"^p-(\d+)-", str(pid))
-            return int(m.group(1)) if m else 10**9
-
-          def sort_lists(entry):
-            for k in ("media","refs","comments_editorial"):
-              arr = entry.get(k)
-              if not is_arr(arr): continue
-              def ts(x):
-                x = normalize(x)
-                try:
-                  s = str((x or {}).get("ts",""))
-                  return dt.datetime.fromisoformat(s.replace("Z","+00:00")).timestamp() if s else 0
-                except Exception:
-                  return 0
-              arr = [normalize(x) for x in arr]
-              arr.sort(key=lambda x: (ts(x), json.dumps(x, sort_keys=True, ensure_ascii=False)))
-              entry[k] = arr
-
-          if not os.path.isdir(ANNO_ROOT):
-            raise SystemExit(f"Missing annotations root: {ANNO_ROOT}")
-
-          pages = {}
-          errors = []
-
-          files = sorted(glob.glob(os.path.join(ANNO_ROOT, "**", "*.yml"), recursive=True))
-          for fp in files:
-            try:
-              with open(fp, "r", encoding="utf-8") as f:
-                doc = yaml.safe_load(f) or {}
-              doc = normalize(doc)
-              if not isinstance(doc, dict) or doc.get("schema") != 1:
-                continue
-
-              page = str(doc.get("page","")).strip().strip("/")
-              paras = doc.get("paras") or {}
-              if not page or not isinstance(paras, dict):
-                continue
-
-              pg = pages.setdefault(page, {"paras": {}})
-              for pid, entry in paras.items():
-                pid = str(pid)
-                if pid not in pg["paras"] or not isinstance(pg["paras"].get(pid), dict):
-                  pg["paras"][pid] = {}
-                if isinstance(entry, dict):
-                  deep_merge(pg["paras"][pid], entry)
-                sort_lists(pg["paras"][pid])
-
-            except Exception as e:
-              errors.append({"file": os.path.relpath(fp, ROOT), "error": str(e)})
-
-          for page, obj in pages.items():
-            keys = list((obj.get("paras") or {}).keys())
-            keys.sort(key=lambda k: (para_num(k), k))
-            obj["paras"] = {k: obj["paras"][k] for k in keys}
-
-          out = {
-            "schema": 1,
-            "generatedAt": dt.datetime.utcnow().replace(tzinfo=dt.timezone.utc).isoformat().replace("+00:00","Z"),
-            "pages": pages,
-            "stats": {
-              "pages": len(pages),
-              "paras": sum(len(v.get("paras") or {}) for v in pages.values()),
-              "errors": len(errors),
-            },
-            "errors": errors,
-          }
-
-          with open("/tmp/annotations-index.json", "w", encoding="utf-8") as f:
-            json.dump(out, f, ensure_ascii=False)
-
-          print("OK: wrote /tmp/annotations-index.json pages=", out["stats"]["pages"], "paras=", out["stats"]["paras"], "errors=", out["stats"]["errors"])
-          PY
-
-          # patch JSON into running containers
-          for c in archicratie-web-blue archicratie-web-green; do
-            echo "== patch annotations-index.json into $c =="
-            docker cp /tmp/annotations-index.json "${c}:/usr/share/nginx/html/annotations-index.json"
-          done
-
-          # copy changed media files into containers (so new media appears without rebuild)
-          if [[ -s /tmp/changed.txt ]]; then
-            while IFS= read -r f; do
-              [[ -n "$f" ]] || continue
-              if [[ "$f" == public/media/* ]]; then
-                dest="/usr/share/nginx/html/${f#public/}"   # => /usr/share/nginx/html/media/...
-                for c in archicratie-web-blue archicratie-web-green; do
-                  echo "== copy media into $c: $f -> $dest =="
-                  docker exec "$c" sh -lc "mkdir -p \"$(dirname "$dest")\""
-                  docker cp "$f" "$c:$dest"
-                done
-              fi
-            done < /tmp/changed.txt
-          fi
-
-          # smoke after patch
-          for p in 8081 8082; do
-            echo "== smoke annotations-index on $p =="
-            curl -fsS --max-time 6 "http://127.0.0.1:${p}/annotations-index.json" \
-              | python3 -c 'import sys,json; j=json.load(sys.stdin); print("generatedAt:", j.get("generatedAt")); print("pages:", len(j.get("pages") or {})); print("paras:", j.get("stats",{}).get("paras"))'
-          done
-
-          echo "✅ hotpatch done"
-
-      - name: Debug on failure (containers status/logs)
-        if: ${{ failure() }}
-        run: |
-          set -euo pipefail
-          echo "== docker ps =="
-          docker ps --format 'table {{.Names}}\t{{.Status}}\t{{.Image}}' | sed -n '1,80p' || true
-          for c in archicratie-web-blue archicratie-web-green; do
-            echo "== logs $c (tail 200) =="
-            docker logs --tail 200 "$c" || true
-          done

.gitea/workflows/proposer-apply-pr.yml

@@ -1,395 +0,0 @@
-name: Proposer Apply (PR)
-
-on:
-  issues:
-    types: [labeled]
-  workflow_dispatch:
-    inputs:
-      issue:
-        description: "Issue number to apply (Proposer: correction/fact-check)"
-        required: true
-
-env:
-  NODE_OPTIONS: --dns-result-order=ipv4first
-
-defaults:
-  run:
-    shell: bash
-
-concurrency:
-  group: proposer-apply-${{ github.event.issue.number || inputs.issue || 'manual' }}
-  cancel-in-progress: true
-
-jobs:
-  apply-proposer:
-    runs-on: mac-ci
-    container:
-      image: mcr.microsoft.com/devcontainers/javascript-node:22-bookworm
-
-    steps:
-      - name: Tools sanity
-        run: |
-          set -euo pipefail
-          git --version
-          node --version
-          npm --version
-
-      - name: Derive context (event.json / workflow_dispatch)
-        env:
-          INPUT_ISSUE: ${{ inputs.issue }}
-          FORGE_API: ${{ vars.FORGE_API || vars.FORGE_BASE }}
-        run: |
-          set -euo pipefail
-          export EVENT_JSON="/var/run/act/workflow/event.json"
-          test -f "$EVENT_JSON" || { echo "❌ Missing $EVENT_JSON"; exit 1; }
-
-          node --input-type=module - <<'NODE' > /tmp/proposer.env
-          import fs from "node:fs";
-
-          const ev = JSON.parse(fs.readFileSync(process.env.EVENT_JSON, "utf8"));
-          const repoObj = ev?.repository || {};
-
-          const cloneUrl =
-            repoObj?.clone_url ||
-            (repoObj?.html_url ? (repoObj.html_url.replace(/\/$/,"") + ".git") : "");
-
-          if (!cloneUrl) throw new Error("No repository clone_url/html_url in event.json");
-
-          let owner =
-            repoObj?.owner?.login ||
-            repoObj?.owner?.username ||
-            (repoObj?.full_name ? repoObj.full_name.split("/")[0] : "");
-
-          let repo =
-            repoObj?.name ||
-            (repoObj?.full_name ? repoObj.full_name.split("/")[1] : "");
-
-          if (!owner || !repo) {
-            const m = cloneUrl.match(/[:/](?<o>[^/]+)\/(?<r>[^/]+?)(?:\.git)?$/);
-            if (m?.groups) { owner = owner || m.groups.o; repo = repo || m.groups.r; }
-          }
-          if (!owner || !repo) throw new Error("Cannot infer owner/repo");
-
-          const defaultBranch = repoObj?.default_branch || "main";
-
-          const issueNumber =
-            ev?.issue?.number ||
-            ev?.issue?.index ||
-            (process.env.INPUT_ISSUE ? Number(process.env.INPUT_ISSUE) : 0);
-
-          if (!issueNumber || !Number.isFinite(Number(issueNumber))) {
-            throw new Error("No issue number in event.json or workflow_dispatch input");
-          }
-
-          const labelName =
-            ev?.label?.name ||
-            ev?.label ||
-            "workflow_dispatch";
-
-          const u = new URL(cloneUrl);
-          const origin = u.origin;
-
-          const apiBase = (process.env.FORGE_API && String(process.env.FORGE_API).trim())
-            ? String(process.env.FORGE_API).trim().replace(/\/+$/,"")
-            : origin;
-
-          function sh(s){ return JSON.stringify(String(s)); }
-          process.stdout.write([
-            `CLONE_URL=${sh(cloneUrl)}`,
-            `OWNER=${sh(owner)}`,
-            `REPO=${sh(repo)}`,
-            `DEFAULT_BRANCH=${sh(defaultBranch)}`,
-            `ISSUE_NUMBER=${sh(issueNumber)}`,
-            `LABEL_NAME=${sh(labelName)}`,
-            `API_BASE=${sh(apiBase)}`
-          ].join("\n") + "\n");
-          NODE
-
-          echo "✅ context:"
-          sed -n '1,120p' /tmp/proposer.env
-
-      - name: Gate on label state/approved
-        run: |
-          set -euo pipefail
-          source /tmp/proposer.env
-
-          if [[ "$LABEL_NAME" != "state/approved" && "$LABEL_NAME" != "workflow_dispatch" ]]; then
-            echo "ℹ️ label=$LABEL_NAME => skip"
-            echo "SKIP=1" >> /tmp/proposer.env
-            exit 0
-          fi
-          echo "✅ proceed (issue=$ISSUE_NUMBER)"
-
-      - name: Fetch issue + API-hard gate on (state/approved present + proposer type)
-        env:
-          FORGE_TOKEN: ${{ secrets.FORGE_TOKEN }}
-        run: |
-          set -euo pipefail
-          source /tmp/proposer.env
-          [[ "${SKIP:-0}" != "1" ]] || { echo "ℹ️ skipped"; exit 0; }
-
-          test -n "${FORGE_TOKEN:-}" || { echo "❌ Missing secret FORGE_TOKEN"; exit 1; }
-
-          curl -fsS \
-            -H "Authorization: token $FORGE_TOKEN" \
-            -H "Accept: application/json" \
-            "$API_BASE/api/v1/repos/$OWNER/$REPO/issues/$ISSUE_NUMBER" \
-            -o /tmp/issue.json
-
-          node --input-type=module - <<'NODE' >> /tmp/proposer.env
-          import fs from "node:fs";
-          const issue = JSON.parse(fs.readFileSync("/tmp/issue.json","utf8"));
-          const title = String(issue.title || "");
-          const body = String(issue.body || "").replace(/\r\n/g, "\n");
-          const labels = Array.isArray(issue.labels) ? issue.labels.map(l => String(l.name||"")).filter(Boolean) : [];
-
-          function pickLine(key) {
-            const re = new RegExp(`^\\s*${key}\\s*:\\s*([^\\n\\r]+)`, "mi");
-            const m = body.match(re);
-            return m ? m[1].trim() : "";
-          }
-
-          const typeRaw = pickLine("Type");
-          const type = String(typeRaw || "").trim().toLowerCase();
-
-          const hasApproved = labels.includes("state/approved");
-          const proposer = new Set(["type/correction","type/fact-check"]);
-
-          const out = [];
-          out.push(`ISSUE_TITLE=${JSON.stringify(title)}`);
-          out.push(`ISSUE_TYPE=${JSON.stringify(type)}`);
-          out.push(`HAS_APPROVED=${hasApproved ? "1":"0"}`);
-
-          if (!hasApproved) {
-            out.push(`SKIP=1`);
-            out.push(`SKIP_REASON=${JSON.stringify("approved_not_present")}`);
-          } else if (!type) {
-            out.push(`SKIP=1`);
-            out.push(`SKIP_REASON=${JSON.stringify("missing_type")}`);
-          } else if (!proposer.has(type)) {
-            out.push(`SKIP=1`);
-            out.push(`SKIP_REASON=${JSON.stringify("not_proposer:"+type)}`);
-          }
-          process.stdout.write(out.join("\n") + "\n");
-          NODE
-
-          echo "✅ proposer gating:"
-          grep -E '^(ISSUE_TYPE|HAS_APPROVED|SKIP|SKIP_REASON)=' /tmp/proposer.env || true
-
-      - name: Comment issue if skipped
-        if: ${{ always() }}
-        env:
-          FORGE_TOKEN: ${{ secrets.FORGE_TOKEN }}
-        run: |
-          set -euo pipefail
-          source /tmp/proposer.env || true
-
-          [[ "${SKIP:-0}" == "1" ]] || exit 0
-          [[ "$LABEL_NAME" == "state/approved" || "$LABEL_NAME" == "workflow_dispatch" ]] || exit 0
-
-          REASON="${SKIP_REASON:-}"
-          TYPE="${ISSUE_TYPE:-}"
-
-          if [[ "$REASON" == "approved_not_present" ]]; then
-            MSG="ℹ️ Proposer Apply: skip — le label **state/approved** n'est pas présent sur le ticket au moment du run (gate API-hard)."
-          elif [[ "$REASON" == "missing_type" ]]; then
-            MSG="ℹ️ Proposer Apply: skip — champ **Type:** manquant/illisible. Attendu: type/correction ou type/fact-check."
-          else
-            MSG="ℹ️ Proposer Apply: skip — Type non-Proposer (${TYPE}). (Ce workflow ne traite que correction/fact-check.)"
-          fi
-
-          PAYLOAD="$(node --input-type=module -e 'console.log(JSON.stringify({body: process.argv[1]||""}))' "$MSG")"
-          curl -fsS -X POST \
-            -H "Authorization: token $FORGE_TOKEN" \
-            -H "Content-Type: application/json" \
-            "$API_BASE/api/v1/repos/$OWNER/$REPO/issues/$ISSUE_NUMBER/comments" \
-            --data-binary "$PAYLOAD" || true
-
-      - name: Checkout default branch
-        run: |
-          set -euo pipefail
-          source /tmp/proposer.env
-          [[ "${SKIP:-0}" != "1" ]] || { echo "ℹ️ skipped"; exit 0; }
-
-          rm -rf .git
-          git init -q
-          git remote add origin "$CLONE_URL"
-          git fetch --depth 1 origin "$DEFAULT_BRANCH"
-          git -c advice.detachedHead=false checkout -q FETCH_HEAD
-          git log -1 --oneline
-          echo "✅ workspace:"
-          ls -la | sed -n '1,120p'
-
-      - name: Detect app dir (repo-root vs ./site)
-        run: |
-          set -euo pipefail
-          source /tmp/proposer.env
-          [[ "${SKIP:-0}" != "1" ]] || { echo "ℹ️ skipped"; exit 0; }
-
-          APP_DIR="."
-          if [[ -d "site" && -f "site/package.json" ]]; then
-            APP_DIR="site"
-          fi
-
-          echo "APP_DIR=$APP_DIR" >> /tmp/proposer.env
-          echo "✅ APP_DIR=$APP_DIR"
-          ls -la "$APP_DIR" | sed -n '1,120p'
-          test -f "$APP_DIR/package.json" || { echo "❌ package.json missing in APP_DIR=$APP_DIR"; exit 1; }
-          test -d "$APP_DIR/scripts" || { echo "❌ scripts/ missing in APP_DIR=$APP_DIR"; exit 1; }
-
-      - name: NPM harden (reduce flakiness)
-        run: |
-          set -euo pipefail
-          source /tmp/proposer.env
-          [[ "${SKIP:-0}" != "1" ]] || exit 0
-          cd "$APP_DIR"
-          npm config set fetch-retries 5
-          npm config set fetch-retry-mintimeout 20000
-          npm config set fetch-retry-maxtimeout 120000
-          npm config set registry https://registry.npmjs.org
-
-      - name: Install deps (APP_DIR)
-        run: |
-          set -euo pipefail
-          source /tmp/proposer.env
-          [[ "${SKIP:-0}" != "1" ]] || { echo "ℹ️ skipped"; exit 0; }
-          cd "$APP_DIR"
-          npm ci --no-audit --no-fund
-
-      - name: Build dist baseline (APP_DIR)
-        run: |
-          set -euo pipefail
-          source /tmp/proposer.env
-          [[ "${SKIP:-0}" != "1" ]] || { echo "ℹ️ skipped"; exit 0; }
-          cd "$APP_DIR"
-          npm run build
-
-      - name: Apply ticket (alias + commit) on bot branch
-        continue-on-error: true
-        env:
-          FORGE_TOKEN: ${{ secrets.FORGE_TOKEN }}
-          BOT_GIT_NAME: ${{ secrets.BOT_GIT_NAME }}
-          BOT_GIT_EMAIL: ${{ secrets.BOT_GIT_EMAIL }}
-          FORGE_API: ${{ vars.FORGE_API || vars.FORGE_BASE }}
-        run: |
-          set -euo pipefail
-          source /tmp/proposer.env
-          [[ "${SKIP:-0}" != "1" ]] || { echo "ℹ️ skipped"; exit 0; }
-
-          git config user.name  "${BOT_GIT_NAME:-archicratie-bot}"
-          git config user.email "${BOT_GIT_EMAIL:-bot@archicratie.local}"
-
-          START_SHA="$(git rev-parse HEAD)"
-          TS="$(date -u +%Y%m%d-%H%M%S)"
-          BR="bot/proposer-${ISSUE_NUMBER}-${TS}"
-          echo "BRANCH=$BR" >> /tmp/proposer.env
-          git checkout -b "$BR"
-
-          export GITEA_OWNER="$OWNER"
-          export GITEA_REPO="$REPO"
-          export FORGE_BASE="$API_BASE"
-
-          LOG="/tmp/proposer-apply.log"
-          set +e
-          (cd "$APP_DIR" && node scripts/apply-ticket.mjs "$ISSUE_NUMBER" --alias --commit) >"$LOG" 2>&1
-          RC=$?
-          set -e
-
-          echo "APPLY_RC=$RC" >> /tmp/proposer.env
-
-          echo "== apply log (tail) =="
-          tail -n 200 "$LOG" || true
-
-          END_SHA="$(git rev-parse HEAD)"
-          if [[ "$RC" -ne 0 ]]; then
-            echo "NOOP=0" >> /tmp/proposer.env
-            exit 0
-          fi
-
-          if [[ "$START_SHA" == "$END_SHA" ]]; then
-            echo "NOOP=1" >> /tmp/proposer.env
-          else
-            echo "NOOP=0" >> /tmp/proposer.env
-            echo "END_SHA=$END_SHA" >> /tmp/proposer.env
-          fi
-
-      - name: Push bot branch
-        if: ${{ always() }}
-        env:
-          FORGE_TOKEN: ${{ secrets.FORGE_TOKEN }}
-        run: |
-          set -euo pipefail
-          source /tmp/proposer.env || true
-          [[ "${SKIP:-0}" != "1" ]] || exit 0
-
-          [[ "${APPLY_RC:-0}" == "0" ]] || { echo "ℹ️ apply failed -> skip push"; exit 0; }
-          [[ "${NOOP:-0}" == "0" ]] || { echo "ℹ️ no-op -> skip push"; exit 0; }
-          [[ -n "${BRANCH:-}" ]] || { echo "ℹ️ BRANCH unset -> skip push"; exit 0; }
-
-          AUTH_URL="$(node --input-type=module -e '
-            const [clone, tok] = process.argv.slice(1);
-            const u = new URL(clone);
-            u.username = "oauth2";
-            u.password = tok;
-            console.log(u.toString());
-          ' "$CLONE_URL" "$FORGE_TOKEN")"
-
-          git remote set-url origin "$AUTH_URL"
-          git push -u origin "$BRANCH"
-
-      - name: Create PR + comment issue
-        if: ${{ always() }}
-        env:
-          FORGE_TOKEN: ${{ secrets.FORGE_TOKEN }}
-        run: |
-          set -euo pipefail
-          source /tmp/proposer.env || true
-          [[ "${SKIP:-0}" != "1" ]] || exit 0
-
-          [[ "${APPLY_RC:-0}" == "0" ]] || exit 0
-          [[ "${NOOP:-0}" == "0" ]] || exit 0
-          [[ -n "${BRANCH:-}" ]] || { echo "ℹ️ BRANCH unset -> skip PR"; exit 0; }
-
-          PR_TITLE="proposer: apply ticket #${ISSUE_NUMBER}"
-          PR_BODY="PR auto depuis ticket #${ISSUE_NUMBER} (state/approved).\n\n- Branche: ${BRANCH}\n- Commit: ${END_SHA:-unknown}\n\nMerge si CI OK."
-
-          PR_PAYLOAD="$(node --input-type=module -e '
-            const [title, body, base, head] = process.argv.slice(1);
-            console.log(JSON.stringify({ title, body, base, head, allow_maintainer_edit: true }));
-          ' "$PR_TITLE" "$PR_BODY" "$DEFAULT_BRANCH" "${OWNER}:${BRANCH}")"
-
-          PR_JSON="$(curl -fsS -X POST \
-            -H "Authorization: token $FORGE_TOKEN" \
-            -H "Content-Type: application/json" \
-            "$API_BASE/api/v1/repos/$OWNER/$REPO/pulls" \
-            --data-binary "$PR_PAYLOAD")"
-
-          PR_URL="$(node --input-type=module -e '
-            const pr = JSON.parse(process.argv[1] || "{}");
-            console.log(pr.html_url || pr.url || "");
-          ' "$PR_JSON")"
-
-          test -n "$PR_URL" || { echo "❌ PR URL missing. Raw: $PR_JSON"; exit 1; }
-
-          MSG="✅ PR Proposer créée pour ticket #${ISSUE_NUMBER} : ${PR_URL}"
-          C_PAYLOAD="$(node --input-type=module -e 'console.log(JSON.stringify({body: process.argv[1]||""}))' "$MSG")"
-
-          curl -fsS -X POST \
-            -H "Authorization: token $FORGE_TOKEN" \
-            -H "Content-Type: application/json" \
-            "$API_BASE/api/v1/repos/$OWNER/$REPO/issues/$ISSUE_NUMBER/comments" \
-            --data-binary "$C_PAYLOAD"
-
-      - name: Finalize (fail job if apply failed)
-        if: ${{ always() }}
-        run: |
-          set -euo pipefail
-          source /tmp/proposer.env || true
-          [[ "${SKIP:-0}" != "1" ]] || exit 0
-
-          RC="${APPLY_RC:-0}"
-          if [[ "$RC" != "0" ]]; then
-            echo "❌ apply failed (rc=$RC)"
-            exit "$RC"
-          fi
-          echo "✅ apply ok"

.gitea/workflows/smoke.yml

@@ -3,7 +3,7 @@ on: [push, workflow_dispatch]
 
 jobs:
   smoke:
-    runs-on: mac-ci
+    runs-on: ubuntu-latest
     steps:
       - run: node -v && npm -v
       - run: echo "runner OK"

.gitignore

@@ -3,10 +3,6 @@
 .env.*
 !.env.example
 
-# dev-only
-public/_auth/whoami
-public/_auth/whoami/*
-
 # --- local backups ---
 *.bak
 *.bak.*

docs/OPS-DEPLOYMENT.md

@@ -25,19 +25,6 @@ Objectif : déployer une nouvelle version du site sur le NAS (DS220+) sans jamai
 
 ➡️ Déploiement = `docs/DEPLOY_PROD_SYNOLOGY_DS220.md` (procédure détaillée, à jour).
 
-## Mise à jour (2026-03-03) — Gate CI de déploiement (SKIP / HOTPATCH / FULL) + preuves A/B
-
-La procédure de déploiement “vivante” est désormais pilotée par **Gitea Actions** via le workflow :
-- `.gitea/workflows/deploy-staging-live.yml`
-
-Ce workflow décide automatiquement :
-- **FULL** (rebuild + restart blue + green) dès qu’un changement impacte le build (ex: `src/content/`, `src/pages/`, `scripts/`, `src/anchors/`, etc.)
-- **HOTPATCH** (patch JSON + copie media) quand le changement ne concerne que `src/annotations/` et/ou `public/media/`
-- **SKIP** sinon
-
-Les preuves et la procédure de test reproductible A/B sont documentées dans :
-➡️ `docs/runbooks/DEPLOY-BLUE-GREEN.md` → section “CI Deploy gate (merge-proof) + Tests A/B + preuve alias injection”.
-
 ## Schéma (résumé, sans commandes)
 
 - Ne jamais toucher au slot live.

docs/OPS_COCKPIT.md

@@ -202,33 +202,4 @@ docker compose logs --tail=200 web_blue
 docker compose logs --tail=200 web_green
 
 # Si tu veux suivre en live :
-docker compose logs -f web_green
-
-
-## Historique synthétique (2026-03-03) — Stabilisation CI/CD “zéro surprise”
-
-### Problème initial observé
-- Déploiement parfois lancé en “hotpatch” alors qu’un rebuild était nécessaire.
-- Sur merge commits, la détection de fichiers modifiés pouvait être ambiguë.
-- Résultat : besoin de `force=1` manuel pour éviter des incohérences.
-
-### Correctif appliqué
-- Gate CI rendu **merge-proof** :
-  - lecture de `BEFORE` et `AFTER` depuis `event.json`
-  - calcul des fichiers modifiés via `git diff --name-only BEFORE AFTER`
-
-- Politique de décision stabilisée :
-  - FULL auto dès qu’un changement impacte build/runtime (content/pages/scripts/anchors/etc.)
-  - HOTPATCH auto uniquement pour annotations/media
-
-### Preuves
-- Test A (touch src/content) :
-  - Gate flags: HAS_FULL=1 HAS_HOTPATCH=0 → MODE=full
-- Test B (touch src/annotations) :
-  - Gate flags: HAS_FULL=0 HAS_HOTPATCH=1 → MODE=hotpatch
-
-### Audit post-déploiement (preuves côté NAS)
-- 8081 + 8082 répondent HTTP 200
-- `/para-index.json` + `/annotations-index.json` OK
-- Aliases injectés visibles dans HTML via `.para-alias` quand alias présent
-
+docker compose logs -f web_green

docs/runbooks/DEPLOY-BLUE-GREEN.md

@@ -199,348 +199,4 @@ Ne jamais modifier dist/ “à la main” sur NAS.
 
 Si un hotfix prod est indispensable : documenter et backporter via PR Gitea.
 
