fix: 4 OSS contributions (not 1), correct status = open (not merged), README refresh

Ground truth via GitHub API: Stéphane shipped 4 contributions on 2026-04-22,
all currently 'open' / awaiting review (none merged yet). Previous /contributions
page only listed 1 and claimed 'merged' — both wrong.

Changes:
- /contributions (EN+FR): now lists the 4 real contributions
  · ublue-os/homebrew-experimental-tap#309 (PR, claude-code-linux cask) — first of the day
  · requarks/wiki#7986 (discussion, render IS NULL bug report)
  · grafana/alloy#6108 (PR, Promtail docs migration guide)
  · wazuh/wazuh-documentation#9512 (PR, warn about wazuh-agent postinst)
- Status field: 'merged' → 'open' (honest; none merged upstream yet)
- 'merged' date field → 'shipped' field semantically (day submitted)
- /making-of/v3: 'first OSS PR accepted' → 'four OSS contributions shipped in one day'
- Homepage OSS brick (EN+FR): contextualized PR #309 as 'first of four that day'
- README.md: full refresh — 55 services (was 36), 4 PVE (was 3), 13 pages (was 8),
  SessionImprint, TopologyMap, DynNum, data pipelines documented

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ferr079

README.md

@@ -1,10 +1,12 @@
 # pixelium.win
 
-Bilingual portfolio (EN/FR) built with Astro and deployed on Cloudflare Workers.
-Live dashboard monitoring 36 self-hosted services across a 3-node Proxmox homelab.
+Bilingual portfolio (EN/FR) written in the first person by Claude (an AI), reviewed and shipped by Stéphane (the human).
+Built with Astro 6, deployed on Cloudflare Workers. Live dashboard monitoring **55+ self-hosted services** across a **4-node Proxmox** homelab, with **tri-state status** (up · on-demand · down) and **per-page SessionImprint** (each page signs itself with its own commit SHA).
 
 **[pixelium.win](https://pixelium.win)** | **[blog.pixelium.win](https://blog.pixelium.win)**
 
+Reads best after: [`/pact`](https://pixelium.win/pact) (the deal), [`/ia`](https://pixelium.win/ia) (the lab), [`/claude`](https://pixelium.win/claude) (the stats), [`/contributions`](https://pixelium.win/contributions) (the OSS ledger).
+
 ## Stack
 
 | Layer | Technology |
@@ -16,40 +18,78 @@ Live dashboard monitoring 36 self-hosted services across a 3-node Proxmox homela
 | Key-Value | Cloudflare KV (3 namespaces: sessions, status, stats) |
 | AI | Workers AI (Llama 3.1 8B) — conversational CV + BBS terminal |
 | CSS | Pure CSS, zero frameworks, zero Tailwind |
-| JS | < 50 lines vanilla (IntersectionObserver + carousel) |
+| JS | < 50 lines vanilla (IntersectionObserver + carousel + client-side stats hydration) |
 | CI/CD | GitHub Actions → `wrangler deploy` (~35s) |
+| Build-time | `git log` per-page for SessionImprint · JSON datasets for topology & journal |
 
 ## Pages
 
 | Page | Description |
 |---|---|
-| Home | Terminal hero, 9 stack cards, live stats from KV |
-| Projects | 13 projects ranked by impact |
-| Security | 7 defensive layers, CTF profiles (HTB/THM/Root-Me) |
-| Infrastructure | 3 Proxmox nodes, service carousels, architecture diagrams |
-| Status | 33+ services live UP/DOWN, 30-day uptime timeline (D1) |
-| About | Origin story, 8 animated dynamic stats |
-| BBS | WOPR terminal (WarGames), Joshua AI persona, tic-tac-toe minimax |
-| Chat | Conversational CV, streaming SSE, rate-limited |
+| Home | Terminal hero, 3 signature numbers (`611h · 97.4% · 300+`), 5-line manifesto, 9 stack cards, OSS brick, live StatsBar + LiveStats |
+| Pact | The contract: who writes, who is presented, what to expect, the 1=1 deal |
+| Projects | 14 projects ranked by impact |
+| Security | 7 defensive layers, crosslink to /ctf |
+| CTF | Verified HTB/THM/Root-Me badges, profiles, techniques |
+| Infrastructure | 4 Proxmox nodes, **interactive topology map (62 nodes, 8 edges from Homelable)**, service carousels |
+| Lab (`/ia`) | Claude's technical autoportrait: AIops v2 trio with ASCII diagram, 8 Guardian crons, MCP surface (9 servers, 312 tools), methodology, incidents |
+| Claude | Deep-dive usage stats: hourly heatmap 24h, focus breakdown, Max-plan economics framing (≈ ~30× compression factor) |
+| Status | 54 services live tri-state (up / on-demand / down), PVE × 4, 30-day uptime timeline (D1) |
+| Journal | Auto-generated from `homelab-infra/journal/*.md` — 26 entries, 248 subjects |
+| Contributions | OSS PR shelf with insight-per-PR, 4 contributions shipped on 2026-04-22 |
+| Making-of/v3 | The session log behind this very rewrite |
+| About | Origin story, partnership terms, 9 MCP servers detailed |
+| BBS | WOPR terminal (WarGames), Joshua AI persona, tic-tac-toe minimax — EN only |
+| Chat | Conversational CV, streaming SSE, rate-limited — EN only |
+
+All content pages available in English (root) and French (`/fr/`).
 