-Le canonical dépend du build : PUBLIC_SITE doit être injecté (voir runbook ENV-PUBLIC_SITE).
-
-## 10) CI Deploy (Gitea Actions) — Gate SKIP / HOTPATCH / FULL (merge-proof) + preuves
-
-Cette section documente le comportement **canonique** du workflow :
-- `.gitea/workflows/deploy-staging-live.yml`
-
-Objectif : **zéro surprise**.
-On ne veut plus “penser à force=1”.
-Le gate doit décider automatiquement, y compris sur des **merge commits**.
-
-### 10.1 — Principe (ce que fait réellement le gate)
-
-Le job `deploy` calcule les fichiers modifiés entre :
-- `BEFORE` = commit précédent (avant le push sur main)
-- `AFTER`  = commit actuel (après le push / merge sur main)
-
-Puis il classe le déploiement dans un mode :
-
-- **MODE=full**
-  - rebuild image + restart `archicratie-web-blue` (8081) + `archicratie-web-green` (8082)
-  - warmup endpoints (para-index, annotations-index, pagefind.js)
-  - vérification canonical staging + live
-
-- **MODE=hotpatch**
-  - rebuild d’un `annotations-index.json` consolidé depuis `src/annotations/**`
-  - patch direct dans les conteneurs en cours d’exécution (blue+green)
-  - copie des médias modifiés `public/media/**` vers `/usr/share/nginx/html/media/**`
-  - smoke sur `/annotations-index.json` des deux ports
-
-- **MODE=skip**
-  - pas de déploiement (on évite le bruit)
-
-⚠️ Important : le mode “hotpatch” **ne rebuild pas** Astro.
-Donc toute modification de contenu, routes, scripts, anchors, etc. doit déclencher **full**.
-
-### 10.2 — Matrice de décision (règles officielles)
-
-Le gate définit deux flags :
-- `HAS_FULL=1` si changement “build-impacting”
-- `HAS_HOTPATCH=1` si changement “annotations/media only”
-
-Règle de priorité :
-1) Si `HAS_FULL=1` → **MODE=full**
-2) Sinon si `HAS_HOTPATCH=1` → **MODE=hotpatch**
-3) Sinon → **MODE=skip**
-
-#### 10.2.1 — Changements qui déclenchent FULL (build-impacting)
-
-Exemples typiques (non exhaustif, mais on couvre le cœur) :
-- `src/content/**` (contenu MD/MDX)
-- `src/pages/**` (routes Astro)
-- `src/anchors/**` (aliases d’ancres)
-- `scripts/**` (tooling postbuild : injection, index, tests)
-- `src/layouts/**`, `src/components/**`, `src/styles/**` (rendu et scripts inline)
-- `astro.config.mjs`, `package.json`, `package-lock.json`
-- `Dockerfile`, `docker-compose.yml`, `nginx.conf`
-- `.gitea/workflows/**` (changement infra CI/CD)
-
-=> On veut **full** pour garantir cohérence et éviter “site partiellement mis à jour”.
-
-#### 10.2.2 — Changements qui déclenchent HOTPATCH (sans rebuild)
-
-Uniquement :
-- `src/annotations/**` (shards YAML)
-- `public/media/**` (assets média)
-
-=> On veut hotpatch pour vitesse et éviter rebuild NAS.
-
-### 10.3 — “Merge-proof” : pourquoi on ne lit PAS seulement `git show $SHA`
-
-Sur un merge commit, `git show --name-only $SHA` peut être trompeur selon le contexte.
-La méthode robuste est :
-- utiliser `event.json` (Gitea Actions) pour récupérer `before` et `after`
-- calculer `git diff --name-only BEFORE AFTER`
-
-C’est ce qui rend le gate **merge-proof**.
-
-### 10.4 — Tests de preuve A/B (reproductibles)
-
-Ces tests valident le gate sans ambiguïté.
-But : vérifier que le mode choisi est EXACTEMENT celui attendu.
-
-#### Test A — toucher `src/content/...` (FULL auto)
-
-1) Créer une branche test
-2) Modifier 1 fichier dans `src/content/` (ex : ajouter une ligne de commentaire non destructive)
-3) PR → merge dans `main`
-4) Vérifier dans `deploy-staging-live.yml` :
-
-Attendus :
-- `Gate flags: HAS_FULL=1 HAS_HOTPATCH=0`
-- `✅ build-impacting change -> MODE=full (rebuild+restart)`
-- Les étapes FULL (blue puis green) s’exécutent réellement
-
-#### Test B — toucher `src/annotations/...` uniquement (HOTPATCH auto)
-
-1) Créer une branche test
-2) Modifier 1 fichier sous `src/annotations/**` (ex: un champ comment, ts, etc.)
-3) PR → merge dans `main`
-4) Vérifier dans `deploy-staging-live.yml` :
-
-Attendus :
-- `Gate flags: HAS_FULL=0 HAS_HOTPATCH=1`
-- `✅ annotations/media change -> MODE=hotpatch`
-- Les étapes FULL sont “skip” (durée 0s)
-- L’étape HOTPATCH s’exécute réellement
-
-### 10.5 — Preuve opérationnelle côté NAS (2 URLs + 2 commandes)
-
-But : prouver que staging+live servent bien les endpoints essentiels (et que le déploiement n’a pas “fait semblant”).
-
-#### 10.5.1 — Deux URLs à vérifier (staging et live)
-
-- Staging (blue) : `http://127.0.0.1:8081/`
-- Live (green)  : `http://127.0.0.1:8082/`
-
-#### 10.5.2 — Deux commandes minimales (zéro débat)
-
-```bash
-curl -fsSI http://127.0.0.1:8081/ | head -n 1
-curl -fsSI http://127.0.0.1:8082/ | head -n 1
-
----
-
-## 10) CI Deploy (Gitea Actions) — Gate SKIP / HOTPATCH / FULL (merge-proof) + preuves
-
-Cette section documente le comportement **canonique** du workflow :
-- `.gitea/workflows/deploy-staging-live.yml`
-
-Objectif : **zéro surprise**.
-On ne veut plus “penser à force=1”.
-Le gate doit décider automatiquement, y compris sur des **merge commits**.
-
-### 10.1 — Principe (ce que fait réellement le gate)
-
-Le job `deploy` calcule les fichiers modifiés entre :
-- `BEFORE` = commit précédent (avant le push sur main)
-- `AFTER`  = commit actuel (après le push / merge sur main)
-
-Puis il classe le déploiement dans un mode :
-
-- **MODE=full**
-  - rebuild image + restart `archicratie-web-blue` (8081) + `archicratie-web-green` (8082)
-  - warmup endpoints (para-index, annotations-index, pagefind.js)
-  - vérification canonical staging + live
-
-- **MODE=hotpatch**
-  - rebuild d’un `annotations-index.json` consolidé depuis `src/annotations/**`
-  - patch direct dans les conteneurs en cours d’exécution (blue+green)
-  - copie des médias modifiés `public/media/**` vers `/usr/share/nginx/html/media/**`
-  - smoke sur `/annotations-index.json` des deux ports
-
-- **MODE=skip**
-  - pas de déploiement (on évite le bruit)
-
-⚠️ Important : le mode “hotpatch” **ne rebuild pas** Astro.
-Donc toute modification de contenu, routes, scripts, anchors, etc. doit déclencher **full**.
-
-### 10.2 — Matrice de décision (règles officielles)
-
-Le gate définit deux flags :
-- `HAS_FULL=1` si changement “build-impacting”
-- `HAS_HOTPATCH=1` si changement “annotations/media only”
-
-Règle de priorité :
-1) Si `HAS_FULL=1` → **MODE=full**
-2) Sinon si `HAS_HOTPATCH=1` → **MODE=hotpatch**
-3) Sinon → **MODE=skip**
-
-#### 10.2.1 — Changements qui déclenchent FULL (build-impacting)
-
-Exemples typiques (non exhaustif, mais on couvre le cœur) :
-- `src/content/**` (contenu MD/MDX)
-- `src/pages/**` (routes Astro)
-- `src/anchors/**` (aliases d’ancres)
-- `scripts/**` (tooling postbuild : injection, index, tests)
-- `src/layouts/**`, `src/components/**`, `src/styles/**` (rendu et scripts inline)
-- `astro.config.mjs`, `package.json`, `package-lock.json`
-- `Dockerfile`, `docker-compose.yml`, `nginx.conf`
-- `.gitea/workflows/**` (changement infra CI/CD)
-
-=> On veut **full** pour garantir cohérence et éviter “site partiellement mis à jour”.
-
-#### 10.2.2 — Changements qui déclenchent HOTPATCH (sans rebuild)
-
-Uniquement :
-- `src/annotations/**` (shards YAML)
-- `public/media/**` (assets média)
-
-=> On veut hotpatch pour vitesse et éviter rebuild NAS.
-
-### 10.3 — “Merge-proof” : pourquoi on ne lit PAS seulement `git show $SHA`
-
-Sur un merge commit, `git show --name-only $SHA` peut être trompeur selon le contexte.
-La méthode robuste est :
-- utiliser `event.json` (Gitea Actions) pour récupérer `before` et `after`
-- calculer `git diff --name-only BEFORE AFTER`
-
-C’est ce qui rend le gate **merge-proof**.
-
-### 10.4 — Tests de preuve A/B (reproductibles)
-
-Ces tests valident le gate sans ambiguïté.
-But : vérifier que le mode choisi est EXACTEMENT celui attendu.
-
-#### Test A — toucher `src/content/...` (FULL auto)
-
-1) Créer une branche test
-2) Modifier 1 fichier dans `src/content/` (ex : ajouter une ligne de commentaire non destructive)
-3) PR → merge dans `main`
-4) Vérifier dans `deploy-staging-live.yml` :
-
-Attendus :
-- `Gate flags: HAS_FULL=1 HAS_HOTPATCH=0`
-- `✅ build-impacting change -> MODE=full (rebuild+restart)`
-- Les étapes FULL (blue puis green) s’exécutent réellement
-
-#### Test B — toucher `src/annotations/...` uniquement (HOTPATCH auto)
-
-1) Créer une branche test
-2) Modifier 1 fichier sous `src/annotations/**` (ex: un champ comment, ts, etc.)
-3) PR → merge dans `main`
-4) Vérifier dans `deploy-staging-live.yml` :
-
-Attendus :
-- `Gate flags: HAS_FULL=0 HAS_HOTPATCH=1`
-- `✅ annotations/media change -> MODE=hotpatch`
-- Les étapes FULL sont “skip” (durée 0s)
-- L’étape HOTPATCH s’exécute réellement
-
-### 10.5 — Preuve opérationnelle côté NAS (2 URLs + 2 commandes)
-
-But : prouver que staging+live servent bien les endpoints essentiels (et que le déploiement n’a pas “fait semblant”).
-
-#### 10.5.1 — Deux URLs à vérifier (staging et live)
-
-- Staging (blue) : `http://127.0.0.1:8081/`
-- Live (green)  : `http://127.0.0.1:8082/`
-
-#### 10.5.2 — Deux commandes minimales (zéro débat)
-
-en bash :
-curl -fsSI http://127.0.0.1:8081/ | head -n 1
-curl -fsSI http://127.0.0.1:8082/ | head -n 1
-
-Attendu : HTTP/1.1 200 OK des deux côtés.
-
-10.6 — Preuve “alias injection” (ancre ancienne → nouvelle) sur une page
-
-Contexte : lorsqu’un paragraphe change (ex: ticket “Proposer” appliqué),
-l’ID de paragraphe peut changer, mais on doit préserver les liens anciens via :
-
-src/anchors/anchor-aliases.json
-
-injection build-time dans dist (span .para-alias)
-
-10.6.1 — Check rapide (staging + live)
-
-Remplacer OLD/NEW par tes ids réels :
-
-Attendu : HTTP/1.1 200 OK des deux côtés.
-
-10.6 — Preuve “alias injection” (ancre ancienne → nouvelle) sur une page
-
-Contexte : lorsqu’un paragraphe change (ex: ticket “Proposer” appliqué),
-l’ID de paragraphe peut changer, mais on doit préserver les liens anciens via :
-
-src/anchors/anchor-aliases.json
-
-injection build-time dans dist (span .para-alias)
-
-10.6.1 — Check rapide (staging + live)
-
-Remplacer OLD/NEW par tes ids réels :
-
-OLD="p-1-60c7ea48"
-NEW="p-1-a21087b0"
-
-for P in 8081 8082; do
-  echo "=== $P ==="
-  HTML="$(curl -fsS "http://127.0.0.1:${P}/archicrat-ia/chapitre-3/" | tr -d '\r')"
-  echo "OLD count: $(printf '%s' "$HTML" | grep -o "$OLD" | wc -l | tr -d ' ')"
-  echo "NEW count: $(printf '%s' "$HTML" | grep -o "$NEW" | wc -l | tr -d ' ')"
-  printf '%s\n' "$HTML" | grep -nE "$OLD|$NEW|class=\"para-alias\"" | head -n 40 || true
-done
-
-Attendu :
-
-présence d’un alias : <span id="$OLD" class="para-alias"...>
-
-présence du nouveau paragraphe : <p id="$NEW">...
-
-10.6.2 — Check “lien ancien ne casse pas” (HTTP 200)
-
-for P in 8081 8082; do
-  curl -fsSI "http://127.0.0.1:${P}/archicrat-ia/chapitre-3/#${OLD}" | head -n 1
-done
-
-Attendu : HTTP/1.1 200 OK et navigation fonctionnelle côté navigateur.
-
-10.7 — Troubleshooting gate (symptômes typiques)
-Symptom 1 : job bloqué “Set up job” très longtemps
-
-Causes fréquentes :
-
-runner indisponible / capacity saturée
-
-runner ne récupère pas les tâches (fetch_timeout trop court + réseau instable)
-
-erreur dans “Gate — decide …” qui casse bash (et donne l’impression d’un hang)
-
-Commandes NAS (diagnostic rapide) :
-
-docker ps --format 'table {{.Names}}\t{{.Status}}\t{{.Image}}' | grep -E 'gitea-act-runner|registry|archicratie-web'
-docker logs --since 30m --tail 400 gitea-act-runner | tail -n 200
-Symptom 2 : conditional binary operator expected
-
-Cause :
-
-test bash du type [[ "$X" == "1" && "$Y" == "2" ]] mal formé
-
-variable vide non quotée
-
-usage d’un opérateur non supporté dans la shell effective
-
-Fix :
-
-set -euo pipefail
-
-toujours quoter : [[ "${VAR:-}" == "..." ]]
-
-logguer BEFORE/AFTER/FORCE et s’assurer qu’ils ne sont pas vides
-
-Symptom 3 : le gate liste “trop de fichiers” alors qu’on a changé 1 seul fichier
-
-Cause :
-
-comparaison faite sur le mauvais range (ex: git show sur merge, ou mauvais parent)
-Fix :
-
-toujours utiliser git diff --name-only "$BEFORE" "$AFTER" (merge-proof)
-
-confirmer dans le log : Gate ctx: BEFORE=... AFTER=...
-
+Le canonical dépend du build : PUBLIC_SITE doit être injecté (voir runbook ENV-PUBLIC_SITE).

ops/diag/archicratie-diag.sh

@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+CTX="${1:-/volume2/docker/archicratie-web/current}"
+EDGE_PORT="${EDGE_PORT:-18080}"
+STAGING_HOST="${STAGING_HOST:-staging.archicratie.trans-hands.synology.me}"
+LIVE_HOST="${LIVE_HOST:-archicratie.trans-hands.synology.me}"
+
+BLUE_CNAME="${BLUE_CNAME:-archicratie-web-blue}"
+GREEN_CNAME="${GREEN_CNAME:-archicratie-web-green}"
+
+BLUE_UPSTREAM="${BLUE_UPSTREAM:-8081}"
+GREEN_UPSTREAM="${GREEN_UPSTREAM:-8082}"
+
+echo "== Archicratie diagnostic =="
+echo "CTX=$CTX"
+echo "EDGE_PORT=$EDGE_PORT"
+echo "STAGING_HOST=$STAGING_HOST"
+echo "LIVE_HOST=$LIVE_HOST"
+echo "BLUE_CNAME=$BLUE_CNAME  BLUE_UPSTREAM=$BLUE_UPSTREAM"
+echo "GREEN_CNAME=$GREEN_CNAME GREEN_UPSTREAM=$GREEN_UPSTREAM"
+echo
+
+echo "== 1) Containers status (docker ps) =="
+sudo docker ps --filter name=archicratie-web --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}"
+echo
+
+echo "== 2) Port bindings (source de vérité: docker port) =="
+echo "-- $BLUE_CNAME --"
+sudo docker port "$BLUE_CNAME" 80 || true
+echo "-- $GREEN_CNAME --"
+sudo docker port "$GREEN_CNAME" 80 || true
+echo
+
+echo "== 3) Canonical upstream direct (8081/8082) =="
+for p in "$BLUE_UPSTREAM" "$GREEN_UPSTREAM"; do
+  echo "-- 127.0.0.1:$p --"
+  curl -fsS "http://127.0.0.1:$p/" \
+    | grep -oE 'rel="canonical" href="[^"]+"' \
+    | head -n 1 || echo "WARN: canonical not found"
+done
+echo
+
+echo "== 4) Edge routing proof (HEAD via Host header) =="
+echo "-- staging via edge --"
+curl -sSI -H "Host: $STAGING_HOST" "http://127.0.0.1:$EDGE_PORT/" \
+  | grep -iE 'HTTP/|location:|x-archi-router|x-archi-route' \
+  | head -n 30 || true
+echo
+
+echo "-- live via edge --"
+curl -sSI -H "Host: $LIVE_HOST" "http://127.0.0.1:$EDGE_PORT/" \
+  | grep -iE 'HTTP/|location:|x-archi-router|x-archi-route' \
+  | head -n 30 || true
+echo
+
+echo "== 5) Traefik errors last 5m (hard fail only) =="
+if sudo docker logs edge-traefik --since 5m | grep -Ei 'level=error|middleware .* does not exist|yaml' >/dev/null; then
+  echo "❌ FOUND traefik errors:"
+  sudo docker logs edge-traefik --since 5m | grep -Ei 'level=error|middleware .* does not exist|yaml' | tail -n 200
+  exit 2
+else
+  echo "✅ OK: pas d'erreur critique traefik (5m)"
+fi
+echo
+
+echo "== 6) Quick expectations (soft checks) =="
+BLUE_BIND="$(sudo docker port "$BLUE_CNAME" 80 2>/dev/null || true)"
+GREEN_BIND="$(sudo docker port "$GREEN_CNAME" 80 2>/dev/null || true)"
+
+if echo "$BLUE_BIND" | grep -q "127.0.0.1:$BLUE_UPSTREAM"; then
+  echo "✅ BLUE binding OK: $BLUE_BIND"
+else
+  echo "⚠️  BLUE binding unexpected: $BLUE_BIND"
+fi
+
+if echo "$GREEN_BIND" | grep -q "127.0.0.1:$GREEN_UPSTREAM"; then
+  echo "✅ GREEN binding OK: $GREEN_BIND"
+else
+  echo "⚠️  GREEN binding unexpected: $GREEN_BIND"
+fi
+
+echo
+echo "✅ Diagnostic complete."

package-lock.json

@@ -9,7 +9,7 @@
       "version": "0.0.1",
       "dependencies": {
         "@astrojs/mdx": "^4.3.13",
-        "astro": "^5.18.0"
+        "astro": "^5.16.11"
       },
       "devDependencies": {
         "@astrojs/sitemap": "^3.7.0",
@@ -1247,9 +1247,9 @@
       "license": "MIT"
     },
     "node_modules/@rollup/rollup-android-arm-eabi": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.59.0.tgz",
-      "integrity": "sha512-upnNBkA6ZH2VKGcBj9Fyl9IGNPULcjXRlg0LLeaioQWueH30p6IXtJEbKAgvyv+mJaMxSm1l6xwDXYjpEMiLMg==",
+      "version": "4.55.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.55.1.tgz",
+      "integrity": "sha512-9R0DM/ykwfGIlNu6+2U09ga0WXeZ9MRC2Ter8jnz8415VbuIykVuc6bhdrbORFZANDmTDvq26mJrEVTl8TdnDg==",
       "cpu": [
         "arm"
       ],
@@ -1260,9 +1260,9 @@
       ]
     },
     "node_modules/@rollup/rollup-android-arm64": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.59.0.tgz",
-      "integrity": "sha512-hZ+Zxj3SySm4A/DylsDKZAeVg0mvi++0PYVceVyX7hemkw7OreKdCvW2oQ3T1FMZvCaQXqOTHb8qmBShoqk69Q==",
+      "version": "4.55.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.55.1.tgz",
+      "integrity": "sha512-eFZCb1YUqhTysgW3sj/55du5cG57S7UTNtdMjCW7LwVcj3dTTcowCsC8p7uBdzKsZYa8J7IDE8lhMI+HX1vQvg==",
       "cpu": [
         "arm64"
       ],
@@ -1273,9 +1273,9 @@
       ]
     },
     "node_modules/@rollup/rollup-darwin-arm64": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.59.0.tgz",
-      "integrity": "sha512-W2Psnbh1J8ZJw0xKAd8zdNgF9HRLkdWwwdWqubSVk0pUuQkoHnv7rx4GiF9rT4t5DIZGAsConRE3AxCdJ4m8rg==",
+      "version": "4.55.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.55.1.tgz",
+      "integrity": "sha512-p3grE2PHcQm2e8PSGZdzIhCKbMCw/xi9XvMPErPhwO17vxtvCN5FEA2mSLgmKlCjHGMQTP6phuQTYWUnKewwGg==",
       "cpu": [
         "arm64"
       ],
@@ -1286,9 +1286,9 @@
       ]
     },
     "node_modules/@rollup/rollup-darwin-x64": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.59.0.tgz",
-      "integrity": "sha512-ZW2KkwlS4lwTv7ZVsYDiARfFCnSGhzYPdiOU4IM2fDbL+QGlyAbjgSFuqNRbSthybLbIJ915UtZBtmuLrQAT/w==",
+      "version": "4.55.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.55.1.tgz",
+      "integrity": "sha512-rDUjG25C9qoTm+e02Esi+aqTKSBYwVTaoS1wxcN47/Luqef57Vgp96xNANwt5npq9GDxsH7kXxNkJVEsWEOEaQ==",
       "cpu": [
         "x64"
       ],
@@ -1299,9 +1299,9 @@
       ]
     },
     "node_modules/@rollup/rollup-freebsd-arm64": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.59.0.tgz",
-      "integrity": "sha512-EsKaJ5ytAu9jI3lonzn3BgG8iRBjV4LxZexygcQbpiU0wU0ATxhNVEpXKfUa0pS05gTcSDMKpn3Sx+QB9RlTTA==",
+      "version": "4.55.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.55.1.tgz",
+      "integrity": "sha512-+JiU7Jbp5cdxekIgdte0jfcu5oqw4GCKr6i3PJTlXTCU5H5Fvtkpbs4XJHRmWNXF+hKmn4v7ogI5OQPaupJgOg==",
       "cpu": [
         "arm64"
       ],
@@ -1312,9 +1312,9 @@
       ]
     },
     "node_modules/@rollup/rollup-freebsd-x64": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.59.0.tgz",
-      "integrity": "sha512-d3DuZi2KzTMjImrxoHIAODUZYoUUMsuUiY4SRRcJy6NJoZ6iIqWnJu9IScV9jXysyGMVuW+KNzZvBLOcpdl3Vg==",
+      "version": "4.55.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.55.1.tgz",
+      "integrity": "sha512-V5xC1tOVWtLLmr3YUk2f6EJK4qksksOYiz/TCsFHu/R+woubcLWdC9nZQmwjOAbmExBIVKsm1/wKmEy4z4u4Bw==",
       "cpu": [
         "x64"
       ],
@@ -1325,9 +1325,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm-gnueabihf": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.59.0.tgz",
-      "integrity": "sha512-t4ONHboXi/3E0rT6OZl1pKbl2Vgxf9vJfWgmUoCEVQVxhW6Cw/c8I6hbbu7DAvgp82RKiH7TpLwxnJeKv2pbsw==",
+      "version": "4.55.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.55.1.tgz",
+      "integrity": "sha512-Rn3n+FUk2J5VWx+ywrG/HGPTD9jXNbicRtTM11e/uorplArnXZYsVifnPPqNNP5BsO3roI4n8332ukpY/zN7rQ==",
       "cpu": [
         "arm"
       ],
@@ -1338,9 +1338,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm-musleabihf": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.59.0.tgz",
-      "integrity": "sha512-CikFT7aYPA2ufMD086cVORBYGHffBo4K8MQ4uPS/ZnY54GKj36i196u8U+aDVT2LX4eSMbyHtyOh7D7Zvk2VvA==",
+      "version": "4.55.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.55.1.tgz",
+      "integrity": "sha512-grPNWydeKtc1aEdrJDWk4opD7nFtQbMmV7769hiAaYyUKCT1faPRm2av8CX1YJsZ4TLAZcg9gTR1KvEzoLjXkg==",
       "cpu": [
         "arm"
       ],
@@ -1351,9 +1351,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm64-gnu": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.59.0.tgz",
-      "integrity": "sha512-jYgUGk5aLd1nUb1CtQ8E+t5JhLc9x5WdBKew9ZgAXg7DBk0ZHErLHdXM24rfX+bKrFe+Xp5YuJo54I5HFjGDAA==",
+      "version": "4.55.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.55.1.tgz",
+      "integrity": "sha512-a59mwd1k6x8tXKcUxSyISiquLwB5pX+fJW9TkWU46lCqD/GRDe9uDN31jrMmVP3feI3mhAdvcCClhV8V5MhJFQ==",
       "cpu": [
         "arm64"
       ],
@@ -1364,9 +1364,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm64-musl": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.59.0.tgz",
-      "integrity": "sha512-peZRVEdnFWZ5Bh2KeumKG9ty7aCXzzEsHShOZEFiCQlDEepP1dpUl/SrUNXNg13UmZl+gzVDPsiCwnV1uI0RUA==",
+      "version": "4.55.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.55.1.tgz",
+      "integrity": "sha512-puS1MEgWX5GsHSoiAsF0TYrpomdvkaXm0CofIMG5uVkP6IBV+ZO9xhC5YEN49nsgYo1DuuMquF9+7EDBVYu4uA==",
       "cpu": [
         "arm64"
       ],
@@ -1377,9 +1377,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-loong64-gnu": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.59.0.tgz",
-      "integrity": "sha512-gbUSW/97f7+r4gHy3Jlup8zDG190AuodsWnNiXErp9mT90iCy9NKKU0Xwx5k8VlRAIV2uU9CsMnEFg/xXaOfXg==",
+      "version": "4.55.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.55.1.tgz",
+      "integrity": "sha512-r3Wv40in+lTsULSb6nnoudVbARdOwb2u5fpeoOAZjFLznp6tDU8kd+GTHmJoqZ9lt6/Sys33KdIHUaQihFcu7g==",
       "cpu": [
         "loong64"
       ],
@@ -1390,9 +1390,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-loong64-musl": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-musl/-/rollup-linux-loong64-musl-4.59.0.tgz",
-      "integrity": "sha512-yTRONe79E+o0FWFijasoTjtzG9EBedFXJMl888NBEDCDV9I2wGbFFfJQQe63OijbFCUZqxpHz1GzpbtSFikJ4Q==",
+      "version": "4.55.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-musl/-/rollup-linux-loong64-musl-4.55.1.tgz",
+      "integrity": "sha512-MR8c0+UxAlB22Fq4R+aQSPBayvYa3+9DrwG/i1TKQXFYEaoW3B5b/rkSRIypcZDdWjWnpcvxbNaAJDcSbJU3Lw==",
       "cpu": [
         "loong64"
       ],
@@ -1403,9 +1403,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-ppc64-gnu": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.59.0.tgz",
-      "integrity": "sha512-sw1o3tfyk12k3OEpRddF68a1unZ5VCN7zoTNtSn2KndUE+ea3m3ROOKRCZxEpmT9nsGnogpFP9x6mnLTCaoLkA==",
+      "version": "4.55.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.55.1.tgz",
+      "integrity": "sha512-3KhoECe1BRlSYpMTeVrD4sh2Pw2xgt4jzNSZIIPLFEsnQn9gAnZagW9+VqDqAHgm1Xc77LzJOo2LdigS5qZ+gw==",
       "cpu": [
         "ppc64"
       ],
@@ -1416,9 +1416,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-ppc64-musl": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-musl/-/rollup-linux-ppc64-musl-4.59.0.tgz",
-      "integrity": "sha512-+2kLtQ4xT3AiIxkzFVFXfsmlZiG5FXYW7ZyIIvGA7Bdeuh9Z0aN4hVyXS/G1E9bTP/vqszNIN/pUKCk/BTHsKA==",
+      "version": "4.55.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-musl/-/rollup-linux-ppc64-musl-4.55.1.tgz",
+      "integrity": "sha512-ziR1OuZx0vdYZZ30vueNZTg73alF59DicYrPViG0NEgDVN8/Jl87zkAPu4u6VjZST2llgEUjaiNl9JM6HH1Vdw==",
       "cpu": [
         "ppc64"
       ],
@@ -1429,9 +1429,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-riscv64-gnu": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.59.0.tgz",
-      "integrity": "sha512-NDYMpsXYJJaj+I7UdwIuHHNxXZ/b/N2hR15NyH3m2qAtb/hHPA4g4SuuvrdxetTdndfj9b1WOmy73kcPRoERUg==",
+      "version": "4.55.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.55.1.tgz",
+      "integrity": "sha512-uW0Y12ih2XJRERZ4jAfKamTyIHVMPQnTZcQjme2HMVDAHY4amf5u414OqNYC+x+LzRdRcnIG1YodLrrtA8xsxw==",
       "cpu": [
         "riscv64"
       ],
@@ -1442,9 +1442,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-riscv64-musl": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.59.0.tgz",
-      "integrity": "sha512-nLckB8WOqHIf1bhymk+oHxvM9D3tyPndZH8i8+35p/1YiVoVswPid2yLzgX7ZJP0KQvnkhM4H6QZ5m0LzbyIAg==",
+      "version": "4.55.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.55.1.tgz",
+      "integrity": "sha512-u9yZ0jUkOED1BFrqu3BwMQoixvGHGZ+JhJNkNKY/hyoEgOwlqKb62qu+7UjbPSHYjiVy8kKJHvXKv5coH4wDeg==",
       "cpu": [
         "riscv64"
       ],
@@ -1455,9 +1455,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-s390x-gnu": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.59.0.tgz",
-      "integrity": "sha512-oF87Ie3uAIvORFBpwnCvUzdeYUqi2wY6jRFWJAy1qus/udHFYIkplYRW+wo+GRUP4sKzYdmE1Y3+rY5Gc4ZO+w==",
+      "version": "4.55.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.55.1.tgz",
+      "integrity": "sha512-/0PenBCmqM4ZUd0190j7J0UsQ/1nsi735iPRakO8iPciE7BQ495Y6msPzaOmvx0/pn+eJVVlZrNrSh4WSYLxNg==",
       "cpu": [
         "s390x"
       ],
@@ -1468,9 +1468,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-x64-gnu": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.59.0.tgz",
-      "integrity": "sha512-3AHmtQq/ppNuUspKAlvA8HtLybkDflkMuLK4DPo77DfthRb71V84/c4MlWJXixZz4uruIH4uaa07IqoAkG64fg==",
+      "version": "4.55.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.55.1.tgz",
+      "integrity": "sha512-a8G4wiQxQG2BAvo+gU6XrReRRqj+pLS2NGXKm8io19goR+K8lw269eTrPkSdDTALwMmJp4th2Uh0D8J9bEV1vg==",
       "cpu": [
         "x64"
       ],
@@ -1481,9 +1481,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-x64-musl": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.59.0.tgz",
-      "integrity": "sha512-2UdiwS/9cTAx7qIUZB/fWtToJwvt0Vbo0zmnYt7ED35KPg13Q0ym1g442THLC7VyI6JfYTP4PiSOWyoMdV2/xg==",
+      "version": "4.55.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.55.1.tgz",
+      "integrity": "sha512-bD+zjpFrMpP/hqkfEcnjXWHMw5BIghGisOKPj+2NaNDuVT+8Ds4mPf3XcPHuat1tz89WRL+1wbcxKY3WSbiT7w==",
       "cpu": [
         "x64"
       ],
@@ -1494,9 +1494,9 @@
       ]
     },
     "node_modules/@rollup/rollup-openbsd-x64": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-openbsd-x64/-/rollup-openbsd-x64-4.59.0.tgz",
-      "integrity": "sha512-M3bLRAVk6GOwFlPTIxVBSYKUaqfLrn8l0psKinkCFxl4lQvOSz8ZrKDz2gxcBwHFpci0B6rttydI4IpS4IS/jQ==",
+      "version": "4.55.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-openbsd-x64/-/rollup-openbsd-x64-4.55.1.tgz",
+      "integrity": "sha512-eLXw0dOiqE4QmvikfQ6yjgkg/xDM+MdU9YJuP4ySTibXU0oAvnEWXt7UDJmD4UkYialMfOGFPJnIHSe/kdzPxg==",
       "cpu": [
         "x64"
       ],
@@ -1507,9 +1507,9 @@
       ]
     },
     "node_modules/@rollup/rollup-openharmony-arm64": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.59.0.tgz",
-      "integrity": "sha512-tt9KBJqaqp5i5HUZzoafHZX8b5Q2Fe7UjYERADll83O4fGqJ49O1FsL6LpdzVFQcpwvnyd0i+K/VSwu/o/nWlA==",
+      "version": "4.55.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.55.1.tgz",
+      "integrity": "sha512-xzm44KgEP11te3S2HCSyYf5zIzWmx3n8HDCc7EE59+lTcswEWNpvMLfd9uJvVX8LCg9QWG67Xt75AuHn4vgsXw==",
       "cpu": [
         "arm64"
       ],
@@ -1520,9 +1520,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-arm64-msvc": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.59.0.tgz",
-      "integrity": "sha512-V5B6mG7OrGTwnxaNUzZTDTjDS7F75PO1ae6MJYdiMu60sq0CqN5CVeVsbhPxalupvTX8gXVSU9gq+Rx1/hvu6A==",
+      "version": "4.55.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.55.1.tgz",
+      "integrity": "sha512-yR6Bl3tMC/gBok5cz/Qi0xYnVbIxGx5Fcf/ca0eB6/6JwOY+SRUcJfI0OpeTpPls7f194as62thCt/2BjxYN8g==",
       "cpu": [
         "arm64"
       ],
@@ -1533,9 +1533,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-ia32-msvc": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.59.0.tgz",
-      "integrity": "sha512-UKFMHPuM9R0iBegwzKF4y0C4J9u8C6MEJgFuXTBerMk7EJ92GFVFYBfOZaSGLu6COf7FxpQNqhNS4c4icUPqxA==",
+      "version": "4.55.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.55.1.tgz",
+      "integrity": "sha512-3fZBidchE0eY0oFZBnekYCfg+5wAB0mbpCBuofh5mZuzIU/4jIVkbESmd2dOsFNS78b53CYv3OAtwqkZZmU5nA==",
       "cpu": [
         "ia32"
       ],
@@ -1546,9 +1546,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-x64-gnu": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.59.0.tgz",
-      "integrity": "sha512-laBkYlSS1n2L8fSo1thDNGrCTQMmxjYY5G0WFWjFFYZkKPjsMBsgJfGf4TLxXrF6RyhI60L8TMOjBMvXiTcxeA==",
+      "version": "4.55.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.55.1.tgz",
+      "integrity": "sha512-xGGY5pXj69IxKb4yv/POoocPy/qmEGhimy/FoTpTSVju3FYXUQQMFCaZZXJVidsmGxRioZAwpThl/4zX41gRKg==",
       "cpu": [
         "x64"
       ],
@@ -1559,9 +1559,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-x64-msvc": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.59.0.tgz",
-      "integrity": "sha512-2HRCml6OztYXyJXAvdDXPKcawukWY2GpR5/nxKp4iBgiO3wcoEGkAaqctIbZcNB6KlUQBIqt8VYkNSj2397EfA==",
+      "version": "4.55.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.55.1.tgz",
+      "integrity": "sha512-SPEpaL6DX4rmcXtnhdrQYgzQ5W2uW3SCJch88lB2zImhJRhIIK44fkUrgIV/Q8yUNfw5oyZ5vkeQsZLhCb06lw==",
       "cpu": [
         "x64"
       ],
@@ -1905,9 +1905,9 @@
       }
     },
     "node_modules/astro": {
-      "version": "5.18.0",
-      "resolved": "https://registry.npmjs.org/astro/-/astro-5.18.0.tgz",
-      "integrity": "sha512-CHiohwJIS4L0G6/IzE1Fx3dgWqXBCXus/od0eGUfxrZJD2um2pE7ehclMmgL/fXqbU7NfE1Ze2pq34h2QaA6iQ==",
+      "version": "5.16.11",
+      "resolved": "https://registry.npmjs.org/astro/-/astro-5.16.11.tgz",
+      "integrity": "sha512-Z7kvkTTT5n6Hn5lCm6T3WU6pkxx84Hn25dtQ6dR7ATrBGq9eVa8EuB/h1S8xvaoVyCMZnIESu99Z9RJfdLRLDA==",
       "license": "MIT",
       "dependencies": {
         "@astrojs/compiler": "^2.13.0",
@@ -1933,7 +1933,7 @@
         "dlv": "^1.1.3",
         "dset": "^3.1.4",
         "es-module-lexer": "^1.7.0",
-        "esbuild": "^0.27.3",
+        "esbuild": "^0.25.0",
         "estree-walker": "^3.0.3",
         "flattie": "^1.1.1",
         "fontace": "~0.4.0",
@@ -1954,16 +1954,16 @@
         "prompts": "^2.4.2",
         "rehype": "^13.0.2",
         "semver": "^7.7.3",
-        "shiki": "^3.21.0",
+        "shiki": "^3.20.0",
         "smol-toml": "^1.6.0",
         "svgo": "^4.0.0",
         "tinyexec": "^1.0.2",
         "tinyglobby": "^0.2.15",
         "tsconfck": "^3.1.6",
         "ultrahtml": "^1.6.0",
-        "unifont": "~0.7.3",
+        "unifont": "~0.7.1",
         "unist-util-visit": "^5.0.0",
-        "unstorage": "^1.17.4",
+        "unstorage": "^1.17.3",
         "vfile": "^6.0.3",
         "vite": "^6.4.1",
         "vitefu": "^1.1.1",
@@ -1990,463 +1990,6 @@
         "sharp": "^0.34.0"
       }
     },
-    "node_modules/astro/node_modules/@esbuild/aix-ppc64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.27.3.tgz",
-      "integrity": "sha512-9fJMTNFTWZMh5qwrBItuziu834eOCUcEqymSH7pY+zoMVEZg3gcPuBNxH1EvfVYe9h0x/Ptw8KBzv7qxb7l8dg==",
-      "cpu": [
-        "ppc64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "aix"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/android-arm": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.27.3.tgz",
-      "integrity": "sha512-i5D1hPY7GIQmXlXhs2w8AWHhenb00+GxjxRncS2ZM7YNVGNfaMxgzSGuO8o8SJzRc/oZwU2bcScvVERk03QhzA==",
-      "cpu": [
-        "arm"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/android-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.27.3.tgz",
-      "integrity": "sha512-YdghPYUmj/FX2SYKJ0OZxf+iaKgMsKHVPF1MAq/P8WirnSpCStzKJFjOjzsW0QQ7oIAiccHdcqjbHmJxRb/dmg==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/android-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.27.3.tgz",
-      "integrity": "sha512-IN/0BNTkHtk8lkOM8JWAYFg4ORxBkZQf9zXiEOfERX/CzxW3Vg1ewAhU7QSWQpVIzTW+b8Xy+lGzdYXV6UZObQ==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/darwin-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.27.3.tgz",
-      "integrity": "sha512-Re491k7ByTVRy0t3EKWajdLIr0gz2kKKfzafkth4Q8A5n1xTHrkqZgLLjFEHVD+AXdUGgQMq+Godfq45mGpCKg==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/darwin-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.27.3.tgz",
-      "integrity": "sha512-vHk/hA7/1AckjGzRqi6wbo+jaShzRowYip6rt6q7VYEDX4LEy1pZfDpdxCBnGtl+A5zq8iXDcyuxwtv3hNtHFg==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/freebsd-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.27.3.tgz",
-      "integrity": "sha512-ipTYM2fjt3kQAYOvo6vcxJx3nBYAzPjgTCk7QEgZG8AUO3ydUhvelmhrbOheMnGOlaSFUoHXB6un+A7q4ygY9w==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/freebsd-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.27.3.tgz",
-      "integrity": "sha512-dDk0X87T7mI6U3K9VjWtHOXqwAMJBNN2r7bejDsc+j03SEjtD9HrOl8gVFByeM0aJksoUuUVU9TBaZa2rgj0oA==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/linux-arm": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.27.3.tgz",
-      "integrity": "sha512-s6nPv2QkSupJwLYyfS+gwdirm0ukyTFNl3KTgZEAiJDd+iHZcbTPPcWCcRYH+WlNbwChgH2QkE9NSlNrMT8Gfw==",
-      "cpu": [
-        "arm"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/linux-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.27.3.tgz",
-      "integrity": "sha512-sZOuFz/xWnZ4KH3YfFrKCf1WyPZHakVzTiqji3WDc0BCl2kBwiJLCXpzLzUBLgmp4veFZdvN5ChW4Eq/8Fc2Fg==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/linux-ia32": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.27.3.tgz",
-      "integrity": "sha512-yGlQYjdxtLdh0a3jHjuwOrxQjOZYD/C9PfdbgJJF3TIZWnm/tMd/RcNiLngiu4iwcBAOezdnSLAwQDPqTmtTYg==",
-      "cpu": [
-        "ia32"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/linux-loong64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.27.3.tgz",
-      "integrity": "sha512-WO60Sn8ly3gtzhyjATDgieJNet/KqsDlX5nRC5Y3oTFcS1l0KWba+SEa9Ja1GfDqSF1z6hif/SkpQJbL63cgOA==",
-      "cpu": [
-        "loong64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/linux-mips64el": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.27.3.tgz",
-      "integrity": "sha512-APsymYA6sGcZ4pD6k+UxbDjOFSvPWyZhjaiPyl/f79xKxwTnrn5QUnXR5prvetuaSMsb4jgeHewIDCIWljrSxw==",
-      "cpu": [
-        "mips64el"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/linux-ppc64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.27.3.tgz",
-      "integrity": "sha512-eizBnTeBefojtDb9nSh4vvVQ3V9Qf9Df01PfawPcRzJH4gFSgrObw+LveUyDoKU3kxi5+9RJTCWlj4FjYXVPEA==",
-      "cpu": [
-        "ppc64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/linux-riscv64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.27.3.tgz",
-      "integrity": "sha512-3Emwh0r5wmfm3ssTWRQSyVhbOHvqegUDRd0WhmXKX2mkHJe1SFCMJhagUleMq+Uci34wLSipf8Lagt4LlpRFWQ==",
-      "cpu": [
-        "riscv64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/linux-s390x": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.27.3.tgz",
-      "integrity": "sha512-pBHUx9LzXWBc7MFIEEL0yD/ZVtNgLytvx60gES28GcWMqil8ElCYR4kvbV2BDqsHOvVDRrOxGySBM9Fcv744hw==",
-      "cpu": [
-        "s390x"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/linux-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.27.3.tgz",
-      "integrity": "sha512-Czi8yzXUWIQYAtL/2y6vogER8pvcsOsk5cpwL4Gk5nJqH5UZiVByIY8Eorm5R13gq+DQKYg0+JyQoytLQas4dA==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/netbsd-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.27.3.tgz",
-      "integrity": "sha512-sDpk0RgmTCR/5HguIZa9n9u+HVKf40fbEUt+iTzSnCaGvY9kFP0YKBWZtJaraonFnqef5SlJ8/TiPAxzyS+UoA==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "netbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/netbsd-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.27.3.tgz",
-      "integrity": "sha512-P14lFKJl/DdaE00LItAukUdZO5iqNH7+PjoBm+fLQjtxfcfFE20Xf5CrLsmZdq5LFFZzb5JMZ9grUwvtVYzjiA==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "netbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/openbsd-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.27.3.tgz",
-      "integrity": "sha512-AIcMP77AvirGbRl/UZFTq5hjXK+2wC7qFRGoHSDrZ5v5b8DK/GYpXW3CPRL53NkvDqb9D+alBiC/dV0Fb7eJcw==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/openbsd-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.27.3.tgz",
-      "integrity": "sha512-DnW2sRrBzA+YnE70LKqnM3P+z8vehfJWHXECbwBmH/CU51z6FiqTQTHFenPlHmo3a8UgpLyH3PT+87OViOh1AQ==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/openharmony-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.27.3.tgz",
-      "integrity": "sha512-NinAEgr/etERPTsZJ7aEZQvvg/A6IsZG/LgZy+81wON2huV7SrK3e63dU0XhyZP4RKGyTm7aOgmQk0bGp0fy2g==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openharmony"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/sunos-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.27.3.tgz",
-      "integrity": "sha512-PanZ+nEz+eWoBJ8/f8HKxTTD172SKwdXebZ0ndd953gt1HRBbhMsaNqjTyYLGLPdoWHy4zLU7bDVJztF5f3BHA==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "sunos"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/win32-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.27.3.tgz",
-      "integrity": "sha512-B2t59lWWYrbRDw/tjiWOuzSsFh1Y/E95ofKz7rIVYSQkUYBjfSgf6oeYPNWHToFRr2zx52JKApIcAS/D5TUBnA==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/win32-ia32": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.27.3.tgz",
-      "integrity": "sha512-QLKSFeXNS8+tHW7tZpMtjlNb7HKau0QDpwm49u0vUp9y1WOF+PEzkU84y9GqYaAVW8aH8f3GcBck26jh54cX4Q==",
-      "cpu": [
-        "ia32"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/@esbuild/win32-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.27.3.tgz",
-      "integrity": "sha512-4uJGhsxuptu3OcpVAzli+/gWusVGwZZHTlS63hh++ehExkVT8SgiEf7/uC/PclrPPkLhZqGgCTjd0VWLo6xMqA==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/astro/node_modules/esbuild": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.27.3.tgz",
-      "integrity": "sha512-8VwMnyGCONIs6cWue2IdpHxHnAjzxnw2Zr7MkVxB2vjmQ2ivqGFb4LEG3SMnv0Gb2F/G/2yA8zUaiL1gywDCCg==",
-      "hasInstallScript": true,
-      "license": "MIT",
-      "bin": {
-        "esbuild": "bin/esbuild"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "optionalDependencies": {
-        "@esbuild/aix-ppc64": "0.27.3",
-        "@esbuild/android-arm": "0.27.3",
-        "@esbuild/android-arm64": "0.27.3",
-        "@esbuild/android-x64": "0.27.3",
-        "@esbuild/darwin-arm64": "0.27.3",
-        "@esbuild/darwin-x64": "0.27.3",
-        "@esbuild/freebsd-arm64": "0.27.3",
-        "@esbuild/freebsd-x64": "0.27.3",
-        "@esbuild/linux-arm": "0.27.3",
-        "@esbuild/linux-arm64": "0.27.3",
-        "@esbuild/linux-ia32": "0.27.3",
-        "@esbuild/linux-loong64": "0.27.3",
-        "@esbuild/linux-mips64el": "0.27.3",
-        "@esbuild/linux-ppc64": "0.27.3",
-        "@esbuild/linux-riscv64": "0.27.3",
-        "@esbuild/linux-s390x": "0.27.3",
-        "@esbuild/linux-x64": "0.27.3",
-        "@esbuild/netbsd-arm64": "0.27.3",
-        "@esbuild/netbsd-x64": "0.27.3",
-        "@esbuild/openbsd-arm64": "0.27.3",
-        "@esbuild/openbsd-x64": "0.27.3",
-        "@esbuild/openharmony-arm64": "0.27.3",
-        "@esbuild/sunos-x64": "0.27.3",
-        "@esbuild/win32-arm64": "0.27.3",
-        "@esbuild/win32-ia32": "0.27.3",
-        "@esbuild/win32-x64": "0.27.3"
-      }
-    },
     "node_modules/axobject-query": {
       "version": "4.1.0",
       "resolved": "https://registry.npmjs.org/axobject-query/-/axobject-query-4.1.0.tgz",
@@ -2883,9 +2426,9 @@
       }
     },
     "node_modules/devalue": {
-      "version": "5.6.3",
-      "resolved": "https://registry.npmjs.org/devalue/-/devalue-5.6.3.tgz",
-      "integrity": "sha512-nc7XjUU/2Lb+SvEFVGcWLiKkzfw8+qHI7zn8WYXKkLMgfGSHbgCEaR6bJpev8Cm6Rmrb19Gfd/tZvGqx9is3wg==",
+      "version": "5.6.2",
+      "resolved": "https://registry.npmjs.org/devalue/-/devalue-5.6.2.tgz",
+      "integrity": "sha512-nPRkjWzzDQlsejL1WVifk5rvcFi/y1onBRxjaFMjZeR9mFpqu2gmAZ9xUB9/IEanEP/vBtGeGganC/GO1fmufg==",
       "license": "MIT"
     },
     "node_modules/devlop": {
@@ -5690,9 +5233,9 @@
       }
     },
     "node_modules/rollup": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.59.0.tgz",
-      "integrity": "sha512-2oMpl67a3zCH9H79LeMcbDhXW/UmWG/y2zuqnF2jQq5uq9TbM9TVyXvA4+t+ne2IIkBdrLpAaRQAvo7YI/Yyeg==",
+      "version": "4.55.1",
+      "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.55.1.tgz",
+      "integrity": "sha512-wDv/Ht1BNHB4upNbK74s9usvl7hObDnvVzknxqY/E/O3X6rW1U1rV1aENEfJ54eFZDTNo7zv1f5N4edCluH7+A==",
       "license": "MIT",
       "dependencies": {
         "@types/estree": "1.0.8"
@@ -5705,31 +5248,31 @@
         "npm": ">=8.0.0"
       },
       "optionalDependencies": {
-        "@rollup/rollup-android-arm-eabi": "4.59.0",
-        "@rollup/rollup-android-arm64": "4.59.0",
-        "@rollup/rollup-darwin-arm64": "4.59.0",
-        "@rollup/rollup-darwin-x64": "4.59.0",
-        "@rollup/rollup-freebsd-arm64": "4.59.0",
-        "@rollup/rollup-freebsd-x64": "4.59.0",
-        "@rollup/rollup-linux-arm-gnueabihf": "4.59.0",
-        "@rollup/rollup-linux-arm-musleabihf": "4.59.0",
-        "@rollup/rollup-linux-arm64-gnu": "4.59.0",
-        "@rollup/rollup-linux-arm64-musl": "4.59.0",
-        "@rollup/rollup-linux-loong64-gnu": "4.59.0",
-        "@rollup/rollup-linux-loong64-musl": "4.59.0",
-        "@rollup/rollup-linux-ppc64-gnu": "4.59.0",
-        "@rollup/rollup-linux-ppc64-musl": "4.59.0",
-        "@rollup/rollup-linux-riscv64-gnu": "4.59.0",
-        "@rollup/rollup-linux-riscv64-musl": "4.59.0",
-        "@rollup/rollup-linux-s390x-gnu": "4.59.0",
-        "@rollup/rollup-linux-x64-gnu": "4.59.0",
-        "@rollup/rollup-linux-x64-musl": "4.59.0",
-        "@rollup/rollup-openbsd-x64": "4.59.0",
-        "@rollup/rollup-openharmony-arm64": "4.59.0",
-        "@rollup/rollup-win32-arm64-msvc": "4.59.0",
-        "@rollup/rollup-win32-ia32-msvc": "4.59.0",
-        "@rollup/rollup-win32-x64-gnu": "4.59.0",
-        "@rollup/rollup-win32-x64-msvc": "4.59.0",
+        "@rollup/rollup-android-arm-eabi": "4.55.1",
+        "@rollup/rollup-android-arm64": "4.55.1",
+        "@rollup/rollup-darwin-arm64": "4.55.1",
+        "@rollup/rollup-darwin-x64": "4.55.1",
+        "@rollup/rollup-freebsd-arm64": "4.55.1",
+        "@rollup/rollup-freebsd-x64": "4.55.1",
+        "@rollup/rollup-linux-arm-gnueabihf": "4.55.1",
+        "@rollup/rollup-linux-arm-musleabihf": "4.55.1",
+        "@rollup/rollup-linux-arm64-gnu": "4.55.1",
+        "@rollup/rollup-linux-arm64-musl": "4.55.1",
+        "@rollup/rollup-linux-loong64-gnu": "4.55.1",
+        "@rollup/rollup-linux-loong64-musl": "4.55.1",
+        "@rollup/rollup-linux-ppc64-gnu": "4.55.1",
+        "@rollup/rollup-linux-ppc64-musl": "4.55.1",
+        "@rollup/rollup-linux-riscv64-gnu": "4.55.1",
+        "@rollup/rollup-linux-riscv64-musl": "4.55.1",
+        "@rollup/rollup-linux-s390x-gnu": "4.55.1",
+        "@rollup/rollup-linux-x64-gnu": "4.55.1",
+        "@rollup/rollup-linux-x64-musl": "4.55.1",
+        "@rollup/rollup-openbsd-x64": "4.55.1",
+        "@rollup/rollup-openharmony-arm64": "4.55.1",
+        "@rollup/rollup-win32-arm64-msvc": "4.55.1",
+        "@rollup/rollup-win32-ia32-msvc": "4.55.1",
+        "@rollup/rollup-win32-x64-gnu": "4.55.1",
+        "@rollup/rollup-win32-x64-msvc": "4.55.1",
         "fsevents": "~2.3.2"
       }
     },
@@ -6138,9 +5681,9 @@
       "license": "MIT"
     },
     "node_modules/underscore": {
-      "version": "1.13.8",
-      "resolved": "https://registry.npmjs.org/underscore/-/underscore-1.13.8.tgz",
-      "integrity": "sha512-DXtD3ZtEQzc7M8m4cXotyHR+FAS18C64asBYY5vqZexfYryNNnDc02W4hKg3rdQuqOYas1jkseX0+nZXjTXnvQ==",
+      "version": "1.13.7",
+      "resolved": "https://registry.npmjs.org/underscore/-/underscore-1.13.7.tgz",
+      "integrity": "sha512-GMXzWtsc57XAtguZgaQViUOzs0KTkk8ojr3/xAxXLITqf/3EMwxC0inyETfDFjH/Krbhuep0HNbbjI9i/q3F3g==",
       "dev": true,
       "license": "MIT"
     },

package.json

@@ -4,29 +4,32 @@
   "version": "0.0.1",
   "private": true,
   "scripts": {
-    "dev": "node scripts/write-dev-whoami.mjs && astro dev",
+    "dev": "astro dev",
     "preview": "astro preview",
     "astro": "astro",
+
     "clean": "rm -rf dist",
     "build": "astro build",
     "build:clean": "npm run clean && npm run build",
-    "postbuild": "node scripts/inject-anchor-aliases.mjs && node scripts/dedupe-ids-dist.mjs && node scripts/build-para-index.mjs && node scripts/build-annotations-index.mjs && node scripts/purge-dist-dev-whoami.mjs && npx pagefind --site dist",
+
+    "postbuild": "node scripts/inject-anchor-aliases.mjs && node scripts/dedupe-ids-dist.mjs && npx pagefind --site dist",
+
     "import": "node scripts/import-docx.mjs",
     "apply:ticket": "node scripts/apply-ticket.mjs",
+
     "audit:dist": "node scripts/audit-dist.mjs",
-    "build:para-index": "node scripts/build-para-index.mjs",
-    "build:annotations-index": "node scripts/build-annotations-index.mjs",
+
     "test:aliases": "node scripts/check-anchor-aliases.mjs",
     "test:anchors": "node scripts/check-anchors.mjs",
     "test:anchors:update": "node scripts/check-anchors.mjs --update",
-    "test:annotations": "node scripts/check-annotations.mjs",
-    "test:annotations:media": "node scripts/check-annotations-media.mjs",
-    "test": "npm run test:aliases && npm run build:clean && npm run audit:dist && node scripts/verify-anchor-aliases-in-dist.mjs && npm run test:anchors && npm run test:annotations && npm run test:annotations:media && node scripts/check-inline-js.mjs",
+
+    "test": "npm run test:aliases && npm run build:clean && npm run audit:dist && node scripts/verify-anchor-aliases-in-dist.mjs && npm run test:anchors && node scripts/check-inline-js.mjs",
+
     "ci": "CI=1 npm test"
   },
   "dependencies": {
     "@astrojs/mdx": "^4.3.13",
-    "astro": "^5.18.0"
+    "astro": "^5.16.11"
   },
   "devDependencies": {
     "@astrojs/sitemap": "^3.7.0",

public/site.webmanifest

@@ -1 +1 @@
-{"name":"","short_name":"","icons":[{"src":"/android-chrome-192x192.png","sizes":"192x192","type":"image/png"},{"src":"/android-chrome-512x512.png","sizes":"512x512","type":"image/png"}],"theme_color":"#ffffff","background_color":"#ffffff","display":"standalone","orientation":"any"}
+{"name":"","short_name":"","icons":[{"src":"/android-chrome-192x192.png","sizes":"192x192","type":"image/png"},{"src":"/android-chrome-512x512.png","sizes":"512x512","type":"image/png"}],"theme_color":"#ffffff","background_color":"#ffffff","display":"standalone"}

scripts/apply-annotation-ticket.mjs

@@ -1,899 +0,0 @@
-#!/usr/bin/env node
-// scripts/apply-annotation-ticket.mjs
-//
-// Applique un ticket Gitea "type/media | type/reference | type/comment" vers:
-//
-//   ✅ src/annotations/<oeuvre>/<chapitre>/<paraId>.yml   (sharding par paragraphe)
-//   ✅ public/media/<oeuvre>/<chapitre>/<paraId>/<file>
-//
-// Compat rétro : lit (si présent) l'ancien monolithe:
-//   src/annotations/<oeuvre>/<chapitre>.yml
-// et deep-merge NON destructif dans le shard lors d'une nouvelle application,
-// pour permettre une migration progressive sans perte.
-//
-// Robuste, idempotent, non destructif.
-// DRY RUN si --dry-run
-// Options: --dry-run --no-download --verify --strict --commit --close
-//
-// Env requis:
-//   FORGE_API   = base API Gitea (LAN) ex: http://192.168.1.20:3000
-//   FORGE_TOKEN = PAT Gitea (repo + issues)
-//
-// Env optionnel:
-//   GITEA_OWNER / GITEA_REPO (sinon auto-détecté via git remote)
-//   ANNO_DIR    (défaut: src/annotations)
-//   PUBLIC_DIR  (défaut: public)
-//   MEDIA_ROOT  (défaut URL: /media)
-//
-// Ticket attendu (body):
-//   Chemin: /archicrat-ia/chapitre-4/
-//   Ancre: #p-0-xxxxxxxx
-//   Type: type/media | type/reference | type/comment
-//
-// Exit codes:
-//   0 ok
-//   1 erreur fatale
-//   2 refus (strict/verify/usage)
-
-import fs from "node:fs/promises";
-import path from "node:path";
-import process from "node:process";
-import { spawnSync } from "node:child_process";
-import YAML from "yaml";
-
-/* ---------------------------------- usage --------------------------------- */
-
-function usage(exitCode = 0) {
-  console.log(`
-apply-annotation-ticket — applique un ticket SidePanel (media/ref/comment) vers src/annotations/ (shard par paragraphe)
-
-Usage:
-  node scripts/apply-annotation-ticket.mjs <issue_number> [--dry-run] [--no-download] [--verify] [--strict] [--commit] [--close]
-
-Flags:
-  --dry-run      : n'écrit rien (affiche un aperçu)
-  --no-download  : n'essaie pas de télécharger les pièces jointes (media)
-  --verify       : vérifie que (page, ancre) existent (dist/para-index.json si dispo, sinon baseline)
-  --strict       : refuse si URL ref invalide (http/https) OU caption media vide OU verify impossible
-  --commit       : git add + git commit (commit dans la branche courante)
-  --close        : ferme le ticket (nécessite --commit)
-
-Env requis:
-  FORGE_API   = base API Gitea (LAN) ex: http://192.168.1.20:3000
-  FORGE_TOKEN = PAT Gitea (repo + issues)
-
-Env optionnel:
-  GITEA_OWNER / GITEA_REPO  (sinon auto-détecté via git remote)
-  ANNO_DIR    (défaut: src/annotations)
-  PUBLIC_DIR  (défaut: public)
-  MEDIA_ROOT  (défaut URL: /media)
-
-Exit codes:
-  0 ok
-  1 erreur fatale
-  2 refus (strict/verify/close sans commit / incohérence)
-`);
-  process.exit(exitCode);
-}
-
-/* ---------------------------------- args ---------------------------------- */
-
-const argv = process.argv.slice(2);
-if (argv.length === 0 || argv.includes("--help") || argv.includes("-h")) usage(0);
-
-const issueNum = Number(argv[0]);
-if (!Number.isFinite(issueNum) || issueNum <= 0) {
-  console.error("❌ Numéro de ticket invalide.");
-  usage(2);
-}
-
-const DRY_RUN = argv.includes("--dry-run");
-const NO_DOWNLOAD = argv.includes("--no-download");
-const DO_VERIFY = argv.includes("--verify");
-const STRICT = argv.includes("--strict");
-const DO_COMMIT = argv.includes("--commit");
-const DO_CLOSE = argv.includes("--close");
-
-if (DO_CLOSE && !DO_COMMIT) {
-  console.error("❌ --close nécessite --commit.");
-  process.exit(2);
-}
-
-if (typeof fetch !== "function") {
-  console.error("❌ fetch() indisponible. Utilise Node 18+.");
-  process.exit(1);
-}
-
-/* --------------------------------- config --------------------------------- */
-
-const CWD = process.cwd();
-const ANNO_DIR = path.join(CWD, process.env.ANNO_DIR || "src", "annotations");
-const PUBLIC_DIR = path.join(CWD, process.env.PUBLIC_DIR || "public");
-const MEDIA_URL_ROOT = String(process.env.MEDIA_ROOT || "/media").replace(/\/+$/, "");
-
-/* --------------------------------- helpers -------------------------------- */
-
-function getEnv(name, fallback = "") {
-  return (process.env[name] ?? fallback).trim();
-}
-
-function run(cmd, args, opts = {}) {
-  const r = spawnSync(cmd, args, { stdio: "inherit", ...opts });
-  if (r.error) throw r.error;
-  if (r.status !== 0) throw new Error(`Command failed: ${cmd} ${args.join(" ")}`);
-}
-
-function runQuiet(cmd, args, opts = {}) {
-  const r = spawnSync(cmd, args, { encoding: "utf8", stdio: "pipe", ...opts });
-  if (r.error) throw r.error;
-  if (r.status !== 0) {
-    const out = (r.stdout || "") + (r.stderr || "");
-    throw new Error(`Command failed: ${cmd} ${args.join(" ")}\n${out}`);
-  }
-  return r.stdout || "";
-}
-
-async function exists(p) {
-  try {
-    await fs.access(p);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-function inferOwnerRepoFromGit() {
-  const r = spawnSync("git", ["remote", "get-url", "origin"], { encoding: "utf-8" });
-  if (r.status !== 0) return null;
-  const u = (r.stdout || "").trim();
-  const m = u.match(/[:/](?<owner>[^/]+)\/(?<repo>[^/]+?)(?:\.git)?$/);
-  if (!m?.groups) return null;
-  return { owner: m.groups.owner, repo: m.groups.repo };
-}
-
-function gitHasStagedChanges() {
-  const r = spawnSync("git", ["diff", "--cached", "--quiet"]);
-  return r.status === 1;
-}
-
-function escapeRegExp(s) {
-  return String(s).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-
-function pickLine(body, key) {
-  const re = new RegExp(`^\\s*${escapeRegExp(key)}\\s*:\\s*([^\\n\\r]+)`, "mi");
-  const m = String(body || "").match(re);
-  return m ? m[1].trim() : "";
-}
-
-function pickSection(body, markers) {
-  const text = String(body || "").replace(/\r\n/g, "\n");
-  const idx = markers
-    .map((m) => ({ m, i: text.toLowerCase().indexOf(m.toLowerCase()) }))
-    .filter((x) => x.i >= 0)
-    .sort((a, b) => a.i - b.i)[0];
-  if (!idx) return "";
-
-  const start = idx.i + idx.m.length;
-  const tail = text.slice(start);
-
-  const stops = ["\n## ", "\n---", "\nJustification", "\nProposition", "\nSources"];
-  let end = tail.length;
-  for (const s of stops) {
-    const j = tail.toLowerCase().indexOf(s.toLowerCase());
-    if (j >= 0 && j < end) end = j;
-  }
-  return tail.slice(0, end).trim();
-}
-
-function normalizeChemin(chemin) {
-  let c = String(chemin || "").trim();
-  if (!c) return "";
-  if (!c.startsWith("/")) c = "/" + c;
-  if (!c.endsWith("/")) c = c + "/";
-  c = c.replace(/\/{2,}/g, "/");
-  return c;
-}
-
-function normalizePageKeyFromChemin(chemin) {
-  // ex: /archicrat-ia/chapitre-4/ => archicrat-ia/chapitre-4
-  return normalizeChemin(chemin).replace(/^\/+|\/+$/g, "");
-}
-
-function normalizeAnchorId(s) {
-  let a = String(s || "").trim();
-  if (a.startsWith("#")) a = a.slice(1);
-  return a;
-}
-
-function assert(cond, msg, code = 1) {
-  if (!cond) {
-    const e = new Error(msg);
-    e.__exitCode = code;
-    throw e;
-  }
-}
-
-function isPlainObject(x) {
-  return !!x && typeof x === "object" && !Array.isArray(x);
-}
-
-function paraIndexFromId(id) {
-  const m = String(id).match(/^p-(\d+)-/i);
-  return m ? Number(m[1]) : Number.NaN;
-}
-
-function isHttpUrl(u) {
-  try {
-    const x = new URL(String(u));
-    return x.protocol === "http:" || x.protocol === "https:";
-  } catch {
-    return false;
-  }
-}
-
-function stableSortByTs(arr) {
-  if (!Array.isArray(arr)) return;
-  arr.sort((a, b) => {
-    const ta = Date.parse(a?.ts || "") || 0;
-    const tb = Date.parse(b?.ts || "") || 0;
-    if (ta !== tb) return ta - tb;
-    return JSON.stringify(a).localeCompare(JSON.stringify(b));
-  });
-}
-
-function normPage(s) {
-    let x = String(s || "").trim();
-    if (!x) return "";
-    // retire origin si on a une URL complète
-    x = x.replace(/^https?:\/\/[^/]+/i, "");
-    // enlève query/hash
-    x = x.split("#")[0].split("?")[0];
-    // enlève index.html
-    x = x.replace(/index\.html$/i, "");
-    // enlève slashs de bord
-    x = x.replace(/^\/+/, "").replace(/\/+$/, "");
-    return x;
-  }
-
-/* ------------------------------ para-index (verify + order) ------------------------------ */
-
-async function loadParaOrderFromDist(pageKey) {
-    const distIdx = path.join(CWD, "dist", "para-index.json");
-    if (!(await exists(distIdx))) return null;
-  
-    let j;
-    try {
-      j = JSON.parse(await fs.readFile(distIdx, "utf8"));
-    } catch {
-      return null;
-    }
-  
-    const want = normPage(pageKey);
-  
-    // Support A) { items:[{id,page,...}, ...] } (ou variantes)
-    const items = Array.isArray(j?.items)
-      ? j.items
-      : Array.isArray(j?.index?.items)
-        ? j.index.items
-        : null;
-  
-    if (items) {
-      const ids = [];
-      for (const it of items) {
-        // page peut être dans plein de clés différentes
-        const pageCand = normPage(
-          it?.page ??
-          it?.pageKey ??
-          it?.path ??
-          it?.route ??
-          it?.href ??
-          it?.url ??
-          ""
-        );
-  
-        // id peut être dans plein de clés différentes
-        let id = String(it?.id ?? it?.paraId ?? it?.anchorId ?? it?.anchor ?? "");
-        if (id.startsWith("#")) id = id.slice(1);
-  
-        if (pageCand === want && id) ids.push(id);
-      }
-      if (ids.length) return ids;
-    }
-  
-    // Support B) { byId: { "p-...": { page:"...", ... }, ... } }
-    if (j?.byId && typeof j.byId === "object") {
-      const ids = Object.keys(j.byId)
-        .filter((id) => {
-          const meta = j.byId[id] || {};
-          const pageCand = normPage(meta.page ?? meta.pageKey ?? meta.path ?? meta.route ?? meta.url ?? "");
-          return pageCand === want;
-        });
-  
-      if (ids.length) {
-        ids.sort((a, b) => {
-          const ia = paraIndexFromId(a);
-          const ib = paraIndexFromId(b);
-          if (Number.isFinite(ia) && Number.isFinite(ib) && ia !== ib) return ia - ib;
-          return String(a).localeCompare(String(b));
-        });
-        return ids;
-      }
-    }
-  
-    // Support C) { pages: { "archicrat-ia/chapitre-4": { ids:[...] } } } (ou variantes)
-    if (j?.pages && typeof j.pages === "object") {
-      // essaie de trouver la bonne clé même si elle est /.../ ou .../index.html
-      const keys = Object.keys(j.pages);
-      const hit = keys.find((k) => normPage(k) === want);
-      if (hit) {
-        const pg = j.pages[hit];
-        if (Array.isArray(pg?.ids)) return pg.ids.map(String);
-        if (Array.isArray(pg?.paras)) return pg.paras.map(String);
-      }
-    }
-  
-    return null;
-  }
-
-  async function tryVerifyAnchor(pageKey, anchorId) {
-    // 1) dist/para-index.json : order complet si possible
-    const order = await loadParaOrderFromDist(pageKey);
-    if (order) return order.includes(anchorId);
-  
-    // 1bis) dist/para-index.json : fallback “best effort” => recherche brute (IDs quasi uniques)
-    const distIdx = path.join(CWD, "dist", "para-index.json");
-    if (await exists(distIdx)) {
-      try {
-        const raw = await fs.readFile(distIdx, "utf8");
-        if (raw.includes(`"${anchorId}"`) || raw.includes(`"#${anchorId}"`)) {
-          return true;
-        }
-      } catch {
-        // ignore
-      }
-    }
-  
-    // 2) tests/anchors-baseline.json (fallback)
-    const base = path.join(CWD, "tests", "anchors-baseline.json");
-    if (await exists(base)) {
-      try {
-        const j = JSON.parse(await fs.readFile(base, "utf8"));
-        const candidates = [];
-        if (j?.pages && typeof j.pages === "object") {
-          for (const [k, v] of Object.entries(j.pages)) {
-            if (!Array.isArray(v)) continue;
-            if (normPage(k).includes(normPage(pageKey))) candidates.push(...v);
-          }
-        }
-        if (Array.isArray(j?.entries)) {
-          for (const it of j.entries) {
-            const p = String(it?.page || "");
-            const ids = it?.ids;
-            if (Array.isArray(ids) && normPage(p).includes(normPage(pageKey))) candidates.push(...ids);
-          }
-        }
-        if (candidates.length) return candidates.some((x) => String(x) === anchorId);
-      } catch {
-        // ignore
-      }
-    }
-  
-    return null; // cannot verify
-  }
-
-/* ----------------------------- deep merge helpers (non destructive) ----------------------------- */
-
-function keyMedia(x) {
-  return String(x?.src || "");
-}
-function keyRef(x) {
-  return `${x?.url || ""}||${x?.label || ""}||${x?.kind || ""}||${x?.citation || ""}`;
-}
-function keyComment(x) {
-  return String(x?.text || "").trim();
-}
-
-function uniqUnion(dstArr, srcArr, keyFn) {
-  const out = Array.isArray(dstArr) ? [...dstArr] : [];
-  const seen = new Set(out.map((x) => keyFn(x)));
-  for (const it of (Array.isArray(srcArr) ? srcArr : [])) {
-    const k = keyFn(it);
-    if (!k) continue;
-    if (!seen.has(k)) {
-      seen.add(k);
-      out.push(it);
-    }
-  }
-  return out;
-}
-
-function deepMergeEntry(dst, src) {
-  if (!isPlainObject(dst) || !isPlainObject(src)) return;
-
-  for (const [k, v] of Object.entries(src)) {
-    if (k === "media" && Array.isArray(v)) {
-      dst.media = uniqUnion(dst.media, v, keyMedia);
-      continue;
-    }
-    if (k === "refs" && Array.isArray(v)) {
-      dst.refs = uniqUnion(dst.refs, v, keyRef);
-      continue;
-    }
-    if (k === "comments_editorial" && Array.isArray(v)) {
-      dst.comments_editorial = uniqUnion(dst.comments_editorial, v, keyComment);
-      continue;
-    }
-
-    if (isPlainObject(v)) {
-      if (!isPlainObject(dst[k])) dst[k] = {};
-      deepMergeEntry(dst[k], v);
-      continue;
-    }
-
-    if (Array.isArray(v)) {
-      const cur = Array.isArray(dst[k]) ? dst[k] : [];
-      const seen = new Set(cur.map((x) => JSON.stringify(x)));
-      const out = [...cur];
-      for (const it of v) {
-        const s = JSON.stringify(it);
-        if (!seen.has(s)) {
-          seen.add(s);
-          out.push(it);
-        }
-      }
-      dst[k] = out;
-      continue;
-    }
-
-    // scalar: set only if missing/empty
-    if (!(k in dst) || dst[k] == null || dst[k] === "") {
-      dst[k] = v;
-    }
-  }
-}
-
-/* ----------------------------- annotations I/O ----------------------------- */
-
-async function loadAnnoDocYaml(fileAbs, pageKey) {
-  if (!(await exists(fileAbs))) {
-    return { schema: 1, page: pageKey, paras: {} };
-  }
-
-  const raw = await fs.readFile(fileAbs, "utf8");
-  let doc;
-  try {
-    doc = YAML.parse(raw);
-  } catch (e) {
-    throw new Error(`${path.relative(CWD, fileAbs)}: parse failed: ${String(e?.message ?? e)}`);
-  }
-
-  assert(isPlainObject(doc), `${path.relative(CWD, fileAbs)}: doc must be an object`, 2);
-  assert(doc.schema === 1, `${path.relative(CWD, fileAbs)}: schema must be 1`, 2);
-  assert(isPlainObject(doc.paras), `${path.relative(CWD, fileAbs)}: missing object key "paras"`, 2);
-
-  if (doc.page != null) {
-    const got = String(doc.page).replace(/^\/+/, "").replace(/\/+$/, "");
-    assert(got === pageKey, `${path.relative(CWD, fileAbs)}: page mismatch (page="${doc.page}" vs path="${pageKey}")`, 2);
-  } else {
-    doc.page = pageKey;
-  }
-
-  return doc;
-}
-
-function sortParasObject(paras, order) {
-  const keys = Object.keys(paras || {});
-  const idx = new Map();
-  if (Array.isArray(order)) order.forEach((id, i) => idx.set(String(id), i));
-
-  keys.sort((a, b) => {
-    const ha = idx.has(a);
-    const hb = idx.has(b);
-    if (ha && hb) return idx.get(a) - idx.get(b);
-    if (ha && !hb) return -1;
-    if (!ha && hb) return 1;
-
-    const ia = paraIndexFromId(a);
-    const ib = paraIndexFromId(b);
-    if (Number.isFinite(ia) && Number.isFinite(ib) && ia !== ib) return ia - ib;
-    return String(a).localeCompare(String(b));
-  });
-
-  const out = {};
-  for (const k of keys) out[k] = paras[k];
-  return out;
-}
-
-async function saveAnnoDocYaml(fileAbs, doc, order = null) {
-  await fs.mkdir(path.dirname(fileAbs), { recursive: true });
-
-  doc.paras = sortParasObject(doc.paras, order);
-
-  for (const e of Object.values(doc.paras || {})) {
-    if (!isPlainObject(e)) continue;
-    stableSortByTs(e.media);
-    stableSortByTs(e.refs);
-    stableSortByTs(e.comments_editorial);
-  }
-
-  const out = YAML.stringify(doc);
-  await fs.writeFile(fileAbs, out, "utf8");
-}
-
-/* ------------------------------ gitea helpers ------------------------------ */
-
-function apiBaseNorm(forgeApiBase) {
-  return forgeApiBase.replace(/\/+$/, "");
-}
-
-async function giteaGET(url, token) {
-  const res = await fetch(url, {
-    headers: {
-      Authorization: `token ${token}`,
-      Accept: "application/json",
-      "User-Agent": "archicratie-apply-annotation/1.0",
-    },
-  });
-  if (!res.ok) {
-    const t = await res.text().catch(() => "");
-    throw new Error(`HTTP ${res.status} GET ${url}\n${t}`);
-  }
-  return await res.json();
-}
-
-async function fetchIssue({ forgeApiBase, owner, repo, token, issueNum }) {
-  const url = `${apiBaseNorm(forgeApiBase)}/api/v1/repos/${owner}/${repo}/issues/${issueNum}`;
-  return await giteaGET(url, token);
-}
-
-async function fetchIssueAssets({ forgeApiBase, owner, repo, token, issueNum }) {
-  // Gitea: /issues/{index}/assets
-  const url = `${apiBaseNorm(forgeApiBase)}/api/v1/repos/${owner}/${repo}/issues/${issueNum}/assets`;
-  try {
-    const json = await giteaGET(url, token);
-    return Array.isArray(json) ? json : [];
-  } catch {
-    return [];
-  }
-}
-
-async function postIssueComment({ forgeApiBase, owner, repo, token, issueNum, comment }) {
-  const url = `${apiBaseNorm(forgeApiBase)}/api/v1/repos/${owner}/${repo}/issues/${issueNum}/comments`;
-  const res = await fetch(url, {
-    method: "POST",
-    headers: {
-      Authorization: `token ${token}`,
-      Accept: "application/json",
-      "Content-Type": "application/json",
-      "User-Agent": "archicratie-apply-annotation/1.0",
-    },
-    body: JSON.stringify({ body: comment }),
-  });
-  if (!res.ok) {
-    const t = await res.text().catch(() => "");
-    throw new Error(`HTTP ${res.status} POST comment ${url}\n${t}`);
-  }
-}
-
-async function closeIssue({ forgeApiBase, owner, repo, token, issueNum, comment }) {
-  if (comment) await postIssueComment({ forgeApiBase, owner, repo, token, issueNum, comment });
-
-  const url = `${apiBaseNorm(forgeApiBase)}/api/v1/repos/${owner}/${repo}/issues/${issueNum}`;
-  const res = await fetch(url, {
-    method: "PATCH",
-    headers: {
-      Authorization: `token ${token}`,
-      Accept: "application/json",
-      "Content-Type": "application/json",
-      "User-Agent": "archicratie-apply-annotation/1.0",
-    },
-    body: JSON.stringify({ state: "closed" }),
-  });
-  if (!res.ok) {
-    const t = await res.text().catch(() => "");
-    throw new Error(`HTTP ${res.status} closing issue: ${url}\n${t}`);
-  }
-}
-
-/* ------------------------------ media helpers ------------------------------ */
-
-function inferMediaTypeFromFilename(name) {
-  const n = String(name || "").toLowerCase();
-  if (/\.(png|jpe?g|webp|gif|svg)$/.test(n)) return "image";
-  if (/\.(mp4|webm|mov|m4v)$/.test(n)) return "video";
-  if (/\.(mp3|wav|ogg|m4a)$/.test(n)) return "audio";
-  return "link";
-}
-
-function sanitizeFilename(name) {
-  return String(name || "file")
-    .replace(/[\/\\]/g, "_")
-    .replace(/[^\w.\-]+/g, "_")
-    .replace(/_+/g, "_")
-    .slice(0, 180);
-}
-
-async function downloadToFile(url, token, destAbs) {
-  const res = await fetch(url, {
-    headers: {
-      Authorization: `token ${token}`,
-      "User-Agent": "archicratie-apply-annotation/1.0",
-    },
-    redirect: "follow",
-  });
-  if (!res.ok) {
-    const t = await res.text().catch(() => "");
-    throw new Error(`download failed HTTP ${res.status}: ${url}\n${t}`);
-  }
-  const buf = Buffer.from(await res.arrayBuffer());
-  await fs.mkdir(path.dirname(destAbs), { recursive: true });
-  await fs.writeFile(destAbs, buf);
-  return buf.length;
-}
-
-/* ------------------------------ type parsers ------------------------------ */
-
-function parseReferenceBlock(body) {
-  const block =
-    pickSection(body, ["Référence (à compléter):", "Reference (à compléter):"]) ||
-    pickSection(body, ["Référence:", "Reference:"]);
-
-  const lines = String(block || "").split(/\r?\n/).map((l) => l.trim());
-  const get = (k) => {
-    const re = new RegExp(`^[-*]\\s*${escapeRegExp(k)}\\s*:\\s*(.*)$`, "i");
-    const m = lines.map((l) => l.match(re)).find(Boolean);
-    return (m?.[1] ?? "").trim();
-  };
-
-  return {
-    url: get("URL") || "",
-    label: get("Label") || "",
-    kind: get("Kind") || "",
-    citation: get("Citation") || get("Passage") || get("Extrait") || "",
-    rawBlock: block || "",
-  };
-}
-
-/* ----------------------------------- main ---------------------------------- */
-
-async function main() {
-  const token = getEnv("FORGE_TOKEN");
-  assert(token, "❌ FORGE_TOKEN manquant.", 2);
-
-  const forgeApiBase = getEnv("FORGE_API") || getEnv("FORGE_BASE");
-  assert(forgeApiBase, "❌ FORGE_API (ou FORGE_BASE) manquant.", 2);
-
-  const inferred = inferOwnerRepoFromGit() || {};
-  const owner = getEnv("GITEA_OWNER", inferred.owner || "");
-  const repo = getEnv("GITEA_REPO", inferred.repo || "");
-  assert(owner && repo, "❌ Impossible de déterminer owner/repo. Fix: export GITEA_OWNER=... GITEA_REPO=...", 2);
-
-  console.log(`🔎 Fetch ticket #${issueNum} from ${owner}/${repo} …`);
-  const issue = await fetchIssue({ forgeApiBase, owner, repo, token, issueNum });
-
-  if (issue?.pull_request) {
-    console.error(`❌ #${issueNum} est une Pull Request, pas un ticket annotations.`);
-    process.exit(2);
-  }
-
-  const body = String(issue.body || "").replace(/\r\n/g, "\n");
-  const title = String(issue.title || "");
-
-  const type = pickLine(body, "Type").toLowerCase();
-  const chemin = normalizeChemin(pickLine(body, "Chemin"));
-  const ancre = normalizeAnchorId(pickLine(body, "Ancre"));
-
-  assert(chemin, "Ticket: Chemin manquant.", 2);
-  assert(ancre && /^p-\d+-/i.test(ancre), `Ticket: Ancre invalide ("${ancre}")`, 2);
-  assert(type, "Ticket: Type manquant.", 2);
-
-  const pageKey = normalizePageKeyFromChemin(chemin);
-  assert(pageKey, "Ticket: impossible de dériver pageKey.", 2);
-
-  const paraOrder = DO_VERIFY ? await loadParaOrderFromDist(pageKey) : null;
-
-  if (DO_VERIFY) {
-    const ok = await tryVerifyAnchor(pageKey, ancre);
-    if (ok === false) {
-      throw Object.assign(new Error(`Ticket verify: ancre introuvable pour page "${pageKey}" => ${ancre}`), { __exitCode: 2 });
-    }
-    if (ok === null) {
-      if (STRICT) {
-        throw Object.assign(
-          new Error(`Ticket verify (strict): impossible de vérifier (pas de dist/para-index.json ou baseline)`),
-          { __exitCode: 2 }
-        );
-      }
-      console.warn("⚠️  verify: impossible de vérifier (pas de dist/para-index.json ou baseline) — on continue.");
-    }
-  }
-
-  // ✅ shard path: src/annotations/<pageKey>/<paraId>.yml
-  const shardAbs = path.join(ANNO_DIR, ...pageKey.split("/"), `${ancre}.yml`);
-  const shardRel = path.relative(CWD, shardAbs).replace(/\\/g, "/");
-
-  // legacy monolith: src/annotations/<pageKey>.yml (read-only, for migration)
-  const legacyAbs = path.join(ANNO_DIR, `${pageKey}.yml`);
-
-  console.log("✅ Parsed:", { type, chemin, ancre: `#${ancre}`, pageKey, annoFile: shardRel });
-
-  // load shard doc
-  const doc = await loadAnnoDocYaml(shardAbs, pageKey);
-  if (!isPlainObject(doc.paras[ancre])) doc.paras[ancre] = {};
-  const entry = doc.paras[ancre];
-
-  // merge legacy entry into shard in-memory (non destructive) to keep compat + enable progressive migration
-  if (await exists(legacyAbs)) {
-    try {
-      const legacy = await loadAnnoDocYaml(legacyAbs, pageKey);
-      const legacyEntry = legacy?.paras?.[ancre];
-      if (isPlainObject(legacyEntry)) {
-        deepMergeEntry(entry, legacyEntry);
-      }
-    } catch {
-      // ignore legacy parse issues; shard still applies new data
-    }
-  }
-
-  const touchedFiles = [];
-  const notes = [];
-  let changed = false;
-  const nowIso = new Date().toISOString();
-
-  if (type === "type/comment") {
-    const comment = pickSection(body, ["Commentaire:", "Comment:", "Commentaires:"]) || "";
-    const text = comment.trim();
-    assert(text.length >= 3, "Ticket comment: bloc 'Commentaire:' introuvable ou trop court.", 2);
-
-    if (!Array.isArray(entry.comments_editorial)) entry.comments_editorial = [];
-    const item = { text, status: "new", ts: nowIso, fromIssue: issueNum };
-
-    const before = entry.comments_editorial.length;
-    entry.comments_editorial = uniqUnion(entry.comments_editorial, [item], keyComment);
-    if (entry.comments_editorial.length !== before) {
-      changed = true;
-      notes.push(`+ comment added (len=${text.length})`);
-    } else {
-      notes.push(`~ comment already present (dedup)`);
-    }
-    stableSortByTs(entry.comments_editorial);
-  }
-
-  else if (type === "type/reference") {
-    const ref = parseReferenceBlock(body);
-    assert(ref.url || ref.label, "Ticket reference: renseigne au moins - URL: ou - Label: dans le ticket.", 2);
-
-    if (STRICT && ref.url && !isHttpUrl(ref.url)) {
-      throw Object.assign(new Error(`Ticket reference (strict): URL invalide (http/https requis): "${ref.url}"`), { __exitCode: 2 });
-    }
-
-    if (!Array.isArray(entry.refs)) entry.refs = [];
-    const item = {
-      url: ref.url || "",
-      label: ref.label || (ref.url ? ref.url : "Référence"),
-      kind: ref.kind || "",
-      ts: nowIso,
-      fromIssue: issueNum,
-    };
-    if (ref.citation) item.citation = ref.citation;
-
-    const before = entry.refs.length;
-    entry.refs = uniqUnion(entry.refs, [item], keyRef);
-    if (entry.refs.length !== before) {
-      changed = true;
-      notes.push(`+ reference added (${item.url ? "url" : "label"})`);
-    } else {
-      notes.push(`~ reference already present (dedup)`);
-    }
-    stableSortByTs(entry.refs);
-  }
-
-  else if (type === "type/media") {
-    if (!Array.isArray(entry.media)) entry.media = [];
-
-    const caption = (title || "").trim();
-    if (STRICT && !caption) {
-      throw Object.assign(new Error("Ticket media (strict): caption vide (titre de ticket requis)."), { __exitCode: 2 });
-    }
-    const captionFinal = caption || ".";
-
-    const atts = NO_DOWNLOAD ? [] : await fetchIssueAssets({ forgeApiBase, owner, repo, token, issueNum });
-    if (!atts.length) notes.push("! no assets found (nothing to download).");
-
-    for (const a of atts) {
-      const name = sanitizeFilename(a?.name || `asset-${a?.id || "x"}`);
-      const dl = a?.browser_download_url || a?.download_url || "";
-      if (!dl) { notes.push(`! asset missing download url: ${name}`); continue; }
-
-      const mediaDirAbs = path.join(PUBLIC_DIR, "media", ...pageKey.split("/"), ancre);
-      const destAbs = path.join(mediaDirAbs, name);
-      const urlPath = `${MEDIA_URL_ROOT}/${pageKey}/${ancre}/${name}`.replace(/\/{2,}/g, "/");
-
-      if (await exists(destAbs)) {
-        notes.push(`~ media already exists: ${urlPath}`);
-      } else if (!DRY_RUN) {
-        const bytes = await downloadToFile(dl, token, destAbs);
-        notes.push(`+ downloaded ${name} (${bytes} bytes) -> ${urlPath}`);
-        touchedFiles.push(path.relative(CWD, destAbs).replace(/\\/g, "/"));
-        changed = true;
-      } else {
-        notes.push(`(dry) would download ${name} -> ${urlPath}`);
-        changed = true;
-      }
-
-      const item = {
-        type: inferMediaTypeFromFilename(name),
-        src: urlPath,
-        caption: captionFinal,
-        credit: "",
-        ts: nowIso,
-        fromIssue: issueNum,
-      };
-
-      const before = entry.media.length;
-      entry.media = uniqUnion(entry.media, [item], keyMedia);
-      if (entry.media.length !== before) changed = true;
-    }
-
-    stableSortByTs(entry.media);
-  }
-
-  else {
-    throw Object.assign(new Error(`Type non supporté: "${type}"`), { __exitCode: 2 });
-  }
-
-  if (!changed) {
-    console.log("ℹ️  No changes to apply.");
-    for (const n of notes) console.log("  ", n);
-    return;
-  }
-
-  if (DRY_RUN) {
-    console.log("\n--- DRY RUN (no write) ---");
-    console.log(`Would update: ${shardRel}`);
-    for (const n of notes) console.log("  ", n);
-    console.log("\nExcerpt (resulting entry):");
-    console.log(YAML.stringify({ [ancre]: doc.paras[ancre] }).trimEnd());
-    console.log("\n✅ Dry-run terminé.");
-    return;
-  }
-
-  await saveAnnoDocYaml(shardAbs, doc, paraOrder);
-  touchedFiles.unshift(shardRel);
-
-  console.log(`✅ Updated: ${shardRel}`);
-  for (const n of notes) console.log("  ", n);
-
-  if (DO_COMMIT) {
-    run("git", ["add", ...touchedFiles], { cwd: CWD });
-
-    if (!gitHasStagedChanges()) {
-      console.log("ℹ️ Nothing to commit (aucun changement staged).");
-      return;
-    }
-
-    const msg = `anno: apply ticket #${issueNum} (${pageKey}#${ancre} ${type})`;
-    run("git", ["commit", "-m", msg], { cwd: CWD });
-
-    const sha = runQuiet("git", ["rev-parse", "--short", "HEAD"], { cwd: CWD }).trim();
-    console.log(`✅ Committed: ${msg} (${sha})`);
-
-    if (DO_CLOSE) {
-      const comment = `✅ Appliqué par apply-annotation-ticket.\nCommit: ${sha}`;
-      await closeIssue({ forgeApiBase, owner, repo, token, issueNum, comment });
-      console.log(`✅ Ticket #${issueNum} fermé.`);
-    }
-  } else {
-    console.log("\nNext (manuel) :");
-    console.log(`  git diff -- ${touchedFiles[0]}`);
-    console.log(`  git add ${touchedFiles.join(" ")}`);
-    console.log(`  git commit -m "anno: apply ticket #${issueNum} (${pageKey}#${ancre} ${type})"`);
-  }
-}
-
-main().catch((e) => {
-  const code = e?.__exitCode || 1;
-  console.error("💥", e?.message || e);
-  process.exit(code);
-});

scripts/build-annotations-index.mjs

@@ -1,106 +1,28 @@
-#!/usr/bin/env node
 // scripts/build-annotations-index.mjs
-// Construit dist/annotations-index.json à partir de src/annotations/**/*.yml
-// Supporte:
-//   - monolith : src/annotations/<pageKey>.yml
-//   - shard    : src/annotations/<pageKey>/<paraId>.yml   (paraId = p-<n>-...)
-// Invariants:
-//   - doc.schema === 1
-//   - doc.page (si présent) == pageKey déduit du chemin
-//   - shard: doc.paras doit contenir EXACTEMENT la clé paraId (sinon fail)
-//
-// Deep-merge non destructif (media/refs/comments dédupliqués), tri stable.
-
 import fs from "node:fs/promises";
 import path from "node:path";
 import YAML from "yaml";
 
-const ROOT = process.cwd();
-const ANNO_ROOT = path.join(ROOT, "src", "annotations");
-const DIST_DIR = path.join(ROOT, "dist");
-const OUT = path.join(DIST_DIR, "annotations-index.json");
+function parseArgs(argv) {
+  const out = {
+    inDir: "src/annotations",
+    outFile: "dist/annotations-index.json",
+  };
 
-function assert(cond, msg) {
-  if (!cond) throw new Error(msg);
-}
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
 
-function isObj(x) {
-  return !!x && typeof x === "object" && !Array.isArray(x);
-}
-function isArr(x) {
-  return Array.isArray(x);
-}
+    if (a === "--in" && argv[i + 1]) out.inDir = argv[++i];
+    else if (a.startsWith("--in=")) out.inDir = a.slice("--in=".length);
 
-function normPath(s) {
-  return String(s || "")
-    .replace(/\\/g, "/")
-    .replace(/^\/+|\/+$/g, "");
-}
-
-function paraNum(pid) {
-  const m = String(pid).match(/^p-(\d+)-/i);
-  return m ? Number(m[1]) : Number.POSITIVE_INFINITY;
-}
-
-function stableSortByTs(arr) {
-  if (!Array.isArray(arr)) return;
-  arr.sort((a, b) => {
-    const ta = Date.parse(a?.ts || "") || 0;
-    const tb = Date.parse(b?.ts || "") || 0;
-    if (ta !== tb) return ta - tb;
-    return JSON.stringify(a).localeCompare(JSON.stringify(b));
-  });
-}
-
-function keyMedia(x) { return String(x?.src || ""); }
-function keyRef(x) {
-  return `${x?.url || ""}||${x?.label || ""}||${x?.kind || ""}||${x?.citation || ""}`;
-}
-function keyComment(x) { return String(x?.text || "").trim(); }
-
-function uniqUnion(dst, src, keyFn) {
-  const out = isArr(dst) ? [...dst] : [];
-  const seen = new Set(out.map((x) => keyFn(x)));
-  for (const it of (isArr(src) ? src : [])) {
-    const k = keyFn(it);
-    if (!k) continue;
-    if (!seen.has(k)) {
-      seen.add(k);
-      out.push(it);
-    }
+    if (a === "--out" && argv[i + 1]) out.outFile = argv[++i];
+    else if (a.startsWith("--out=")) out.outFile = a.slice("--out=".length);
   }
   return out;
 }
 
-function deepMergeEntry(dst, src) {
-  if (!isObj(dst) || !isObj(src)) return;
-
-  for (const [k, v] of Object.entries(src)) {
-    if (k === "media" && isArr(v)) { dst.media = uniqUnion(dst.media, v, keyMedia); continue; }
-    if (k === "refs" && isArr(v)) { dst.refs = uniqUnion(dst.refs, v, keyRef); continue; }
-    if (k === "comments_editorial" && isArr(v)) { dst.comments_editorial = uniqUnion(dst.comments_editorial, v, keyComment); continue; }
-
-    if (isObj(v)) {
-      if (!isObj(dst[k])) dst[k] = {};
-      deepMergeEntry(dst[k], v);
-      continue;
-    }
-
-    if (isArr(v)) {
-      const cur = isArr(dst[k]) ? dst[k] : [];
-      const seen = new Set(cur.map((x) => JSON.stringify(x)));
-      const out = [...cur];
-      for (const it of v) {
-        const s = JSON.stringify(it);
-        if (!seen.has(s)) { seen.add(s); out.push(it); }
-      }
-      dst[k] = out;
-      continue;
-    }
-
-    // scalar: set only if missing/empty
-    if (!(k in dst) || dst[k] == null || dst[k] === "") dst[k] = v;
-  }
+async function exists(p) {
+  try { await fs.access(p); return true; } catch { return false; }
 }
 
 async function walk(dir) {
@@ -108,116 +30,111 @@ async function walk(dir) {
   const ents = await fs.readdir(dir, { withFileTypes: true });
   for (const e of ents) {
     const p = path.join(dir, e.name);
-    if (e.isDirectory()) out.push(...await walk(p));
-    else if (e.isFile() && /\.ya?ml$/i.test(e.name)) out.push(p);
+    if (e.isDirectory()) out.push(...(await walk(p)));
+    else out.push(p);
   }
   return out;
 }
 
-function inferExpectedFromRel(relNoExt) {
-  const parts = relNoExt.split("/").filter(Boolean);
-  const last = parts.at(-1) || "";
-  const isShard = parts.length > 1 && /^p-\d+-/i.test(last); // ✅ durcissement
-  const pageKey = isShard ? parts.slice(0, -1).join("/") : relNoExt;
-  const paraId = isShard ? last : null;
-  return { isShard, pageKey, paraId };
+function inferPageKeyFromFile(inDirAbs, fileAbs) {
+  // src/annotations/<page>.yml -> "<page>"
+  const rel = path.relative(inDirAbs, fileAbs).replace(/\\/g, "/");
+  return rel.replace(/\.(ya?ml|json)$/i, "");
 }
 
-function validateAndNormalizeDoc(doc, relFile, expectedPageKey, expectedParaId) {
-  assert(isObj(doc), `${relFile}: doc must be an object`);
-  assert(doc.schema === 1, `${relFile}: schema must be 1`);
-  assert(isObj(doc.paras), `${relFile}: missing object key "paras"`);
+function assert(cond, msg) {
+  if (!cond) throw new Error(msg);
+}
 
-  const gotPage = doc.page != null ? normPath(doc.page) : "";
-  const expPage = normPath(expectedPageKey);
+function isPlainObject(x) {
+  return !!x && typeof x === "object" && !Array.isArray(x);
+}
 
-  if (gotPage) {
-    assert(
-      gotPage === expPage,
-      `${relFile}: page mismatch (page="${doc.page}" vs path="${expectedPageKey}")`
-    );
-  } else {
-    doc.page = expPage;
-  }
+function normalizePageKey(s) {
+  // pas de / en tête/fin
+  return String(s || "").replace(/^\/+/, "").replace(/\/+$/, "");
+}
 
-  if (expectedParaId) {
-    const keys = Object.keys(doc.paras || {}).map(String);
+function validateAndNormalizeDoc(doc, pageKey, fileRel) {
+  assert(isPlainObject(doc), `${fileRel}: document must be an object`);
+  assert(doc.schema === 1, `${fileRel}: schema must be 1`);
+  if (doc.page != null) {
     assert(
-      keys.includes(expectedParaId),
-      `${relFile}: shard mismatch: must contain paras["${expectedParaId}"]`
-    );
-    assert(
-      keys.length === 1 && keys[0] === expectedParaId,
-      `${relFile}: shard invariant violated: shard file must contain ONLY paras["${expectedParaId}"] (got: ${keys.join(", ")})`
+      normalizePageKey(doc.page) === pageKey,
+      `${fileRel}: page mismatch (page="${doc.page}" vs path="${pageKey}")`
     );
   }
+  assert(isPlainObject(doc.paras), `${fileRel}: missing object key "paras"`);
 
-  return doc;
+  const parasOut = Object.create(null);
+
+  for (const [paraId, entry] of Object.entries(doc.paras)) {
+    assert(/^p-\d+-/i.test(paraId), `${fileRel}: invalid para id "${paraId}"`);
+
+    // entry peut être vide, mais doit être un objet si présent
+    assert(entry == null || isPlainObject(entry), `${fileRel}: paras.${paraId} must be an object`);
+
+    const e = entry ? { ...entry } : {};
+
+    // Sanity checks (non destructifs : on n’écrase pas, on vérifie juste les types)
+    if (e.refs != null) assert(Array.isArray(e.refs), `${fileRel}: paras.${paraId}.refs must be an array`);
+    if (e.authors != null) assert(Array.isArray(e.authors), `${fileRel}: paras.${paraId}.authors must be an array`);
+    if (e.quotes != null) assert(Array.isArray(e.quotes), `${fileRel}: paras.${paraId}.quotes must be an array`);
+    if (e.media != null) assert(Array.isArray(e.media), `${fileRel}: paras.${paraId}.media must be an array`);
+    if (e.comments_editorial != null) assert(Array.isArray(e.comments_editorial), `${fileRel}: paras.${paraId}.comments_editorial must be an array`);
+
+    parasOut[paraId] = e;
+  }
+
+  return parasOut;
+}
+
+async function readDoc(fileAbs) {
+  const raw = await fs.readFile(fileAbs, "utf8");
+  if (/\.json$/i.test(fileAbs)) return JSON.parse(raw);
+  return YAML.parse(raw);
 }
 
 async function main() {
-  const pages = {};
-  const errors = [];
+  const { inDir, outFile } = parseArgs(process.argv.slice(2));
+  const CWD = process.cwd();
 
-  await fs.mkdir(DIST_DIR, { recursive: true });
+  const inDirAbs = path.isAbsolute(inDir) ? inDir : path.join(CWD, inDir);
+  const outAbs = path.isAbsolute(outFile) ? outFile : path.join(CWD, outFile);
 
-  const files = await walk(ANNO_ROOT);
-
-  for (const fp of files) {
-    const rel = normPath(path.relative(ANNO_ROOT, fp));
-    const relNoExt = rel.replace(/\.ya?ml$/i, "");
-    const { isShard, pageKey, paraId } = inferExpectedFromRel(relNoExt);
-
-    try {
-      const raw = await fs.readFile(fp, "utf8");
-      const doc = YAML.parse(raw) || {};
-
-      if (!isObj(doc) || doc.schema !== 1) continue;
-
-      validateAndNormalizeDoc(
-        doc,
-        `src/annotations/${rel}`,
-        pageKey,
-        isShard ? paraId : null
-      );
-
-      const pg = (pages[pageKey] ??= { paras: {} });
-
-      if (isShard) {
-        const entry = doc.paras[paraId];
-        if (!isObj(pg.paras[paraId])) pg.paras[paraId] = {};
-        if (isObj(entry)) deepMergeEntry(pg.paras[paraId], entry);
-
-        stableSortByTs(pg.paras[paraId].media);
-        stableSortByTs(pg.paras[paraId].refs);
-        stableSortByTs(pg.paras[paraId].comments_editorial);
-      } else {
-        for (const [pid, entry] of Object.entries(doc.paras || {})) {
-          const p = String(pid);
-          if (!isObj(pg.paras[p])) pg.paras[p] = {};
-          if (isObj(entry)) deepMergeEntry(pg.paras[p], entry);
-
-          stableSortByTs(pg.paras[p].media);
-          stableSortByTs(pg.paras[p].refs);
-          stableSortByTs(pg.paras[p].comments_editorial);
-        }
-      }
-    } catch (e) {
-      errors.push({ file: `src/annotations/${rel}`, error: String(e?.message || e) });
-    }
+  // antifragile
+  if (!(await exists(inDirAbs))) {
+    console.log(`ℹ️  annotations-index: skip (input missing): ${inDir}`);
+    process.exit(0);
   }
 
-  for (const [pageKey, pg] of Object.entries(pages)) {
-    const keys = Object.keys(pg.paras || {});
-    keys.sort((a, b) => {
-      const ia = paraNum(a);
-      const ib = paraNum(b);
-      if (Number.isFinite(ia) && Number.isFinite(ib) && ia !== ib) return ia - ib;
-      return String(a).localeCompare(String(b));
-    });
-    const next = {};
-    for (const k of keys) next[k] = pg.paras[k];
-    pg.paras = next;
+  const files = (await walk(inDirAbs)).filter((p) => /\.(ya?ml|json)$/i.test(p));
+  if (!files.length) {
+    console.log(`ℹ️  annotations-index: skip (no .yml/.yaml/.json found in): ${inDir}`);
+    process.exit(0);
+  }
+
+  const pages = Object.create(null);
+  let paraCount = 0;
+
+  for (const f of files) {
+    const fileRel = path.relative(CWD, f).replace(/\\/g, "/");
+    const pageKey = normalizePageKey(inferPageKeyFromFile(inDirAbs, f));
+    assert(pageKey, `${fileRel}: cannot infer page key`);
+
+    let doc;
+    try {
+      doc = await readDoc(f);
+    } catch (e) {
+      throw new Error(`${fileRel}: parse failed: ${String(e?.message ?? e)}`);
+    }
+
+    const paras = validateAndNormalizeDoc(doc, pageKey, fileRel);
+
+    // 1 fichier = 1 page (canon)
+    assert(!pages[pageKey], `${fileRel}: duplicate page "${pageKey}" (only one file per page)`);
+    pages[pageKey] = { paras };
+    paraCount += Object.keys(paras).length;
   }
 
   const out = {
@@ -226,21 +143,17 @@ async function main() {
     pages,
     stats: {
       pages: Object.keys(pages).length,
-      paras: Object.values(pages).reduce((n, p) => n + Object.keys(p.paras || {}).length, 0),
-      errors: errors.length,
+      paras: paraCount,
     },
-    errors,
   };
 
-  if (errors.length) {
-    throw new Error(`${errors[0].file}: ${errors[0].error}`);
-  }
+  await fs.mkdir(path.dirname(outAbs), { recursive: true });
+  await fs.writeFile(outAbs, JSON.stringify(out), "utf8");
 
-  await fs.writeFile(OUT, JSON.stringify(out), "utf8");
-  console.log(`✅ annotations-index: pages=${out.stats.pages} paras=${out.stats.paras} -> dist/annotations-index.json`);
+  console.log(`✅ annotations-index: pages=${out.stats.pages} paras=${out.stats.paras} -> ${path.relative(CWD, outAbs)}`);
 }
 
 main().catch((e) => {
-  console.error(`FAIL: build-annotations-index crashed: ${e?.stack || e?.message || e}`);
+  console.error("FAIL: build-annotations-index crashed:", e);
   process.exit(1);
-});
+});

scripts/check-annotations-media.mjs

@@ -48,9 +48,6 @@ async function main() {
   let missing = 0;
   const notes = [];
 
-  // Optim: éviter de vérifier 100 fois le même fichier media
-  const seenMedia = new Set(); // src string
-
   for (const f of files) {
     const rel = path.relative(CWD, f).replace(/\\/g, "/");
     const raw = await fs.readFile(f, "utf8");
@@ -73,10 +70,6 @@ async function main() {
         const src = String(m?.src || "");
         if (!src.startsWith("/media/")) continue; // externes ok, ou autres conventions futures
 
-        // dédupe
-        if (seenMedia.has(src)) continue;
-        seenMedia.add(src);
-
         checked++;
         const p = toPublicPathFromUrl(src);
         if (!p) continue;
@@ -101,4 +94,4 @@ async function main() {
 main().catch((e) => {
   console.error("FAIL: check-annotations-media crashed:", e);
   process.exit(1);
-});
+});

scripts/check-annotations.mjs

@@ -27,6 +27,11 @@ function escRe(s) {
   return String(s).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
+function inferPageKeyFromFile(fileAbs) {
+  const rel = path.relative(ANNO_DIR, fileAbs).replace(/\\/g, "/");
+  return rel.replace(/\.(ya?ml|json)$/i, "");
+}
+
 function normalizePageKey(s) {
   return String(s || "").replace(/^\/+/, "").replace(/\/+$/, "");
 }
@@ -35,31 +40,6 @@ function isPlainObject(x) {
   return !!x && typeof x === "object" && !Array.isArray(x);
 }
 
-function isParaId(s) {
-  return /^p-\d+-/i.test(String(s || ""));
-}
-
-/**
- * Supporte:
- * - monolith: src/annotations/<pageKey>.yml -> pageKey = rel sans ext
- * - shard   : src/annotations/<pageKey>/<paraId>.yml -> pageKey = dirname(rel), paraId = basename
- *
- * shard seulement si le fichier est dans un sous-dossier (anti cas pathologique).
- */
-function inferFromFile(fileAbs) {
-  const rel = path.relative(ANNO_DIR, fileAbs).replace(/\\/g, "/");
-  const relNoExt = rel.replace(/\.(ya?ml|json)$/i, "");
-  const parts = relNoExt.split("/").filter(Boolean);
-  const base = parts[parts.length - 1] || "";
-  const dirParts = parts.slice(0, -1);
-
-  const isShard = dirParts.length > 0 && isParaId(base);
-  const pageKey = isShard ? dirParts.join("/") : relNoExt;
-  const paraId = isShard ? base : "";
-
-  return { pageKey: normalizePageKey(pageKey), paraId };
-}
-
 async function loadAliases() {
   if (!(await exists(ALIASES_PATH))) return {};
   try {
@@ -80,12 +60,10 @@ function getAlias(aliases, pageKey, oldId) {
   // supporte:
   // 1) { "<pageKey>": { "<old>": "<new>" } }
   // 2) { "<old>": "<new>" }
-  const k1 = String(pageKey || "");
-  const k2 = k1 ? ("/" + k1.replace(/^\/+|\/+$/g, "") + "/") : "";
-  const a1 = (aliases?.[k1]?.[oldId]) || (k2 ? aliases?.[k2]?.[oldId] : "");
-  if (a1) return String(a1);
+  const a1 = aliases?.[pageKey]?.[oldId];
+  if (a1) return a1;
   const a2 = aliases?.[oldId];
-  if (a2) return String(a2);
+  if (a2) return a2;
   return "";
 }
 
@@ -103,11 +81,7 @@ async function main() {
   const aliases = await loadAliases();
   const files = (await walk(ANNO_DIR)).filter((p) => /\.(ya?ml|json)$/i.test(p));
 
-  // perf: cache HTML par page (shards = beaucoup de fichiers pour 1 page)
-  const htmlCache = new Map();        // pageKey -> html
-  const missingDistPage = new Set();  // pageKey
-
-  let pagesSeen = new Set();
+  let pages = 0;
   let checked = 0;
   let failures = 0;
   const notes = [];
@@ -131,7 +105,7 @@ async function main() {
       continue;
     }
 
-    const { pageKey, paraId: shardParaId } = inferFromFile(f);
+    const pageKey = normalizePageKey(inferPageKeyFromFile(f));
 
     if (doc.page != null && normalizePageKey(doc.page) !== pageKey) {
       failures++;
@@ -145,44 +119,20 @@ async function main() {
       continue;
     }
 
-    // shard invariant (fort) : doit contenir paras[paraId]
-    if (shardParaId) {
-      if (!Object.prototype.hasOwnProperty.call(doc.paras, shardParaId)) {
-        failures++;
-        notes.push(`- SHARD MISMATCH: ${rel} (expected paras["${shardParaId}"] present)`);
-        continue;
-      }
-      // si extras -> warning (non destructif)
-      const keys = Object.keys(doc.paras);
-      if (!(keys.length === 1 && keys[0] === shardParaId)) {
-        notes.push(`- WARN shard has extra paras: ${rel} (expected only "${shardParaId}", got ${keys.join(", ")})`);
-      }
-    }
-
-    pagesSeen.add(pageKey);
-
     const distFile = path.join(DIST_DIR, pageKey, "index.html");
     if (!(await exists(distFile))) {
-      if (!missingDistPage.has(pageKey)) {
-        missingDistPage.add(pageKey);
-        failures++;
-        notes.push(`- MISSING PAGE: dist/${pageKey}/index.html (from ${rel})`);
-      } else {
-        notes.push(`- WARN missing page already reported: dist/${pageKey}/index.html (from ${rel})`);
-      }
+      failures++;
+      notes.push(`- MISSING PAGE: dist/${pageKey}/index.html (from ${rel})`);
       continue;
     }
 
-    let html = htmlCache.get(pageKey);
-    if (!html) {
-      html = await fs.readFile(distFile, "utf8");
-      htmlCache.set(pageKey, html);
-    }
+    pages++;
+    const html = await fs.readFile(distFile, "utf8");
 
     for (const paraId of Object.keys(doc.paras)) {
       checked++;
 
-      if (!isParaId(paraId)) {
+      if (!/^p-\d+-/i.test(paraId)) {
         failures++;
         notes.push(`- INVALID ID: ${rel} (${paraId})`);
         continue;
@@ -206,7 +156,6 @@ async function main() {
   }
 
   const warns = notes.filter((x) => x.startsWith("- WARN"));
-  const pages = pagesSeen.size;
 
   if (failures > 0) {
     console.error(`FAIL: annotations invalid (pages=${pages} checked=${checked} failures=${failures})`);
@@ -221,4 +170,4 @@ async function main() {
 main().catch((e) => {
   console.error("FAIL: annotations check crashed:", e);
   process.exit(1);
-});
+});

scripts/import-docx.mjs

@@ -114,6 +114,7 @@ async function runMammoth(docxPath, assetsOutDirWebRoot) {
   );
 
   let html = result.value || "";
+
   // Mammoth gives relative src="image-xx.png" ; we will prefix later
   return html;
 }
@@ -181,25 +182,6 @@ async function exists(p) {
   try { await fs.access(p); return true; } catch { return false; }
 }
 
-/**
- * ✅ compat:
- * - ancien : collection="archicratie" + slug="archicrat-ia/chapitre-3"
- * - nouveau : collection="archicrat-ia" + slug="chapitre-3"
- *
- * But : toujours écrire dans src/content/archicrat-ia/<slugSansPrefix>.mdx
- */
-function normalizeDest(collection, slug) {
-  let outCollection = String(collection || "").trim();
-  let outSlug = String(slug || "").trim().replace(/^\/+|\/+$/g, "");
-
-  if (outCollection === "archicratie" && outSlug.startsWith("archicrat-ia/")) {
-    outCollection = "archicrat-ia";
-    outSlug = outSlug.replace(/^archicrat-ia\//, "");
-  }
-
-  return { outCollection, outSlug };
-}
-
 async function main() {
   const args = parseArgs(process.argv);
   const manifestPath = path.resolve(args.manifest);
@@ -221,14 +203,11 @@ async function main() {
 
   for (const it of selected) {
     const docxPath = path.resolve(it.source);
-
-    const { outCollection, outSlug } = normalizeDest(it.collection, it.slug);
-
-    const outFile = path.resolve("src/content", outCollection, `${outSlug}.mdx`);
+    const outFile = path.resolve("src/content", it.collection, `${it.slug}.mdx`);
     const outDir = path.dirname(outFile);
 
-    const assetsPublicDir = path.posix.join("/imported", outCollection, outSlug);
-    const assetsDiskDir = path.resolve("public", "imported", outCollection, outSlug);
+    const assetsPublicDir = path.posix.join("/imported", it.collection, it.slug);
+    const assetsDiskDir = path.resolve("public", "imported", it.collection, it.slug);
 
     if (!(await exists(docxPath))) {
       throw new Error(`Missing source docx: ${docxPath}`);
@@ -262,20 +241,18 @@ async function main() {
       html = rewriteLocalImageLinks(html, assetsPublicDir);
       body = html.trim() ? html : "<p>(Import vide)</p>";
     }
-
+  
     const defaultVersion = process.env.PUBLIC_RELEASE || "0.1.0";
 
-    // ✅ IMPORTANT: archicrat-ia partage edition/status avec archicratie (pas de migration frontmatter)
     const schemaDefaultsByCollection = {
-      archicratie:   { edition: "archicratie", status: "modele_sociopolitique", level: 1 },
-      "archicrat-ia": { edition: "archicrat-ia", status: "essai_these", level: 1 },
-      ia:            { edition: "ia",         status: "cas_pratique",           level: 1 },
-      traite:        { edition: "traite",     status: "ontodynamique",          level: 1 },
-      glossaire:     { edition: "glossaire",  status: "lexique",                level: 1 },
-      atlas:         { edition: "atlas",      status: "atlas",                  level: 1 },
+      archicratie: { edition: "archicratie", status: "modele_sociopolitique", level: 1 },
+      ia:         { edition: "ia",         status: "cas_pratique",           level: 1 },
+      traite:     { edition: "traite",     status: "ontodynamique",          level: 1 },
+      glossaire:  { edition: "glossaire",  status: "lexique",                level: 1 },
+      atlas:      { edition: "atlas",      status: "atlas",                  level: 1 },
     };
 
-    const defaults = schemaDefaultsByCollection[outCollection] || { edition: outCollection, status: "draft", level: 1 };
+    const defaults = schemaDefaultsByCollection[it.collection] || { edition: it.collection, status: "draft", level: 1 };
 
     const fm = [
       "---",
@@ -305,4 +282,4 @@ async function main() {
 main().catch((e) => {
   console.error("\nERROR:", e?.message || e);
   process.exit(1);
-});
+});

scripts/inject-anchor-aliases.mjs

@@ -14,24 +14,6 @@ const STRICT = argv.includes("--strict") || process.env.CI === "1" || process.en
 function escRe(s) {
   return String(s).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-
-async function exists(p) {
-  try {
-    await fs.access(p);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-function normalizeRoute(route) {
-  let r = String(route || "").trim();
-  if (!r.startsWith("/")) r = "/" + r;
-  if (!r.endsWith("/")) r = r + "/";
-  r = r.replace(/\/{2,}/g, "/");
-  return r;
-}
-
 function countIdAttr(html, id) {
   const re = new RegExp(`\\bid=(["'])${escRe(id)}\\1`, "gi");
   let c = 0;
@@ -40,6 +22,7 @@ function countIdAttr(html, id) {
 }
 
 function findStartTagWithId(html, id) {
+  // 1er élément qui porte id="..."
   const re = new RegExp(
     `<([a-zA-Z0-9:-]+)\\b[^>]*\\bid=(["'])${escRe(id)}\\2[^>]*>`,
     "i"
@@ -53,10 +36,34 @@ function isInjectedAliasSpan(html, id) {
   const found = findStartTagWithId(html, id);
   if (!found) return false;
   if (found.tagName !== "span") return false;
+  // class="... para-alias ..."
   return /\bclass=(["'])(?:(?!\1).)*\bpara-alias\b(?:(?!\1).)*\1/i.test(found.tag);
 }
+  
+function normalizeRoute(route) {
+  let r = String(route || "").trim();
+  if (!r.startsWith("/")) r = "/" + r;
+  if (!r.endsWith("/")) r = r + "/";
+  r = r.replace(/\/{2,}/g, "/");
+  return r;
+}
+
+async function exists(p) {
+  try {
+    await fs.access(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function hasId(html, id) {
+  const re = new RegExp(`\\bid=(["'])${escRe(id)}\\1`, "i");
+  return re.test(html);
+}
 
 function injectBeforeId(html, newId, injectHtml) {
+  // insère juste avant la balise qui porte id="newId"
   const re = new RegExp(
     `(<[^>]+\\bid=(["'])${escRe(newId)}\\2[^>]*>)`,
     "i"
@@ -75,7 +82,6 @@ async function main() {
   }
 
   const raw = await fs.readFile(ALIASES_PATH, "utf-8");
-
   /** @type {Record<string, Record<string,string>>} */
   let aliases;
   try {
@@ -83,7 +89,6 @@ async function main() {
   } catch (e) {
     throw new Error(`JSON invalide: ${ALIASES_PATH} (${e?.message || e})`);
   }
-
   if (!aliases || typeof aliases !== "object" || Array.isArray(aliases)) {
     throw new Error(`Format invalide: attendu { route: { oldId: newId } } dans ${ALIASES_PATH}`);
   }
@@ -109,10 +114,10 @@ async function main() {
       console.log(msg);
       warnCount++;
     }
-
+    
     if (entries.length === 0) continue;
 
-    const rel = route.replace(/^\/+|\/+$/g, "");
+    const rel = route.replace(/^\/+|\/+$/g, ""); // sans slash
     const htmlPath = path.join(DIST_ROOT, rel, "index.html");
 
     if (!(await exists(htmlPath))) {
@@ -130,8 +135,24 @@ async function main() {
       if (!oldId || !newId) continue;
 
       const oldCount = countIdAttr(html, oldId);
+      if (oldCount > 0) {
+        // ✅ déjà injecté (idempotent)
+        if (isInjectedAliasSpan(html, oldId)) continue;
 
-      // ✅ déjà injecté => idempotent
+        // ⛔️ oldId existe déjà "en vrai" (ex: <p id="oldId">)
+        // => alias inutile / inversé / obsolète
+        const found = findStartTagWithId(html, oldId);
+        const where = found ? `<${found.tagName} … id="${oldId}" …>` : `id="${oldId}"`;
+        const msg =
+          `⚠️  alias inutile/inversé: oldId déjà présent dans la page (${where}). ` +
+          `Supprime l'alias ${oldId} -> ${newId} (ou corrige le sens) pour route=${route}`;
+        if (STRICT) throw new Error(msg);
+        console.log(msg);
+        warnCount++;
+        continue;
+      }
+
+      // juste après avoir calculé oldCount
       if (oldCount > 0 && isInjectedAliasSpan(html, oldId)) {
         if (STRICT && oldCount !== 1) {
           throw new Error(`oldId dupliqué (${oldCount}) alors qu'il est censé être unique: ${route} id=${oldId}`);
@@ -139,23 +160,18 @@ async function main() {
         continue;
       }
 
-      // ⛔️ oldId existe déjà "en vrai" => alias inutile/inversé
-      if (oldCount > 0) {
-        const found = findStartTagWithId(html, oldId);
-        const where = found ? `<${found.tagName} … id="${oldId}" …>` : `id="${oldId}"`;
-        const msg =
-          `⚠️  alias inutile/inversé: oldId déjà présent (${where}). ` +
-          `Supprime ${oldId} -> ${newId} (ou corrige le sens) pour route=${route}`;
+      // avant l'injection, après hasId(newId)
+      const newCount = countIdAttr(html, newId);
+      if (newCount !== 1) {
+        const msg = `⚠️  newId non-unique (${newCount}) : ${route} new=${newId} (injection ambiguë)`;
         if (STRICT) throw new Error(msg);
         console.log(msg);
         warnCount++;
         continue;
       }
 
-      // newId doit exister UNE fois (sinon injection ambiguë)
-      const newCount = countIdAttr(html, newId);
-      if (newCount !== 1) {
-        const msg = `⚠️  newId non-unique (${newCount}) : ${route} new=${newId} (injection ambiguë)`;
+      if (!hasId(html, newId)) {
+        const msg = `⚠️  newId introuvable: ${route} old=${oldId} -> new=${newId}`;
         if (STRICT) throw new Error(msg);
         console.log(msg);
         warnCount++;

scripts/purge-dist-dev-whoami.mjs

@@ -1,31 +0,0 @@
-// scripts/purge-dist-dev-whoami.mjs
-import fs from "node:fs/promises";
-import path from "node:path";
-
-const CWD = process.cwd();
-const targetDir = path.join(CWD, "dist", "_auth", "whoami");
-const targetIndex = path.join(CWD, "dist", "_auth", "whoami", "index.html");
-
-// Purge idempotente (force=true => pas d'erreur si absent)
-async function rmSafe(p) {
-  try {
-    await fs.rm(p, { recursive: true, force: true });
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-async function main() {
-  const removedIndex = await rmSafe(targetIndex);
-  const removedDir = await rmSafe(targetDir);
-
-  // Optionnel: si dist/_auth devient vide, on laisse tel quel (pas besoin de toucher)
-  const any = removedIndex || removedDir;
-  console.log(`✅ purge-dist-dev-whoami: ${any ? "purged" : "nothing to purge"}`);
-}
-
-main().catch((e) => {
-  console.error("❌ purge-dist-dev-whoami failed:", e);
-  process.exit(1);
-});

scripts/verify-anchor-aliases-in-dist.mjs

@@ -205,7 +205,7 @@ for (const [route, mapping] of Object.entries(data)) {
         newId,
         htmlPath,
         msg:
-          `oldId present but is NOT an injected alias span (<span class="para-alias">).\n` +
+          `oldId present but is NOT an injected alias span (<span class="para-alias">).</n` +
           `Saw: ${seen}`,
       });
       continue;

scripts/write-dev-whoami.mjs

@@ -1,26 +0,0 @@
-import fs from "node:fs/promises";
-import path from "node:path";
-
-const OUT = path.join(process.cwd(), "public", "_auth", "whoami");
-
-const groupsRaw = process.env.PUBLIC_WHOAMI_GROUPS ?? "editors";
-const user = process.env.PUBLIC_WHOAMI_USER ?? "dev";
-const name = process.env.PUBLIC_WHOAMI_NAME ?? "Dev Local";
-const email = process.env.PUBLIC_WHOAMI_EMAIL ?? "area.technik@proton.me";
-
-const groups = groupsRaw
-  .split(/[;,]/)
-  .map((s) => s.trim())
-  .filter(Boolean)
-  .join(",");
-
-const body =
-  `Remote-User: ${user}\n` +
-  `Remote-Name: ${name}\n` +
-  `Remote-Email: ${email}\n` +
-  `Remote-Groups: ${groups}\n`;
-
-await fs.mkdir(path.dirname(OUT), { recursive: true });
-await fs.writeFile(OUT, body, "utf8");
-
-console.log(`✅ dev whoami written: ${path.relative(process.cwd(), OUT)} (${groups})`);

src/anchors/anchor-aliases.json

@@ -1,5 +1,2 @@
-{
-  "/archicrat-ia/chapitre-3/": {
-    "p-1-60c7ea48": "p-1-a21087b0"
-  }
-}
+{}
+  

src/annotations/archicrat-ia/prologue.yml

@@ -0,0 +1,59 @@
+schema: 1
+
+# optionnel (si présent, doit matcher le chemin du fichier)
+page: archicratie/archicrat-ia/prologue
+
+paras:
+  p-0-d7974f88:
+    refs:
+      - label: "Happycratie — (Cabanas & Illouz) via Cairn"
+        url: "https://shs.cairn.info/revue-ethnologie-francaise-2019-4-page-813?lang=fr"
+        kind: "article"
+      - label: "Techno-féodalisme — Variations (OpenEdition)"
+        url: "https://journals.openedition.org/variations/2290"
+        kind: "article"
+
+    authors:
+      - "Eva Illouz"
+      - "Yanis Varoufakis"
+
+    quotes:
+      - text: "Dans Happycratie, Edgar Cabanas et Eva Illouz..."
+        source: "Happycratie, p.1"
+      - text: "En eux-mêmes, les actifs ne sont ni féodaux ni capitalistes..."
+        source: "Entretien Morozov/Varoufakis — techno-féodalisme"
+
+    media:
+      - type: "image"
+        src: "/public/media/archicratie/archicrat-ia/prologue/p-0-d7974f88/schema-1.svg"
+        caption: "Tableau explicatif"
+        credit: "ChatGPT"
+      - type: "image"
+        src: "/public/media/archicratie/archicrat-ia/prologue/p-0-d7974f88/schema-2.svg"
+        caption: "Diagramme d’évolution"
+        credit: "Yanis Varoufakis"
+
+    comments_editorial:
+      - text: "TODO: nuancer / préciser — commentaire éditorial versionné (pas public)."
+        status: "draft"
+
+  p-1-2ef25f29:
+    refs:
+      - label: "Kafka et le pouvoir — Bernard Lahire (Cairn)"
+        url: "https://shs.cairn.info/franz-kafka--9782707159410-page-475?lang=fr"
+        kind: "book"
+
+    authors:
+      - "Bernard Lahire"
+
+    quotes:
+      - text: "Si l’on voulait chercher quelque chose comme une vision du monde chez Kafka..."
+        source: "Bernard Lahire, Franz Kafka, p.475+"
+
+    media:
+      - type: "video"
+        src: "/media/prologue/p-1-2ef25f29/bien_commun.mp4"
+        caption: "Entretien avec Bernard Lahire"
+        credit: "Cairn.info"
+
+    comments_editorial: []

src/components/EditionToc.astro

@@ -3,11 +3,14 @@ import { getCollection } from "astro:content";
 
 const { currentSlug } = Astro.props;
 
-// ✅ Après migration : TOC = collection "archicrat-ia"
-const entries = (await getCollection("archicrat-ia"))
+const entries = (await getCollection("archicratie"))
+  .filter((e) => e.slug.startsWith("archicrat-ia/"))
   .sort((a, b) => (a.data.order ?? 0) - (b.data.order ?? 0));
 
-const href = (slug) => `/archicrat-ia/${slug}/`;
+// ✅ On route l’Essai-thèse sur /archicrat-ia/<slug-sans-prefix>/
+// (Astro trailingSlash = always → on garde le "/" final)
+const strip = (s) => String(s || "").replace(/^archicrat-ia\//, "");
+const href = (slug) => `/archicrat-ia/${strip(slug)}/`;
 ---
 
 <nav class="toc-global" aria-label="Table des matières — ArchiCraT-IA">
@@ -160,4 +163,4 @@ const href = (slug) => `/archicrat-ia/${slug}/`;
   const active = document.querySelector(".toc-global .toc-item.is-active");
   if (active) active.scrollIntoView({ block: "nearest" });
 })();
-</script>
+</script>

src/components/SidePanel.astro

@@ -25,12 +25,12 @@
 
     {/* ✅ actions références en haut (niveau 2 uniquement) */}
     <div class="panel-top-actions level-2" aria-label="Actions références">
-      <div class="panel-actions">
+    <div class="panel-actions">
         <button class="panel-btn panel-btn--primary" id="panel-ref-submit" type="button">
-          Soumettre une référence (Gitea)
+        Soumettre une référence (Gitea)
         </button>
-      </div>
-      <div class="panel-msg" id="panel-ref-msg" hidden></div>
+    </div>
+    <div class="panel-msg" id="panel-ref-msg" hidden></div>
     </div>
 
     <section class="panel-block level-2" aria-label="Références et auteurs">
@@ -60,7 +60,7 @@
     </section>
   </div>
 
-  {/* ✅ Lightbox media (plein écran) */}
+  {/* ✅ Lightbox media (pop-up au-dessus du panel) */}
   <div class="panel-lightbox" id="panel-lightbox" hidden aria-hidden="true">
     <div class="panel-lightbox__overlay" data-close="1"></div>
     <div class="panel-lightbox__dialog" role="dialog" aria-modal="true" aria-label="Aperçu du média">
@@ -93,9 +93,6 @@
   const btnMediaSubmit = root.querySelector("#panel-media-submit");
   const msgMedia = root.querySelector("#panel-media-msg");
 
-  const btnRefSubmit = root.querySelector("#panel-ref-submit");
-  const msgRef = root.querySelector("#panel-ref-msg");
-
   const taComment = root.querySelector("#panel-comment-text");
   const btnSend = root.querySelector("#panel-comment-send");
   const msgComment = root.querySelector("#panel-comment-msg");
@@ -104,6 +101,9 @@
   const lbContent = root.querySelector("#panel-lightbox-content");
   const lbCaption = root.querySelector("#panel-lightbox-caption");
 
+  const btnRefSubmit = root.querySelector("#panel-ref-submit");
+  const msgRef = root.querySelector("#panel-ref-msg");
+
   const docTitle = document.body?.dataset?.docTitle || document.title || "Archicratie";
   const docVersion = document.body?.dataset?.docVersion || "";
 
@@ -114,16 +114,6 @@
   let currentParaId = "";
   let mediaShowAll = (localStorage.getItem("archicratie:panel:mediaAll") === "1");
 
-  // ===== cosmetics: micro flash “update” =====
-  let _flashT = 0;
-  function flashUpdate(){
-    try {
-      root.classList.add("is-updating");
-      if (_flashT) clearTimeout(_flashT);
-      _flashT = setTimeout(() => root.classList.remove("is-updating"), 180);
-    } catch {}
-  }
-
   // ===== globals =====
   function getG() {
     return window.__archiGitea || { ready: false, base: "", owner: "", repo: "" };
@@ -131,6 +121,9 @@
   function getAuthInfoP() {
     return window.__archiAuthInfoP || Promise.resolve({ ok: false, groups: [] });
   }
+  function isDev() {
+    return Boolean((window.__archiFlags && window.__archiFlags.dev) || /^(localhost|127\.0\.0\.1|\[::1\])$/i.test(location.hostname));
+  }
 
   const access = { ready: false, canUsers: false };
 
@@ -144,20 +137,23 @@
     return Array.isArray(groups) && groups.some((x) => String(x).toLowerCase() === gg);
   }
 
-  // ✅ readers + editors peuvent soumettre médias + commentaires + refs
+  // ✅ règle mission : readers + editors peuvent soumettre médias + commentaires
+  // ✅ dev fallback : si /_auth/whoami n’existe pas, on autorise pour tester
   getAuthInfoP().then((info) => {
     const groups = Array.isArray(info?.groups) ? info.groups : [];
     const canReaders = inGroup(groups, "readers");
     const canEditors = inGroup(groups, "editors");
 
-    const whoamiSkipped = Boolean(window.__archiFlags && window.__archiFlags.whoamiSkipped);
-    access.canUsers = Boolean((info?.ok && (canReaders || canEditors)) || whoamiSkipped);
+    access.canUsers = Boolean((info?.ok && (canReaders || canEditors)) || (isDev() && !info?.ok));
     access.ready = true;
 
     if (btnMediaSubmit) btnMediaSubmit.disabled = !access.canUsers;
     if (btnSend) btnSend.disabled = !access.canUsers;
+
     if (btnRefSubmit) btnRefSubmit.disabled = !access.canUsers;
 
+
+    // si pas d'accès, on informe (soft)
     if (!access.canUsers) {
       if (msgHead) {
         msgHead.hidden = false;
@@ -166,12 +162,12 @@
       }
     }
   }).catch(() => {
+    // fallback dev
     access.ready = true;
-    if (Boolean(window.__archiFlags && window.__archiFlags.whoamiSkipped)) {
+    if (isDev()) {
       access.canUsers = true;
       if (btnMediaSubmit) btnMediaSubmit.disabled = false;
       if (btnSend) btnSend.disabled = false;
-      if (btnRefSubmit) btnRefSubmit.disabled = false;
     }
   });
 
@@ -213,11 +209,8 @@
   async function loadIndex() {
     if (_idxP) return _idxP;
     _idxP = (async () => {
-      try {
-        const res = await fetch("/annotations-index.json?_=" + Date.now(), { cache: "no-store" });
-        if (res && res.ok) return await res.json();
-      } catch {}
-      _idxP = null;
+      const res = await fetch("/annotations-index.json?_=" + Date.now(), { cache: "no-store" }).catch(() => null);
+      if (res && res.ok) return await res.json();
       return null;
     })();
     return _idxP;
@@ -258,22 +251,24 @@
     return issue.toString();
   }
 
-  function openNewTab(url) {
-    try {
-      const a = document.createElement("a");
-      a.href = url;
-      a.target = "_blank";
-      a.rel = "noopener noreferrer";
-      a.style.display = "none";
-      document.body.appendChild(a);
-      a.click();
-      a.remove();
-      return true;
-    } catch {
-      return false;
+  // Ouvre un nouvel onglet UNE SEULE FOIS (évite le double-open Safari/Firefox + noopener).
+    function openNewTab(url) {
+        try {
+            const a = document.createElement("a");
+            a.href = url;
+            a.target = "_blank";
+            a.rel = "noopener noreferrer";
+            a.style.display = "none";
+            document.body.appendChild(a);
+            a.click();
+            a.remove();
+            return true; // on ne peut pas détecter proprement un blocage sans retomber dans le double-open
+        } catch {
+            return false;
+        }
     }
-  }
 
+  // ====== GARDES ANTI-DOUBLONS ======
   const _openStamp = new Map();
   function openOnce(key, fn) {
     const now = Date.now();
@@ -302,21 +297,13 @@
   }
 
   // ===== Lightbox =====
-  function lockScroll(on) {
-    try {
-      document.documentElement.classList.toggle("archi-lb-open", !!on);
-    } catch {}
-  }
-
   function closeLightbox() {
     if (!lb) return;
     lb.hidden = true;
     lb.setAttribute("aria-hidden", "true");
     if (lbContent) clear(lbContent);
     if (lbCaption) { lbCaption.hidden = true; lbCaption.textContent = ""; }
-    lockScroll(false);
   }
-
   function openLightbox({ type, src, caption }) {
     if (!lb || !lbContent) return;
     clear(lbContent);
@@ -355,7 +342,6 @@
       else { lbCaption.hidden = true; lbCaption.textContent = ""; }
     }
 
-    lockScroll(true);
     lb.hidden = false;
     lb.setAttribute("aria-hidden", "false");
   }
@@ -373,6 +359,7 @@
     });
   }
 
+  // ===== Renders =====
   function renderLevel2(data) {
     clear(elL2);
     if (!elL2) return;
@@ -572,22 +559,11 @@
   async function updatePanel(paraId) {
     currentParaId = paraId || currentParaId || "";
     if (elId) elId.textContent = currentParaId || "—";
-
-    flashUpdate();
-
     hideMsg(msgHead);
     hideMsg(msgMedia);
     hideMsg(msgComment);
-    hideMsg(msgRef);
 
     const idx = await loadIndex();
-
-    if (!idx && msgHead && msgHead.hidden) {
-      msgHead.hidden = false;
-      msgHead.textContent = "Index annotations indisponible (annotations-index.json).";
-      msgHead.dataset.kind = "info";
-    }
-
     const data = idx?.pages?.[pageKey]?.paras?.[currentParaId] || null;
 
     renderLevel2(data);
@@ -595,6 +571,7 @@
     renderLevel4(data);
   }
 
+  // ===== media "voir tous" =====
   if (btnMediaAll) {
     bindClickOnce(btnMediaAll, (ev) => {
       ev.preventDefault();
@@ -606,6 +583,7 @@
     btnMediaAll.textContent = mediaShowAll ? "Réduire la liste" : "Voir tous les éléments";
   }
 
+  // ===== media submit (readers + editors) =====
   if (btnMediaSubmit) {
     bindClickOnce(btnMediaSubmit, (ev) => {
       ev.preventDefault();
@@ -648,26 +626,27 @@
     });
   }
 
-  if (btnRefSubmit) {
+  // ===== référence submit (readers + editors) =====
+    if (btnRefSubmit) {
     bindClickOnce(btnRefSubmit, (ev) => {
-      ev.preventDefault();
-      hideMsg(msgRef);
+        ev.preventDefault();
+        hideMsg(msgRef);
 
-      if (guardEventOnce(ev, "gitea_open_ref")) return;
+        if (guardEventOnce(ev, "gitea_open_ref")) return;
 
-      if (!currentParaId) return showMsg(msgRef, "Choisis d’abord un paragraphe (scroll / survol).", "warn");
-      if (!getG().ready) return showMsg(msgRef, "Gitea non configuré (PUBLIC_GITEA_*).", "error");
-      if (btnRefSubmit.disabled) return showMsg(msgRef, "Connexion requise (readers/editors).", "error");
+        if (!currentParaId) return showMsg(msgRef, "Choisis d’abord un paragraphe (scroll / survol).", "warn");
+        if (!getG().ready) return showMsg(msgRef, "Gitea non configuré (PUBLIC_GITEA_*).", "error");
+        if (btnRefSubmit.disabled) return showMsg(msgRef, "Connexion requise (readers/editors).", "error");
 
-      const pageUrl = new URL(location.href);
-      pageUrl.search = "";
-      pageUrl.hash = currentParaId;
+        const pageUrl = new URL(location.href);
+        pageUrl.search = "";
+        pageUrl.hash = currentParaId;
 
-      const paraTxt = getParaText(currentParaId);
-      const excerpt = paraTxt.length > FULL_TEXT_SOFT_LIMIT ? (paraTxt.slice(0, FULL_TEXT_SOFT_LIMIT) + "…") : paraTxt;
+        const paraTxt = getParaText(currentParaId);
+        const excerpt = paraTxt.length > FULL_TEXT_SOFT_LIMIT ? (paraTxt.slice(0, FULL_TEXT_SOFT_LIMIT) + "…") : paraTxt;
 
-      const title = `[Reference] ${currentParaId} — ${docTitle}`;
-      const body = [
+        const title = `[Reference] ${currentParaId} — ${docTitle}`;
+        const body = [
         `Chemin: ${location.pathname}`,
         `URL: ${pageUrl.toString()}`,
         `Ancre: #${currentParaId}`,
@@ -685,16 +664,18 @@
         ``,
         `---`,
         `Note: issue générée depuis le site (pré-remplissage).`,
-      ].join("\n");
+        ].join("\n");
 
-      const url = buildIssueURL({ title, body });
-      if (!url) return showMsg(msgRef, "Impossible de générer l’issue.", "error");
+        const url = buildIssueURL({ title, body });
+        if (!url) return showMsg(msgRef, "Impossible de générer l’issue.", "error");
 
-      const ok = openOnce(`ref:${currentParaId}`, () => openNewTab(url));
-      if (!ok) showMsg(msgRef, "Si rien ne s’ouvre : autorise les popups pour ce site.", "error");
+        const ok = openOnce(`ref:${currentParaId}`, () => openNewTab(url));
+        if (!ok) showMsg(msgRef, "Si rien ne s’ouvre : autorise les popups pour ce site.", "error");
     });
-  }
+    }
 
+
+  // ===== commentaire (readers + editors) =====
   if (btnSend) {
     bindClickOnce(btnSend, (ev) => {
       ev.preventDefault();
@@ -746,31 +727,60 @@
     });
   }
 
-  // ===== wiring: para courant (SOURCE OF TRUTH = EditionLayout) =====
-  function onCurrentPara(ev) {
-    try {
-      const id = ev?.detail?.id ? String(ev.detail.id) : "";
-      if (!id || !/^p-\d+-/i.test(id)) return;
-      if (id === currentParaId) return;
-      updatePanel(id);
-    } catch {}
+  // ===== wiring: para courant (aligné sur le paragraphe sous le reading-follow) =====
+  function isPara(el) {
+    return Boolean(el && el.nodeType === 1 && el.matches && el.matches('.reading p[id^="p-"]'));
   }
-  window.addEventListener("archicratie:currentPara", onCurrentPara);
 
-  const initial = String(location.hash || "").replace(/^#/, "").trim();
+  function pickParaAtY(y) {
+    const x = Math.max(0, Math.round(window.innerWidth * 0.5));
+    const candidates = [
+      document.elementFromPoint(x, y),
+      document.elementFromPoint(Math.min(window.innerWidth - 1, x + 60), y),
+      document.elementFromPoint(Math.max(0, x - 60), y),
+    ].filter(Boolean);
 
-  if (/^p-\d+-/i.test(initial)) {
-    updatePanel(initial);
-  } else if (window.__archiCurrentParaId && /^p-\d+-/i.test(String(window.__archiCurrentParaId))) {
-    updatePanel(String(window.__archiCurrentParaId));
-  } else {
-    setTimeout(() => {
-      try {
-        const id = String(window.__archiCurrentParaId || "").trim();
-        if (/^p-\d+-/i.test(id)) updatePanel(id);
-      } catch {}
-    }, 0);
+    for (const c of candidates) {
+      if (isPara(c)) return c;
+      const p = c.closest ? c.closest('.reading p[id^="p-"]') : null;
+      if (isPara(p)) return p;
+    }
+    return null;
   }
+
+  let _lastPicked = "";
+  function syncFromFollowLine() {
+    const off = Number(document.documentElement.style.getPropertyValue("--sticky-offset-px")) || 0;
+    const y = Math.round(off + 8);
+    const p = pickParaAtY(y);
+    if (!p || !p.id) return;
+    if (p.id === _lastPicked) return;
+    _lastPicked = p.id;
+
+    // met à jour l'app global (EditionLayout écoute déjà currentPara)
+    try { window.dispatchEvent(new CustomEvent("archicratie:currentPara", { detail: { id: p.id } })); } catch {}
+
+    // et met à jour le panel immédiatement (sans attendre)
+    updatePanel(p.id);
+  }
+
+  let ticking = false;
+  function onScroll() {
+    if (ticking) return;
+    ticking = true;
+    requestAnimationFrame(() => {
+      ticking = false;
+      syncFromFollowLine();
+    });
+  }
+
+  window.addEventListener("scroll", onScroll, { passive: true });
+  window.addEventListener("resize", onScroll);
+
+  // Initial: hash > sinon calc
+  const initial = String(location.hash || "").replace(/^#/, "");
+  if (/^p-\d+-/i.test(initial)) updatePanel(initial);
+  else setTimeout(() => { try { syncFromFollowLine(); } catch {} }, 0);
 })();
 </script>
 
@@ -783,8 +793,6 @@
     position: sticky;
     top: calc(var(--sticky-header-h) + var(--page-gap));
     align-self: start;
-
-    --thumb: 92px; /* ✅ taille des vignettes (80–110 selon goût) */
   }
 
   :global(body[data-reading-level="3"]) .page-panel{
@@ -902,33 +910,28 @@
   /* actions médias en haut */
   .panel-top-actions{ margin-top: 8px; }
 
-  /* ===== media thumbnails (plus petits + plus denses) ===== */
+  /* ===== media thumbnails (150x150) ===== */
   .panel-media-grid{
     display: grid;
-    grid-template-columns: repeat(auto-fill, minmax(var(--thumb), 1fr));
+    grid-template-columns: repeat(auto-fill, minmax(150px, 1fr));
     gap: 10px;
   }
 
   .panel-media-tile{
-    width: 100%;
+    width: 150px;
+    max-width: 100%;
     border: 1px solid rgba(127,127,127,.20);
     border-radius: 14px;
     padding: 8px;
     background: rgba(127,127,127,0.04);
     cursor: pointer;
     text-align: left;
-    transition: transform 120ms ease, background 120ms ease, border-color 120ms ease;
-  }
-
-  .panel-media-tile:hover{
-    transform: translateY(-1px);
-    background: rgba(127,127,127,0.07);
-    border-color: rgba(127,127,127,.32);
   }
 
   .panel-media-tile img{
-    width: 100%;
-    height: var(--thumb);
+    width: 150px;
+    height: 150px;
+    max-width: 100%;
     object-fit: cover;
     display: block;
     border-radius: 10px;
@@ -936,8 +939,8 @@
   }
 
   .panel-media-ph{
-    width: 100%;
-    height: var(--thumb);
+    width: 150px;
+    height: 150px;
     border-radius: 10px;
     display: grid;
     place-items: center;
@@ -980,11 +983,7 @@
     resize: vertical;
   }
 
-  /* ===== Lightbox (plein écran “cinéma”) ===== */
-  :global(html.archi-lb-open){
-    overflow: hidden; /* ✅ empêche le scroll derrière */
-  }
-
+  /* ===== Lightbox ===== */
   .panel-lightbox{
     position: fixed;
     inset: 0;
@@ -994,66 +993,58 @@
   .panel-lightbox__overlay{
     position: absolute;
     inset: 0;
-    background: rgba(0,0,0,0.84);
-    backdrop-filter: blur(10px);
-    -webkit-backdrop-filter: blur(10px);
+    background: rgba(0,0,0,0.80);
+    backdrop-filter: blur(6px);
+    -webkit-backdrop-filter: blur(6px);
   }
 
   .panel-lightbox__dialog{
     position: absolute;
-    left: 50%;
-    top: 50%;
-    transform: translate(-50%, -50%);
-
-    width: min(1100px, 92vw);
-    max-height: 92vh;
+    right: 24px;
+    top: calc(var(--sticky-header-h) + 16px);
+    width: min(520px, calc(100vw - 48px));
+    max-height: calc(100vh - (var(--sticky-header-h) + 32px));
     overflow: auto;
 
-    border: 1px solid rgba(255,255,255,0.14);
-    border-radius: 18px;
+    border: 1px solid rgba(127,127,127,0.22);
+    border-radius: 16px;
+    background: rgba(255,255,255,0.10);
+    backdrop-filter: blur(10px);
+    -webkit-backdrop-filter: blur(10px);
+    padding: 12px;
+  }
 
-    background: rgba(20,20,20,0.55);
-    backdrop-filter: blur(14px);
-    -webkit-backdrop-filter: blur(14px);
-
-    padding: 16px;
-    box-shadow: 0 24px 70px rgba(0,0,0,0.55);
+  @media (prefers-color-scheme: dark){
+    .panel-lightbox__dialog{
+      background: rgba(0,0,0,0.28);
+    }
   }
 
   .panel-lightbox__close{
-    position: absolute;
-    top: 12px;
-    right: 12px;
-
+    position: sticky;
+    top: 0;
+    margin-left: auto;
     display: inline-flex;
     align-items: center;
     justify-content: center;
-
-    width: 44px;
-    height: 40px;
-
-    border-radius: 14px;
-    border: 1px solid rgba(255,255,255,0.22);
-    background: rgba(255,255,255,0.10);
-
+    width: 34px;
+    height: 30px;
+    border-radius: 10px;
+    border: 1px solid rgba(127,127,127,0.35);
+    background: rgba(127,127,127,0.10);
     cursor: pointer;
-    font-size: 22px;
+    font-size: 18px;
     font-weight: 900;
   }
 
-  .panel-lightbox__content{
-    margin-top: 36px;
-  }
-
   .panel-lightbox__content img,
   .panel-lightbox__content video{
     display: block;
     width: 100%;
-    max-height: calc(92vh - 160px);
-    object-fit: contain;
-
-    background: rgba(0,0,0,0.22);
-    border-radius: 14px;
+    height: auto;
+    max-width: 1400px;
+    margin: 0 auto;
+    border-radius: 12px;
   }
 
   .panel-lightbox__content audio{
@@ -1061,14 +1052,13 @@
   }
 
   .panel-lightbox__caption{
-    margin-top: 12px;
+    margin-top: 10px;
     font-size: 12px;
     font-weight: 800;
     opacity: .92;
-    color: rgba(255,255,255,0.92);
   }
 
   @media (max-width: 1100px){
     .page-panel{ display: none; }
   }
-</style>
+</style>

src/content/archicratie/archicrat-ia/chapitre-3.mdx

@@ -14,7 +14,7 @@ source:
 ---
 Ce chapitre se tient à un point nodal de notre essai-thèse : il ouvre un espace d’exploration systématique des formes conceptuelles et philosophiques à travers lesquelles le pouvoir se configure comme régime de régulation. Il ne s’agit pas ici de revenir une nouvelle fois sur les fondements de l’autorité, ni d’interroger la légitimité politique au sens classique du terme, ni même d’enquêter sur la genèse des institutions. L’ambition est autre, structurelle, transversale, morphologique, elle tentera d’arpenter, à même les dispositifs, les pensées, les théorisations et les expériences, les modalités différentiées par lesquelles s’instaurent, s’éprouvent et se disputent les formes de régulation du vivre-ensemble.
 
-Dès lors, ce chapitre ne postule aucun fondement, ne cherche aucun point d’origine, ne prétend restituer aucune ontologie stable du politique. Ce qu’il donne à lire, c’est une cartographie dynamique des régimes de régulation, traversée par des formes irréductibles, non homogènes, souvent conflictuelles, parfois incompatibles, mais toutes pensées comme des configurations singulières, et souvent complémentaires.
+Dès lors, ce chapitre ne postule aucun fondement, ne cherche aucun point d’origine, ne prétend restituer aucune ontologie stable du politique. Ce qu’il donne à lire, c’est une cartographie dynamique des régimes de régulation, traversée par des formes irréductibles, non homogènes, souvent conflictuelles, parfois incompatibles, mais toutes pensées comme des configurations singulières.
 
 Ainsi, loin d’être une galerie illustrative de théories politiques juxtaposées, le chapitre s’agence comme une topologie critique, une plongée stratigraphique dans les scènes où s’articule la régulation — entendue ici non comme stabilisation externe ou ajustement technico-fonctionnel, mais comme dispositif instituant, tension structurante, scène traversée de conflictualité et d’exigence normative. Car à nos yeux, la régulation n’est pas ce qui vient après le pouvoir, elle en est la forme même constitutive — son architecture, son rythme, son épaisseur. Elle est ce par quoi le pouvoir ne se contente pas d’être exercé, mais s’institue, se justifie, se dispute, se recompose.
 

src/content/config.ts

@@ -2,7 +2,7 @@ import { defineCollection, z } from "astro:content";
 
 const linkSchema = z.object({
   type: z.enum(["definition", "appui", "transposition"]),
-  target: z.string().min(1),
+  target: z.string().min(1), // URL interne (ex: /glossaire/archicratie/) ou slug
   note: z.string().optional()
 });
 
@@ -12,6 +12,7 @@ const baseTextSchema = z.object({
   version: z.string().min(1),
   concepts: z.array(z.string().min(1)).default([]),
   links: z.array(linkSchema).default([]),
+  // optionnels mais utiles dès maintenant
   order: z.number().int().nonnegative().optional(),
   summary: z.string().optional()
 });
@@ -49,31 +50,20 @@ const atlas = defineCollection({
   })
 });
 
-// ✅ NOUVELLE collection : archicrat-ia (Essai-thèse)
-// NOTE : on accepte temporairement edition/status "archicratie/modele_sociopolitique"
-// si tes MDX n’ont pas encore été normalisés.
-// Quand tu voudras "strict", on passera à edition="archicrat-ia" status="essai_these"
-// + update frontmatter des 7 fichiers.
-const archicratIa = defineCollection({
-  type: "content",
-  schema: baseTextSchema.extend({
-    edition: z.union([z.literal("archicrat-ia"), z.literal("archicratie")]),
-    status: z.union([z.literal("essai_these"), z.literal("modele_sociopolitique")])
-  })
-});
-
 // Glossaire (référentiel terminologique)
 const glossaire = defineCollection({
   type: "content",
   schema: z.object({
-    title: z.string().min(1),
-    term: z.string().min(1),
+    title: z.string().min(1), // Titre public (souvent identique au terme)
+    term: z.string().min(1),  // Terme canonique
     aliases: z.array(z.string().min(1)).default([]),
     edition: z.literal("glossaire"),
     status: z.literal("referentiel"),
     version: z.string().min(1),
+    // Micro-définition affichable en popover (courte, stable)
     definitionShort: z.string().min(1),
     concepts: z.array(z.string().min(1)).default([]),
+    // Liens typés (vers ouvrages ou autres termes)
     links: z.array(linkSchema).default([])
   })
 });
@@ -83,8 +73,5 @@ export const collections = {
   archicratie,
   ia,
   glossaire,
-  atlas,
-
-  // ⚠️ clé avec tiret => doit être quotée
-  "archicrat-ia": archicratIa
-};
+  atlas
+};

src/layouts/EditionLayout.astro

@@ -5,7 +5,6 @@ import LevelToggle from "../components/LevelToggle.astro";
 import BuildStamp from "../components/BuildStamp.astro";
 import SidePanel from "../components/SidePanel.astro";
 import "../styles/global.css";
-import "../styles/panel.css";
 
 const {
   title,
@@ -31,13 +30,6 @@ const GITEA_REPO = import.meta.env.PUBLIC_GITEA_REPO ?? "";
 
 // ✅ OPTIONNEL : bridge serveur (proxy same-origin)
 const ISSUE_BRIDGE_PATH = import.meta.env.PUBLIC_ISSUE_BRIDGE_PATH ?? "";
-
-// ✅ Auth whoami (same-origin) — configurable, antifragile en dev
-const WHOAMI_PATH = import.meta.env.PUBLIC_WHOAMI_PATH ?? "/_auth/whoami";
-// Par défaut: en DEV local on SKIP pour éviter le spam 404.
-// Pour tester l’auth en dev: export PUBLIC_WHOAMI_IN_DEV=1
-const WHOAMI_IN_DEV = (import.meta.env.PUBLIC_WHOAMI_IN_DEV ?? "") === "1";
-const WHOAMI_FORCE_LOCALHOST = (import.meta.env.PUBLIC_WHOAMI_FORCE_LOCALHOST ?? "") === "1";
 ---
 
 <!doctype html>
@@ -60,104 +52,54 @@ const WHOAMI_FORCE_LOCALHOST = (import.meta.env.PUBLIC_WHOAMI_FORCE_LOCALHOST ??
     <meta data-pagefind-meta={`version:${String(version ?? "")}`} />
 
     {/* ✅ BOOT EARLY : SidePanel dépend de ces globals. */}
-    <script
-      is:inline
-      define:vars={{
-        IS_DEV,
-        GITEA_BASE,
-        GITEA_OWNER,
-        GITEA_REPO,
-        ISSUE_BRIDGE_PATH,
-        WHOAMI_PATH,
-        WHOAMI_IN_DEV,
-        WHOAMI_FORCE_LOCALHOST,
-      }}
-    >
+    <script is:inline define:vars={{ IS_DEV, GITEA_BASE, GITEA_OWNER, GITEA_REPO, ISSUE_BRIDGE_PATH }}>
 (() => {
-  // ✅ anti double-init (HMR / inclusion accidentelle)
-  if (window.__archiBootOnce === 1) return;
-  window.__archiBootOnce = 1;
+  const __DEV__ = Boolean(IS_DEV);
+  window.__archiFlags = Object.assign({}, window.__archiFlags, { dev: __DEV__ });
 
-  var __DEV__ = Boolean(IS_DEV);
+  const base = String(GITEA_BASE || "").replace(/\/+$/, "");
+  const owner = String(GITEA_OWNER || "");
+  const repo = String(GITEA_REPO || "");
+  const giteaReady = Boolean(base && owner && repo);
+  window.__archiGitea = { ready: giteaReady, base, owner, repo };
 
-  // ===== Gitea globals =====
-  var base = String(GITEA_BASE || "").replace(/\/+$/, "");
-  var owner = String(GITEA_OWNER || "");
-  var repo = String(GITEA_REPO || "");
-  window.__archiGitea = {
-    ready: Boolean(base && owner && repo),
-    base, owner, repo
-  };
-
-  // ===== optional issue bridge (same-origin proxy) =====
-  var rawBridge = String(ISSUE_BRIDGE_PATH || "").trim();
-  var normBridge = rawBridge
+  const rawBridge = String(ISSUE_BRIDGE_PATH || "").trim();
+  const normBridge = rawBridge
     ? (rawBridge.startsWith("/") ? rawBridge : ("/" + rawBridge.replace(/^\/+/, ""))).replace(/\/+$/, "")
     : "";
   window.__archiIssueBridge = { ready: Boolean(normBridge), path: normBridge };
 
-  // ===== whoami config =====
-  var __WHOAMI_PATH__ = String(WHOAMI_PATH || "/_auth/whoami");
-  var __WHOAMI_IN_DEV__ = Boolean(WHOAMI_IN_DEV);
-
-  // En dev: par défaut on SKIP (=> pas de spam 404). Override via PUBLIC_WHOAMI_IN_DEV=1.
-  var SHOULD_FETCH_WHOAMI = (!__DEV__) || __WHOAMI_IN_DEV__;
-
-  window.__archiFlags = Object.assign({}, window.__archiFlags, {
-    dev: __DEV__,
-    whoamiPath: __WHOAMI_PATH__,
-    whoamiInDev: __WHOAMI_IN_DEV__,
-    whoamiFetch: SHOULD_FETCH_WHOAMI,
-  });
-
-  var REQUIRED_GROUP = "editors";
-  var READ_GROUP = "readers";
+  const WHOAMI_PATH = "/_auth/whoami";
+  const REQUIRED_GROUP = "editors";
+  const READ_GROUP = "readers";
 
   function parseWhoamiLine(text, key) {
-    var re = new RegExp("^" + key + ":\\s*(.*)$", "mi");
-    var m = String(text || "").match(re);
-    return (m && m[1] ? m[1] : "").trim();
+    const re = new RegExp(`^${key}:\\s*(.*)$`, "mi");
+    const m = String(text || "").match(re);
+    return (m?.[1] ?? "").trim();
   }
-
   function inGroup(groups, g) {
-    var gg = String(g || "").toLowerCase();
+    const gg = String(g || "").toLowerCase();
     return Array.isArray(groups) && groups.some((x) => String(x).toLowerCase() === gg);
   }
 
-  // ===== Auth info promise (single source of truth) =====
   if (!window.__archiAuthInfoP) {
     window.__archiAuthInfoP = (async () => {
-      // ✅ dev default: skip
-      if (!SHOULD_FETCH_WHOAMI) {
-        return { ok: false, user: "", name: "", email: "", groups: [], raw: "" };
-      }
-
-      var res = null;
-      try {
-        res = await fetch(__WHOAMI_PATH__ + "?_=" + Date.now(), {
-          credentials: "include",
-          cache: "no-store",
-          redirect: "manual",
-          headers: { Accept: "text/plain" },
-        });
-      } catch {
-        res = null;
-      }
+      const res = await fetch(`${WHOAMI_PATH}?_=${Date.now()}`, {
+        credentials: "include",
+        cache: "no-store",
+        redirect: "manual",
+        headers: { Accept: "text/plain" },
+      }).catch(() => null);
 
       if (!res) return { ok: false, user: "", name: "", email: "", groups: [], raw: "" };
-      if (res.type === "opaqueredirect") return { ok: false, user: "", name: "", email: "", groups: [], raw: "" };
       if (res.status >= 300 && res.status < 400) return { ok: false, user: "", name: "", email: "", groups: [], raw: "" };
-      if (res.status === 404) return { ok: false, user: "", name: "", email: "", groups: [], raw: "" };
 
-      var text = "";
-      try { text = await res.text(); } catch { text = ""; }
+      const text = await res.text().catch(() => "");
+      const looksLikeWhoami = /Remote-(User|Groups|Email|Name)\s*:/i.test(text);
+      if (!res.ok || !looksLikeWhoami) return { ok: false, user: "", name: "", email: "", groups: [], raw: text };
 
-      var looksLikeWhoami = /Remote-(User|Groups|Email|Name)\s*:/i.test(text);
-      if (!res.ok || !looksLikeWhoami) {
-        return { ok: false, user: "", name: "", email: "", groups: [], raw: text };
-      }
-
-      var groups = parseWhoamiLine(text, "Remote-Groups")
+      const groups = parseWhoamiLine(text, "Remote-Groups")
         .split(/[;,]/)
         .map((s) => s.trim())
         .filter(Boolean)
@@ -174,22 +116,18 @@ const WHOAMI_FORCE_LOCALHOST = (import.meta.env.PUBLIC_WHOAMI_FORCE_LOCALHOST ??
     })().catch(() => ({ ok: false, user: "", name: "", email: "", groups: [], raw: "" }));
   }
 
-  // readers + editors (strict)
   if (!window.__archiCanReadP) {
     window.__archiCanReadP = window.__archiAuthInfoP.then((info) =>
-      Boolean(info && info.ok && (inGroup(info.groups, READ_GROUP) || inGroup(info.groups, REQUIRED_GROUP)))
+      Boolean(info.ok && (inGroup(info.groups, READ_GROUP) || inGroup(info.groups, REQUIRED_GROUP)))
     );
   }
 
-  // editors gate for "Proposer"
   if (!window.__archiIsEditorP) {
     window.__archiIsEditorP = window.__archiAuthInfoP
-      // ✅ DEV fallback: si whoami absent/KO => Proposer autorisé (comme ton intention initiale)
-      .then((info) => Boolean(inGroup(info.groups, REQUIRED_GROUP) || (__DEV__ && !(info && info.ok))))
-      .catch(() => Boolean(__DEV__));
+      .then((info) => Boolean(inGroup(info.groups, REQUIRED_GROUP) || (__DEV__ && !info.ok)))
+      .catch(() => false);
   }
 })();
-
     </script>
   </head>
 
@@ -262,24 +200,17 @@ const WHOAMI_FORCE_LOCALHOST = (import.meta.env.PUBLIC_WHOAMI_FORCE_LOCALHOST ??
         padding: var(--page-gap) 16px 48px;
       }
 
-      /* ✅ Grille robustifiée + panel plus confortable (base) */
       .page-shell{
         --aside-w: 320px;
         --reading-w: 78ch;
-        --panel-w: 420px;
+        --panel-w: 380px;
         --gap: 18px;
 
-        max-width: min(
-          calc(var(--aside-w) + var(--reading-w) + var(--panel-w) + (var(--gap) * 2)),
-          calc(100vw - 32px)
-        );
+        max-width: calc(var(--aside-w) + var(--reading-w) + var(--panel-w) + (var(--gap) * 2));
         margin: 0 auto;
 
         display: grid;
-        grid-template-columns:
-          var(--aside-w)
-          minmax(0, var(--reading-w))
-          minmax(0, var(--panel-w));
+        grid-template-columns: var(--aside-w) minmax(0, var(--reading-w)) var(--panel-w);
         column-gap: var(--gap);
         align-items: start;
       }
@@ -354,38 +285,23 @@ const WHOAMI_FORCE_LOCALHOST = (import.meta.env.PUBLIC_WHOAMI_FORCE_LOCALHOST ??
       }
       :global(body[data-reading-level="1"]) .page-panel{ display: none !important; }
 
-      /* Niveau 3 : lecture plus étroite + panel LARGE ; TOC masqué */
+      /* Niveau 3 : lecture plus étroite + panel large ; TOC masqué */
       :global(body[data-reading-level="3"]) .page-shell{
-        --reading-w: 60ch;
-        --panel-w: clamp(720px, 48vw, 940px);
-
-        max-width: min(
-          calc(var(--reading-w) + var(--panel-w) + var(--gap)),
-          calc(100vw - 32px)
-        );
-
-        grid-template-columns:
-          minmax(0, var(--reading-w))
-          minmax(0, var(--panel-w));
+        --reading-w: 62ch;
+        --panel-w: 560px;
+        max-width: calc(var(--reading-w) + var(--panel-w) + (var(--gap) * 1));
+        grid-template-columns: minmax(0, var(--reading-w)) var(--panel-w);
       }
       :global(body[data-reading-level="3"]) .page-aside{ display: none; }
       :global(body[data-reading-level="3"]) .reading{ grid-column: 1; }
 
-      /* Niveau 4 : TOC à gauche + panel confortable */
+      /* Niveau 4 : TOC à gauche + panel */
       :global(body[data-reading-level="4"]) .page-shell{
         --aside-w: 320px;
         --reading-w: 64ch;
-        --panel-w: clamp(520px, 36vw, 720px);
-
-        max-width: min(
-          calc(var(--aside-w) + var(--reading-w) + var(--panel-w) + (var(--gap) * 2)),
-          calc(100vw - 32px)
-        );
-
-        grid-template-columns:
-          var(--aside-w)
-          minmax(0, var(--reading-w))
-          minmax(0, var(--panel-w));
+        --panel-w: 520px;
+        max-width: calc(var(--aside-w) + var(--reading-w) + var(--panel-w) + (var(--gap) * 2));
+        grid-template-columns: var(--aside-w) minmax(0, var(--reading-w)) var(--panel-w);
       }
       :global(body[data-reading-level="4"]) .page-aside{ display: block; }
       :global(body[data-reading-level="4"]) .reading{ grid-column: 2; }
@@ -1034,13 +950,11 @@ const WHOAMI_FORCE_LOCALHOST = (import.meta.env.PUBLIC_WHOAMI_FORCE_LOCALHOST ??
 
   safe("propose-gate", () => {
     if (!giteaReady) return;
-
     const p = window.__archiIsEditorP || Promise.resolve(false);
-
     p.then((ok) => {
       document.querySelectorAll(".para-propose").forEach((el) => {
         if (ok) showEl(el);
-        else hideEl(el); // ✅ jamais remove => antifragile
+        else el.remove();
       });
     }).catch((err) => {
       console.warn("[proposer] gate failed; keeping Proposer hidden", err);
@@ -1181,45 +1095,6 @@ const WHOAMI_FORCE_LOCALHOST = (import.meta.env.PUBLIC_WHOAMI_FORCE_LOCALHOST ??
     });
   });
 
-  /* ✅ NOUVEAU : clic paragraphe => snap sous reading-follow + SidePanel aligné */
-  safe("click-para-align", () => {
-    if (!reading) return;
-
-    reading.addEventListener("click", (ev) => {
-      try {
-        const t = ev.target;
-
-        // ne pas casser les boutons / liens / para-tools
-        if (t && t.closest && t.closest(".para-tools")) return;
-        const a = t && t.closest ? t.closest("a") : null;
-        if (a) return;
-
-        const p = t && t.closest ? t.closest('.reading p[id^="p-"]') : null;
-        if (!p || !p.id) return;
-
-        // si sélection texte en cours => ne pas snap
-        const sel = window.getSelection ? window.getSelection() : null;
-        if (sel && !sel.isCollapsed) return;
-
-        openDetailsIfNeeded(p);
-
-        // snap immédiat sous followbar
-        scrollToElWithOffset(p, 12, "auto");
-
-        // URL stable
-        history.replaceState(null, "", `${location.pathname}#${p.id}`);
-
-        // force la source de vérité (SidePanel suit via event archicratie:currentPara)
-        __hoverParaId = "";
-        __activeParaId = p.id;
-        setCurrentPara(p.id, "click");
-
-        writeLastSeen(p.id);
-        updateResumeButton();
-      } catch {}
-    }, { passive: true });
-  });
-
   // ===== Hash handling (robuste) =====
   function resolveParaIdFromEl(el) {
     if (!el) return "";
@@ -1343,6 +1218,8 @@ const WHOAMI_FORCE_LOCALHOST = (import.meta.env.PUBLIC_WHOAMI_FORCE_LOCALHOST ??
 
     const h1 = reading.querySelector("h1");
 
+    // ✅ FIX: ne pas dépendre du tag <span>; accepter .details-anchor quel que soit le tag,
+    // et utiliser <details> comme marker (top fiable) pour que rf-h2 s'affiche correctement.
     const h2Anchors = Array.from(reading.querySelectorAll(".details-anchor[id]"))
       .map((s) => {
         const d = (s.nextElementSibling && s.nextElementSibling.tagName === "DETAILS")
@@ -1632,4 +1509,4 @@ const WHOAMI_FORCE_LOCALHOST = (import.meta.env.PUBLIC_WHOAMI_FORCE_LOCALHOST ??
 })();
     </script>
   </body>
-</html>
+</html>

src/pages/annotations-index.json.ts

@@ -1,216 +0,0 @@
-// src/pages/annotations-index.json.ts
-import type { APIRoute } from "astro";
-import fs from "node:fs/promises";
-import path from "node:path";
-import YAML from "yaml";
-
-const CWD = process.cwd();
-const ANNO_ROOT = path.join(CWD, "src", "annotations");
-
-const isObj = (x: any) => !!x && typeof x === "object" && !Array.isArray(x);
-const isArr = (x: any) => Array.isArray(x);
-
-function normPath(s: string) {
-  return String(s || "").replace(/\\/g, "/").replace(/^\/+|\/+$/g, "");
-}
-function paraNum(pid: string) {
-  const m = String(pid).match(/^p-(\d+)-/i);
-  return m ? Number(m[1]) : Number.POSITIVE_INFINITY;
-}
-function toIso(v: any) {
-  if (v instanceof Date) return v.toISOString();
-  return typeof v === "string" ? v : "";
-}
-function stableSortByTs(arr: any[]) {
-  if (!Array.isArray(arr)) return;
-  arr.sort((a, b) => {
-    const ta = Date.parse(toIso(a?.ts)) || 0;
-    const tb = Date.parse(toIso(b?.ts)) || 0;
-    if (ta !== tb) return ta - tb;
-    return JSON.stringify(a).localeCompare(JSON.stringify(b));
-  });
-}
-
-function keyMedia(x: any) { return String(x?.src || ""); }
-function keyRef(x: any) {
-  return `${x?.url || ""}||${x?.label || ""}||${x?.kind || ""}||${x?.citation || ""}`;
-}
-function keyComment(x: any) { return String(x?.text || "").trim(); }
-
-function uniqUnion(dst: any[], src: any[], keyFn: (x:any)=>string) {
-  const out = isArr(dst) ? [...dst] : [];
-  const seen = new Set(out.map((x) => keyFn(x)));
-  for (const it of (isArr(src) ? src : [])) {
-    const k = keyFn(it);
-    if (!k) continue;
-    if (!seen.has(k)) { seen.add(k); out.push(it); }
-  }
-  return out;
-}
-
-function deepMergeEntry(dst: any, src: any) {
-  if (!isObj(dst) || !isObj(src)) return;
-
-  for (const [k, v] of Object.entries(src)) {
-    if (k === "media" && isArr(v)) { dst.media = uniqUnion(dst.media, v, keyMedia); continue; }
-    if (k === "refs" && isArr(v)) { dst.refs = uniqUnion(dst.refs, v, keyRef); continue; }
-    if (k === "comments_editorial" && isArr(v)) { dst.comments_editorial = uniqUnion(dst.comments_editorial, v, keyComment); continue; }
-
-    if (isObj(v)) {
-      if (!isObj((dst as any)[k])) (dst as any)[k] = {};
-      deepMergeEntry((dst as any)[k], v);
-      continue;
-    }
-
-    if (isArr(v)) {
-      const cur = isArr((dst as any)[k]) ? (dst as any)[k] : [];
-      const seen = new Set(cur.map((x:any) => JSON.stringify(x)));
-      const out = [...cur];
-      for (const it of v) {
-        const s = JSON.stringify(it);
-        if (!seen.has(s)) { seen.add(s); out.push(it); }
-      }
-      (dst as any)[k] = out;
-      continue;
-    }
-
-    if (!(k in (dst as any)) || (dst as any)[k] == null || (dst as any)[k] === "") (dst as any)[k] = v;
-  }
-}
-
-async function walk(dir: string): Promise<string[]> {
-  const out: string[] = [];
-  const ents = await fs.readdir(dir, { withFileTypes: true });
-  for (const e of ents) {
-    const p = path.join(dir, e.name);
-    if (e.isDirectory()) out.push(...await walk(p));
-    else if (e.isFile() && /\.ya?ml$/i.test(e.name)) out.push(p);
-  }
-  return out;
-}
-
-function inferExpected(relNoExt: string) {
-  const parts = relNoExt.split("/").filter(Boolean);
-  const last = parts.at(-1) || "";
-  const isShard = parts.length > 1 && /^p-\d+-/i.test(last); // ✅ durcissement
-  const pageKey = isShard ? parts.slice(0, -1).join("/") : relNoExt;
-  const paraId = isShard ? last : null;
-  return { isShard, pageKey, paraId };
-}
-
-export const GET: APIRoute = async () => {
-  const pages: Record<string, { paras: Record<string, any> }> = {};
-  const errors: Array<{ file: string; error: string }> = [];
-
-  let files: string[] = [];
-  let missingRoot = false;
-
-  try {
-    files = await walk(ANNO_ROOT);
-  } catch (e: any) {
-    // ✅ FAIL-OPEN : pas d’annotations => index vide (ne casse pas la build)
-    missingRoot = true;
-    console.warn(`[annotations-index] Missing annotations root: ${ANNO_ROOT} (${e?.message || e})`);
-    files = [];
-    // ✅ surtout PAS d'errors.push ici
-  }
-
-  for (const fp of files) {
-    const rel = normPath(path.relative(ANNO_ROOT, fp));
-    const relNoExt = rel.replace(/\.ya?ml$/i, "");
-    const { isShard, pageKey, paraId } = inferExpected(relNoExt);
-
-    try {
-      const raw = await fs.readFile(fp, "utf8");
-      const doc = YAML.parse(raw) || {};
-
-      if (!isObj(doc) || doc.schema !== 1) continue;
-
-      const docPage = normPath(doc.page || "");
-      if (docPage && docPage !== pageKey) {
-        throw new Error(`page mismatch (page="${doc.page}" vs path="${pageKey}")`);
-      }
-      if (!doc.page) doc.page = pageKey;
-
-      if (!isObj(doc.paras)) throw new Error(`missing object key "paras"`);
-
-      const pg = pages[pageKey] ??= { paras: {} };
-
-      if (isShard) {
-        if (!paraId) throw new Error("internal: missing paraId");
-        if (!(paraId in doc.paras)) {
-          throw new Error(`shard mismatch: file must contain paras["${paraId}"]`);
-        }
-        // ✅ invariant aligné avec build-annotations-index
-        const keys = Object.keys(doc.paras).map(String);
-        if (!(keys.length === 1 && keys[0] === paraId)) {
-          throw new Error(`shard invariant violated: shard must contain ONLY paras["${paraId}"] (got: ${keys.join(", ")})`);
-        }
-
-        const entry = doc.paras[paraId];
-        if (!isObj(pg.paras[paraId])) pg.paras[paraId] = {};
-        if (isObj(entry)) deepMergeEntry(pg.paras[paraId], entry);
-
-        stableSortByTs(pg.paras[paraId].media);
-        stableSortByTs(pg.paras[paraId].refs);
-        stableSortByTs(pg.paras[paraId].comments_editorial);
-      } else {
-        for (const [pid, entry] of Object.entries(doc.paras)) {
-          const p = String(pid);
-          if (!isObj(pg.paras[p])) pg.paras[p] = {};
-          if (isObj(entry)) deepMergeEntry(pg.paras[p], entry);
-
-          stableSortByTs(pg.paras[p].media);
-          stableSortByTs(pg.paras[p].refs);
-          stableSortByTs(pg.paras[p].comments_editorial);
-        }
-      }
-    } catch (e: any) {
-      errors.push({ file: `src/annotations/${rel}`, error: String(e?.message || e) });
-    }
-  }
-
-  for (const [pk, pg] of Object.entries(pages)) {
-    const keys = Object.keys(pg.paras || {});
-    keys.sort((a, b) => {
-      const ia = paraNum(a);
-      const ib = paraNum(b);
-      if (Number.isFinite(ia) && Number.isFinite(ib) && ia !== ib) return ia - ib;
-      return String(a).localeCompare(String(b));
-    });
-    const next: Record<string, any> = {};
-    for (const k of keys) next[k] = pg.paras[k];
-    pg.paras = next;
-  }
-
-  const warnings: Array<{ where: string; warning: string }> = [];
-  if (missingRoot) {
-    warnings.push({
-      where: "src/pages/annotations-index.json.ts",
-      warning: `Missing annotations root "${ANNO_ROOT}" (treated as empty).`,
-    });
-  }
-
-  const out = {
-    schema: 1,
-    generatedAt: new Date().toISOString(),
-    pages,
-    stats: {
-      pages: Object.keys(pages).length,
-      paras: Object.values(pages).reduce((n, p) => n + Object.keys(p.paras || {}).length, 0),
-      errors: errors.length,
-    },
-    warnings,
-    errors,
-  };
-
-  // ✅ FAIL-OPEN uniquement si le dossier manque.
-  // Si le dossier existe mais qu’un YAML est cassé -> fail-closed.
-  if (errors.length && !missingRoot) {
-    throw new Error(`${errors[0].file}: ${errors[0].error}`);
-  }
-
-  return new Response(JSON.stringify(out), {
-    headers: { "Content-Type": "application/json; charset=utf-8" },
-  });
-};

src/pages/archicrat-ia/[...slug].astro

@@ -5,11 +5,12 @@ import EditionToc from "../../components/EditionToc.astro";
 import LocalToc from "../../components/LocalToc.astro";
 
 export async function getStaticPaths() {
-  // ✅ Après migration : plus de filtre par prefix, on prend toute la collection
-  const entries = await getCollection("archicrat-ia");
+  const entries = (await getCollection("archicratie"))
+    .filter((e) => e.slug.startsWith("archicrat-ia/"));
 
   return entries.map((entry) => ({
-    params: { slug: entry.slug },
+    // ✅ inline : jamais de helper externe (évite "stripPrefix is not defined")
+    params: { slug: entry.slug.replace(/^archicrat-ia\//, "") },
     props: { entry },
   }));
 }
@@ -34,4 +35,4 @@ const { Content, headings } = await entry.render();
 
   <h1>{entry.data.title}</h1>
   <Content />
-</EditionLayout>
+</EditionLayout>

src/pages/archicrat-ia/index.astro

@@ -2,12 +2,13 @@
 import SiteLayout from "../../layouts/SiteLayout.astro";
 import { getCollection } from "astro:content";
 
-// ✅ Après migration physique : collection = "archicrat-ia", slug = "chapitre-3" (sans prefix)
-const entries = await getCollection("archicrat-ia");
+const entries = (await getCollection("archicratie"))
+  .filter((e) => e.slug.startsWith("archicrat-ia/"));
 
 entries.sort((a, b) => (a.data.order ?? 9999) - (b.data.order ?? 9999));
 
-const href = (slug) => `/archicrat-ia/${slug}/`;
+const strip = (slug) => slug.replace(/^archicrat-ia\//, "");
+const href = (slug) => `/archicrat-ia/${strip(slug)}/`;
 ---
 
 <SiteLayout title="Essai-thèse — ArchiCraT-IA">
@@ -18,4 +19,4 @@ const href = (slug) => `/archicrat-ia/${slug}/`;
       <li><a href={href(e.slug)}>{e.data.title}</a></li>
     ))}
   </ul>
-</SiteLayout>
+</SiteLayout>

src/pages/para-index.json.ts

@@ -1,42 +0,0 @@
-import type { APIRoute } from "astro";
-import * as fs from "node:fs/promises";
-import * as path from "node:path";
-
-export const prerender = true;
-
-async function exists(p: string) {
-  try { await fs.access(p); return true; } catch { return false; }
-}
-
-export const GET: APIRoute = async () => {
-  const distFile = path.join(process.cwd(), "dist", "para-index.json");
-
-  // Si dist existe (ex: après un build), on renvoie le vrai fichier.
-  if (await exists(distFile)) {
-    const raw = await fs.readFile(distFile, "utf8");
-    return new Response(raw, {
-      status: 200,
-      headers: {
-        "content-type": "application/json; charset=utf-8",
-        "cache-control": "no-store",
-      },
-    });
-  }
-
-  // Sinon stub (dev sans build) : pas d’erreur, pas de crash, pas de 404.
-  const stub = {
-    schema: 1,
-    generatedAt: new Date().toISOString(),
-    items: [],
-    byId: {},
-    note: "para-index not built yet (run: npm run build to generate dist/para-index.json)",
-  };
-
-  return new Response(JSON.stringify(stub), {
-    status: 200,
-    headers: {
-      "content-type": "application/json; charset=utf-8",
-      "cache-control": "no-store",
-    },
-  });
-};

src/styles/global.css

@@ -27,40 +27,17 @@
   --rf-h3-size: 1.25rem;
   --rf-h3-lh: 1.25;
   --rf-h3-fw: 650;
-
-  /* ===== Polish (non destructif) ===== */
-  --ease-out: cubic-bezier(.2,.9,.2,1);
-  --ease-soft: cubic-bezier(.2,.8,.2,1);
-
-  --focus-ring: 2px solid rgba(140,140,255,0.60);
-  --focus-ring-offset: 2px;
 }
 
 body {
   margin: 0;
   font-family: system-ui, -apple-system, Segoe UI, Roboto, Arial, sans-serif;
   line-height: 1.6;
-
-  /* polish */
-  text-rendering: optimizeLegibility;
-  -webkit-font-smoothing: antialiased;
-  -moz-osx-font-smoothing: grayscale;
 }
 
 a { text-decoration: none; }
 a:hover { text-decoration: underline; }
 
-/* ===== Focus (accessibilité + feel premium) ===== */
-:focus { outline: none; }
-:focus-visible{
-  outline: var(--focus-ring);
-  outline-offset: var(--focus-ring-offset);
-}
-
-@media (prefers-reduced-motion: reduce){
-  *{ transition: none !important; animation: none !important; }
-}
-
 /* Header sticky */
 header{
   position: sticky;
@@ -84,26 +61,15 @@ main { padding: 0; }
 .reading {
   max-width: 78ch;
   margin: 0 auto;
-
-  /* polish */
-  font-size: 16px;
-  letter-spacing: 0.005em;
 }
 
 .reading h1 {
   line-height: 1.2;
   margin: 0 0 10px;
-
-  /* polish */
-  letter-spacing: -0.01em;
 }
 
 .reading p { margin: 0 0 12px; }
 
-/* petits ajustements de respiration */
-.reading h2 { margin-top: 18px; }
-.reading h3 { margin-top: 14px; }
-
 .edition-bar {
   display: flex;
   flex-wrap: wrap;
@@ -133,11 +99,6 @@ main { padding: 0; }
   border: 1px solid rgba(127,127,127,0.55);
   border-radius: 999px;
   padding: 5px 12px;
-  transition: transform 120ms var(--ease-out), background 120ms var(--ease-out);
-}
-.resume-btn:hover{
-  background: rgba(127,127,127,0.10);
-  transform: translateY(-1px);
 }
 
 /* Jump by paragraph id */
@@ -153,11 +114,6 @@ main { padding: 0; }
   border-radius: 999px;
   font-size: 13px;
   width: 320px;
-  transition: border-color 120ms var(--ease-out), box-shadow 120ms var(--ease-out);
-}
-.jump-input:focus-visible{
-  border-color: rgba(140,140,255,0.65);
-  box-shadow: 0 0 0 3px rgba(140,140,255,0.18);
 }
 .jump-input.is-error{
   outline: 2px solid rgba(127,127,127,0.55);
@@ -170,11 +126,6 @@ main { padding: 0; }
   border-radius: 999px;
   cursor: pointer;
   font-size: 13px;
-  transition: transform 120ms var(--ease-out), background 120ms var(--ease-out);
-}
-.jump-btn:hover{
-  background: rgba(127,127,127,0.10);
-  transform: translateY(-1px);
 }
 
 /* Toggle niveaux (legacy, non bloquant) */
@@ -186,11 +137,6 @@ main { padding: 0; }
   border-radius: 999px;
   cursor: pointer;
   font-size: 13px;
-  transition: transform 120ms var(--ease-out), background 120ms var(--ease-out), border-color 120ms var(--ease-out);
-}
-.lvl-btn:hover{
-  background: rgba(127,127,127,0.10);
-  transform: translateY(-1px);
 }
 .lvl-btn[aria-pressed="true"] {
   border-color: rgba(127,127,127,0.9);
@@ -265,13 +211,6 @@ body[data-reading-level="4"] .level-3 { display: none; }
   border-radius: 999px;
   padding: 2px 8px;
   background: transparent;
-  transition: transform 120ms var(--ease-out), background 120ms var(--ease-out);
-}
-.para-anchor:hover,
-.para-propose:hover,
-.para-cite:hover{
-  background: rgba(127,127,127,0.10);
-  transform: translateY(-1px);
 }
 .para-cite{ cursor: pointer; }
 
@@ -282,13 +221,8 @@ body[data-reading-level="4"] .level-3 { display: none; }
   padding: 4px 12px;
   background: transparent;
   cursor: pointer;
-  transition: transform 120ms var(--ease-out), background 120ms var(--ease-out);
-}
-.para-bookmark:hover{
-  background: rgba(127,127,127,0.10);
-  transform: translateY(-1px);
-  text-decoration: underline;
 }
+.para-bookmark:hover{ text-decoration: underline; }
 
 /* Highlight (jump / resume / arrivée hash) */
 .para-highlight{
@@ -486,57 +420,3 @@ html{ scroll-behavior: smooth; }
   padding: 0;
   background: transparent;
 }
-
-/* ==========================
-   Landscape boost (mobile/tablet)
-   CSS-only, non destructif
-   - iOS + Android
-   - élargit la lecture en paysage sur petits écrans
-   - ne touche pas au desktop
-   ========================== */
-
-/* 1) Quand on est en paysage sur “petits” devices,
-      on évite une colonne unique trop “étroite” et on retire le max-width 78ch. */
-      @media (orientation: landscape) and (max-width: 1024px){
-        /* La grille (EditionLayout) utilise .page-shell ; on la rend plus “fluide” */
-        .page-shell{
-          max-width: calc(100vw - 16px) !important; /* respire mais exploite la largeur */
-        }
-      
-        /* La lecture ne doit pas rester “bridée” à 78ch en paysage */
-        .reading{
-          max-width: none !important;
-          width: 100% !important;
-        }
-      }
-      
-      /* 2) Cas extrême : petits téléphones en paysage (hauteur faible).
-            On réduit légèrement les paddings pour gagner de la place utile. */
-      @media (orientation: landscape) and (max-width: 820px) and (max-height: 520px){
-        header{
-          padding-top: 10px;
-          padding-bottom: 10px;
-        }
-      
-        /* allège un peu la barre d’édition (sans la casser) */
-        .edition-bar{
-          margin-top: 8px;
-          padding-top: 8px;
-          gap: 8px 12px;
-        }
-      
-        /* champ jump un peu moins large, pour éviter de “manger” la nav */
-        .jump-input{
-          width: min(260px, 48vw);
-        }
-      }
-      
-      /* 3) iOS Safari : le viewport peut être “bizarre” en paysage (barres).
-            Cette règle aide à éviter des layouts coincés quand l’UI Safari bouge. */
-      @supports (height: 100dvh){
-        @media (orientation: landscape) and (max-width: 1024px){
-          .page-shell{
-            min-height: 100dvh;
-          }
-        }
-      }

src/styles/panel.css

@@ -1,568 +0,0 @@
-/* src/styles/panel.css — v3.1 premium FIX
-   Objectifs :
-   - Lightbox AU-DESSUS du header (pas masquée)
-   - bouton close toujours visible
-   - le haut du média jamais coupé
-   - CSS-only, aucune logique JS modifiée
-*/
-
-/* ===== Tokens ===== */
-:root{
-    --panel-radius: 18px;
-    --panel-radius-sm: 14px;
-  
-    --panel-border: rgba(127,127,127,0.16);
-    --panel-border-strong: rgba(127,127,127,0.26);
-  
-    --panel-glass: rgba(255,255,255,0.055);
-    --panel-glass-2: rgba(255,255,255,0.075);
-  
-    --panel-shadow: 0 14px 34px rgba(0,0,0,0.07);
-    --panel-shadow-2: 0 22px 60px rgba(0,0,0,0.10);
-  
-    --panel-title: rgba(20,20,20,0.90);
-    --panel-text: rgba(20,20,20,0.84);
-    --panel-muted: rgba(20,20,20,0.62);
-  
-    --chip-bg: rgba(127,127,127,0.10);
-    --chip-bd: rgba(127,127,127,0.22);
-  
-    --btn-bg: rgba(127,127,127,0.10);
-    --btn-bd: rgba(127,127,127,0.30);
-  
-    /* thumbs */
-    --thumb: 84px;
-  
-    /* Motion */
-    --ease: cubic-bezier(.2,.85,.2,1);
-    --ease2: cubic-bezier(.18,.9,.18,1);
-  
-    /* Lightbox sizing */
-    --lb-maxw: 1480px;
-  
-    /* Inset (viewport safe) : header + notch + marges */
-    --lb-inset-x: 14px;
-    --lb-inset-top: max(calc(env(safe-area-inset-top, 0px) + 12px), 12px);
-    --lb-inset-bot: max(calc(env(safe-area-inset-bottom, 0px) + 12px), 12px);
-  
-    /* Space reserved for close button strip inside dialog */
-    --lb-topbar-h: 56px;
-  
-    /* padding viewer */
-    --lb-pad: 16px;
-  }
-  
-  @media (min-width: 900px){
-    :root{ --lb-inset-x: 24px; --lb-pad: 18px; }
-  }
-  
-  @media (prefers-color-scheme: dark){
-    :root{
-      --panel-border: rgba(255,255,255,0.12);
-      --panel-border-strong: rgba(255,255,255,0.18);
-  
-      --panel-glass: rgba(255,255,255,0.045);
-      --panel-glass-2: rgba(255,255,255,0.070);
-  
-      --panel-shadow: 0 18px 48px rgba(0,0,0,0.26);
-      --panel-shadow-2: 0 30px 80px rgba(0,0,0,0.38);
-  
-      --panel-title: rgba(255,255,255,0.90);
-      --panel-text: rgba(255,255,255,0.86);
-      --panel-muted: rgba(255,255,255,0.62);
-  
-      --chip-bg: rgba(255,255,255,0.08);
-      --chip-bd: rgba(255,255,255,0.14);
-  
-      --btn-bg: rgba(255,255,255,0.07);
-      --btn-bd: rgba(255,255,255,0.16);
-    }
-  }
-  
-  /* ===== Panel container ===== */
-  body[data-reading-level="1"] .page-panel{ display: none !important; }
-  
-  /* IMPORTANT :
-     Pour que la Lightbox (enfant du panel) puisse passer AU-DESSUS du header,
-     on met le panel dans une couche au-dessus du header (z=50).
-     Comme le panel n’empiète pas sur le header (top calculé), c’est safe.
-  */
-  .page-panel{
-    position: sticky;
-    top: calc(var(--sticky-header-h) + var(--page-gap));
-    align-self: start;
-    color: var(--panel-text);
-  
-    z-index: 80; /* ✅ au-dessus du header (50) => Lightbox non masquée */
-  }
-  
-  .page-panel__inner{
-    max-height: calc(100vh - (var(--sticky-header-h) + var(--page-gap) + 12px));
-    overflow: auto;
-    scrollbar-gutter: stable;
-  
-    border: 1px solid var(--panel-border);
-    border-radius: var(--panel-radius);
-  
-    padding: 14px;
-    background:
-      radial-gradient(1200px 600px at 20% 0%, rgba(140,140,255,0.10), transparent 55%),
-      radial-gradient(900px 520px at 80% 20%, rgba(127,255,210,0.06), transparent 55%),
-      linear-gradient(180deg, var(--panel-glass), transparent 68%);
-  
-    backdrop-filter: blur(10px);
-    -webkit-backdrop-filter: blur(10px);
-  
-    box-shadow: var(--panel-shadow);
-  
-    transition: border-color 140ms var(--ease), box-shadow 140ms var(--ease), transform 140ms var(--ease);
-  }
-  
-  .page-panel.is-updating .page-panel__inner{
-    border-color: var(--panel-border-strong);
-    box-shadow: var(--panel-shadow-2);
-    transform: translateY(-1px);
-  }
-  
-  /* ===== Head ===== */
-  .panel-head{
-    display: flex;
-    align-items: center;
-    justify-content: space-between;
-    gap: 10px;
-  
-    margin-bottom: 10px;
-    padding-bottom: 10px;
-  
-    border-bottom: 1px solid rgba(127,127,127,0.18);
-  }
-  
-  .panel-head__left{
-    display: inline-flex;
-    align-items: center;
-    gap: 10px;
-    min-width: 0;
-  }
-  
-  .panel-head__label{ font-weight: 900; opacity: .88; }
-  
-  .panel-head__id{
-    font-weight: 850;
-    letter-spacing: .01em;
-  
-    white-space: nowrap;
-    overflow: hidden;
-    text-overflow: ellipsis;
-    max-width: 16rem;
-  
-    padding: 2px 10px;
-    border-radius: 999px;
-    border: 1px solid var(--chip-bd);
-    background: var(--chip-bg);
-  }
-  
-  /* ===== Messages ===== */
-  .panel-msg{ margin-top: 8px; font-size: 12px; opacity: .92; }
-  .panel-msg--head{ margin-top: 0; margin-bottom: 10px; }
-  
-  /* ===== Toolbar actions : compacte + sticky ===== */
-  .panel-top-actions{
-    position: sticky;
-    top: 0;
-    z-index: 6;
-  
-    margin: 10px 0 10px;
-    padding: 10px;
-  
-    border: 1px solid rgba(127,127,127,0.14);
-    border-radius: var(--panel-radius-sm);
-  
-    background: rgba(255,255,255,0.55);
-    backdrop-filter: blur(12px);
-    -webkit-backdrop-filter: blur(12px);
-  
-    box-shadow: 0 10px 24px rgba(0,0,0,0.06);
-  }
-  
-  @media (prefers-color-scheme: dark){
-    .panel-top-actions{
-      background: rgba(0,0,0,0.28);
-      box-shadow: 0 12px 28px rgba(0,0,0,0.22);
-    }
-  }
-  
-  .panel-top-actions::after{
-    content: "";
-    display: block;
-    margin-top: 10px;
-    height: 1px;
-    background: rgba(127,127,127,0.16);
-  }
-  
-  /* ===== Buttons ===== */
-  .panel-actions{
-    display: flex;
-    gap: 8px;
-    flex-wrap: wrap;
-    margin: 0;
-  }
-  
-  .panel-btn{
-    border: 1px solid var(--btn-bd);
-    background: var(--btn-bg);
-    border-radius: 999px;
-    padding: 6px 12px;
-    font-size: 13px;
-    cursor: pointer;
-    color: inherit;
-  
-    transition: transform 120ms var(--ease2), background 120ms var(--ease2), border-color 120ms var(--ease2);
-  }
-  
-  .panel-btn:hover{
-    transform: translateY(-1px);
-    border-color: var(--panel-border-strong);
-    background: rgba(127,127,127,0.14);
-  }
-  @media (prefers-color-scheme: dark){
-    .panel-btn:hover{ background: rgba(255,255,255,0.10); }
-  }
-  
-  .panel-btn:disabled{ opacity: .55; cursor: default; transform: none; }
-  .panel-btn--primary{ font-weight: 900; border-color: var(--panel-border-strong); }
-  
-  /* ===== Sections ===== */
-  .panel-block{
-    margin-top: 14px;
-    padding-top: 12px;
-    border-top: 1px solid rgba(127,127,127,0.16);
-  }
-  .panel-block:first-of-type{ margin-top: 10px; border-top: 0; padding-top: 0; }
-  
-  .panel-title{
-    margin: 0 0 10px;
-    font-size: 13px;
-    font-weight: 950;
-    letter-spacing: 0.06em;
-    text-transform: uppercase;
-    color: var(--panel-title);
-    opacity: .96;
-  }
-  
-  .panel-subtitle{ font-size: 12px; font-weight: 900; margin: 12px 0 6px; opacity: .90; }
-  .panel-body p{ margin: 8px 0; opacity: .92; }
-  
-  .panel-list{ margin: 0; padding-left: 18px; }
-  .panel-list li{ margin: 7px 0; }
-  
-  .panel-chip{
-    display: inline-block;
-    margin-left: 8px;
-    font-size: 11px;
-    font-weight: 900;
-    padding: 2px 8px;
-    border-radius: 999px;
-    border: 1px solid var(--chip-bd);
-    background: var(--chip-bg);
-    opacity: .95;
-  }
-  
-  .panel-quote{
-    margin: 8px 0;
-    padding: 10px 10px;
-    border-left: 3px solid rgba(140,140,255,0.35);
-    background: rgba(127,127,127,0.06);
-    border-radius: 12px;
-  }
-  @media (prefers-color-scheme: dark){
-    .panel-quote{ background: rgba(255,255,255,0.05); }
-  }
-  .panel-quote__src{ margin-top: 6px; font-size: 12px; opacity: .72; }
-  
-  /* ===== Media grid ===== */
-  .panel-media-grid{
-    display: grid;
-    grid-template-columns: repeat(auto-fill, minmax(var(--thumb), 1fr));
-    gap: 10px;
-    align-items: start;
-  }
-  
-  .panel-media-tile{
-    width: 100%;
-    border: 1px solid rgba(127,127,127,0.16);
-    border-radius: 14px;
-    padding: 8px;
-    background: rgba(127,127,127,0.04);
-  
-    cursor: pointer;
-    text-align: left;
-  
-    transition: transform 120ms var(--ease2), background 120ms var(--ease2), border-color 120ms var(--ease2);
-  }
-  @media (prefers-color-scheme: dark){
-    .panel-media-tile{ background: rgba(255,255,255,0.035); }
-  }
-  
-  .panel-media-tile:hover{
-    transform: translateY(-1px);
-    border-color: var(--panel-border-strong);
-    background: rgba(127,127,127,0.08);
-  }
-  @media (prefers-color-scheme: dark){
-    .panel-media-tile:hover{ background: rgba(255,255,255,0.055); }
-  }
-  
-  .panel-media-tile img{
-    width: 100%;
-    height: var(--thumb);
-    object-fit: cover;
-    display: block;
-    border-radius: 10px;
-    margin-bottom: 8px;
-    cursor: zoom-in;
-  }
-  
-  .panel-media-ph{
-    width: 100%;
-    height: var(--thumb);
-    border-radius: 10px;
-    display: grid;
-    place-items: center;
-    background: var(--chip-bg);
-    margin-bottom: 8px;
-    font-weight: 950;
-    font-size: 12px;
-    opacity: .9;
-  }
-  
-  .panel-media-cap{
-    font-size: 12px;
-    font-weight: 900;
-    opacity: .92;
-    white-space: nowrap;
-    overflow: hidden;
-    text-overflow: ellipsis;
-  }
-  
-  .panel-media-credit{
-    margin-top: 4px;
-    font-size: 11px;
-    opacity: .74;
-    white-space: nowrap;
-    overflow: hidden;
-    text-overflow: ellipsis;
-  }
-  
-  /* Featured (1 média) */
-  .panel-media-grid > .panel-media-tile:only-child{
-    grid-column: 1 / -1;
-    padding: 10px;
-  }
-  
-  .panel-media-grid > .panel-media-tile:only-child img,
-  .panel-media-grid > .panel-media-tile:only-child .panel-media-ph{
-    height: min(52vh, 460px);
-    object-fit: contain;
-    background: rgba(0,0,0,0.08);
-  }
-  @media (prefers-color-scheme: dark){
-    .panel-media-grid > .panel-media-tile:only-child img,
-    .panel-media-grid > .panel-media-tile:only-child .panel-media-ph{
-      background: rgba(0,0,0,0.22);
-    }
-  }
-  .panel-media-grid > .panel-media-tile:only-child .panel-media-cap{
-    white-space: normal;
-    overflow: visible;
-    text-overflow: clip;
-    line-height: 1.35;
-  }
-  
-  /* ===== Compose ===== */
-  .panel-compose{
-    margin-top: 12px;
-    padding-top: 10px;
-    border-top: 1px dashed rgba(127,127,127,0.22);
-  }
-  .panel-label{
-    display: block;
-    font-size: 12px;
-    font-weight: 950;
-    opacity: .90;
-    margin-bottom: 6px;
-  }
-  .panel-textarea{
-    width: 100%;
-    box-sizing: border-box;
-    border: 1px solid rgba(127,127,127,0.24);
-    border-radius: 12px;
-    padding: 9px 10px;
-    background: transparent;
-    font-size: 13px;
-    resize: vertical;
-  }
-  
-  /* =======================================================================
-     LIGHTBOX FIX (CRITIQUE)
-     - overlay couvre le header
-     - close toujours visible
-     - le haut du média n’est jamais “mangé”
-     - overrides forts (important) car styles inline du composant existent
-     ======================================================================= */
-  
-  /* Quand hidden => pas d’interaction */
-  .panel-lightbox[hidden]{ display: none !important; }
-  
-  /* Conteneur full-viewport AU DESSUS de tout */
-  .panel-lightbox{
-    position: fixed !important;
-    inset: 0 !important;
-    z-index: 2147483647 !important; /* max practical */
-    pointer-events: auto !important;
-  }
-  
-  /* Overlay : couvre TOUT y compris header */
-  .panel-lightbox__overlay{
-    position: absolute !important;
-    inset: 0 !important;
-    background: rgba(0,0,0,0.86) !important;
-    backdrop-filter: blur(10px) !important;
-    -webkit-backdrop-filter: blur(10px) !important;
-  }
-  
-  /* Dialog : on bannit transform/centering qui peut “couper” le haut.
-     On utilise un inset fixe => le haut est toujours visible. */
-  .panel-lightbox__dialog{
-    position: fixed !important;
-    left: auto !important;
-    top: auto !important;
-    right: auto !important;
-    bottom: auto !important;
-    transform: none !important;
-  
-    inset: var(--lb-inset-top) var(--lb-inset-x) var(--lb-inset-bot) var(--lb-inset-x) !important;
-  
-    width: auto !important;
-    height: auto !important;
-    max-height: none !important;
-  
-    border-radius: 18px !important;
-    border: 1px solid rgba(255,255,255,0.14) !important;
-  
-    background: rgba(18,18,18,0.58) !important;
-    backdrop-filter: blur(14px) !important;
-    -webkit-backdrop-filter: blur(14px) !important;
-  
-    box-shadow: 0 28px 90px rgba(0,0,0,0.60) !important;
-    overflow: hidden !important;
-  
-    /* layout interne */
-    display: flex !important;
-    flex-direction: column !important;
-  
-    /* petite anim (discrète) */
-    animation: archiLbIn 160ms var(--ease) !important;
-  }
-  
-  @keyframes archiLbIn{
-    from { opacity: 0; transform: translateY(-6px); }
-    to   { opacity: 1; transform: translateY(0); }
-  }
-  
-  /* Close : FIXED dans le viewport => ne peut plus être masqué par le header */
-  .panel-lightbox__close{
-    position: fixed !important;
-    top: calc(var(--lb-inset-top) + 8px) !important;
-    right: calc(var(--lb-inset-x) + 8px) !important;
-    z-index: 2147483647 !important;
-  
-    display: inline-flex !important;
-    align-items: center !important;
-    justify-content: center !important;
-  
-    width: 46px !important;
-    height: 42px !important;
-  
-    border-radius: 14px !important;
-    border: 1px solid rgba(255,255,255,0.30) !important;
-    background: rgba(0,0,0,0.50) !important;
-    color: rgba(255,255,255,0.92) !important;
-  
-    cursor: pointer !important;
-    font-size: 22px !important;
-    font-weight: 950 !important;
-  
-    transition: transform 120ms var(--ease2), background 120ms var(--ease2) !important;
-  }
-  .panel-lightbox__close:hover{
-    transform: translateY(-1px) !important;
-    background: rgba(255,255,255,0.14) !important;
-  }
-  
-  /* Contenu : prend l’espace, jamais sous le close (close est fixed viewport) */
-  .panel-lightbox__content{
-    flex: 1 1 auto !important;
-    min-height: 0 !important;
-  
-    padding: var(--lb-pad) !important;
-    padding-top: 12px !important;
-  
-    display: grid !important;
-    place-items: center !important;
-  
-    overflow: auto !important;
-  }
-  
-  /* Média : contain, et jamais coupé en haut (dialog inset fixe + scroll possible) */
-  .panel-lightbox__content img,
-  .panel-lightbox__content video{
-    display: block !important;
-    max-width: min(var(--lb-maxw), calc(100vw - (var(--lb-inset-x) * 2) - (var(--lb-pad) * 2))) !important;
-    max-height: calc(100vh - var(--lb-inset-top) - var(--lb-inset-bot) - 64px) !important;
-  
-    width: auto !important;
-    height: auto !important;
-  
-    object-fit: contain !important;
-  
-    background: rgba(0,0,0,0.22) !important;
-    border-radius: 14px !important;
-  }
-  
-  /* audio */
-  .panel-lightbox__content audio{
-    width: min(860px, calc(100vw - (var(--lb-inset-x) * 2) - 28px)) !important;
-  }
-  
-  /* Caption : en bas, sans masquer le média (on reste simple) */
-  .panel-lightbox__caption{
-    position: relative !important;
-    z-index: 2 !important;
-  
-    padding: 10px 14px !important;
-    font-size: 12px !important;
-    font-weight: 950 !important;
-    color: rgba(255,255,255,0.92) !important;
-  
-    background: linear-gradient(to top, rgba(0,0,0,0.72), rgba(0,0,0,0.00)) !important;
-  }
-  
-  /* Bonus : si le navigateur supporte :has(), on fige le scroll arrière-plan (premium) */
-  @supports selector(html:has(*)){
-    html:has(.panel-lightbox:not([hidden])){
-      overflow: hidden;
-    }
-  }
-  
-  /* ===== Responsive : comme avant, panel caché sous 1100px ===== */
-  @media (max-width: 1100px){
-    .page-panel{ display: none; }
-  }
-  
-  /* ===== Reduce motion ===== */
-  @media (prefers-reduced-motion: reduce){
-    .panel-lightbox__dialog{ animation: none !important; }
-    .panel-btn,
-    .panel-media-tile,
-    .page-panel__inner{ transition: none !important; }
-  }

tests/anchors-baseline.json

@@ -1,4 +1,8 @@
 {
+  "archicratie/00-demarrage/index.html": [
+    "p-0-d64c1c39",
+    "p-1-3f750540"
+  ],
   "archicrat-ia/chapitre-1/index.html": [
     "p-0-8d27a7f5",
     "p-1-8a6c18bf",