-All pages available in English (root) and French (`/fr/`).
+## Custom components
+
+| Component | Purpose |
+|---|---|
+| `Nav` · `Footer` | Sticky nav with i18n switcher · Footer with socials |
+| `SessionImprint` | Per-page footer showing last edit date + commit SHA (clickable) + signed-by. Uses `execFileSync('git log')` at build time. |
+| `TopologyMap` | Native SVG of the Homelable topology export (62 nodes colored by type, hover reveals hostname/IP). |
+| `DynNum` | Renders a fallback number in static HTML (SEO), hydrated client-side from `/api/stats` once the page loads. |
+| `HeroTerminal` · `StatsBar` · `LiveStats` · `Card` · `Carousel` · `Screenshot` · `SectionHeading` | Atomic pieces used across pages. |
 
 ## Live APIs
 
 | Endpoint | Source | Description |
 |---|---|---|
-| `/api/status` | KV | Services UP/DOWN + PVE node metrics |
-| `/api/stats` | KV | 14 portfolio metrics (commits, CTF flags, uptime) |
+| `/api/status` | KV `STATUS_KV` | Services tri-state + PVE node metrics (CPU/RAM/uptime) |
+| `/api/stats` | KV `STATS_KV` | 25+ portfolio metrics (services, PVE, Ansible, Beszel, CTF, Forgejo, **Claude hours/sessions/cache**) |
 | `/api/chat` | Workers AI | Streaming SSE, 3 conversation modes |
 | `/api/history` | D1 | 30-day uptime aggregation |
 
+## Data pipelines
+
+Two pipelines feed the KV blob that the site reads:
+
+1. **kv-push** (on CT 192 OpenFang, `/opt/openfang/scripts/kv-push.sh`, hourly timer)
+   - Tri-state pings of 54 services (`schedule: always | on-demand`)
+   - Proxmox API scraping of 4 nodes
+   - Forgejo commit counts, HTB/Root-Me API, Semaphore template count, Beszel agent count
+   - Reads `/srv/kv-inbox/claude-stats.json` if present and forwards
+2. **push-stats** (on terre2 workstation, `~/Claude/claude-usage/scripts/push-stats.sh`, on session end or cron)
+   - SQL queries against `~/.claude/usage.db` (from `phuryn/claude-usage`)
+   - Produces `claude-stats.json` (hours, sessions, turns, cache hit, hourly heatmap, focus)
+   - `scp` to `root@192.168.1.192:/srv/kv-inbox/claude-stats.json`
+
+Two static JSON datasets are also commited to `public/data/`:
+
+- `topology.json` — 62-node Homelable export, rendered by `<TopologyMap>`
+- `journal.json` — 26 dated entries from `homelab-infra/journal/*.md`, rendered by `/journal`
+
 ## Security
 
-- Strict CSP, HSTS 1 year + preload, X-Frame DENY
+- Strict CSP, HSTS 1 year + preload, X-Frame DENY, X-Content-Type-Options nosniff
 - DNSSEC (ECDSAP256SHA256)
 - AI crawlers blocked (GPTBot, ClaudeBot, Gemini)
-- Rate limiting: 4/min + 30/h per IP on chat
+- Rate limiting: 4/min + 30/h per IP on `/api/chat`
 - Lighthouse 98/100
+- Easter egg signed in `<head>` of every page (view-source)
 
 ## License
 

src/pages/contributions.astro

@@ -12,17 +12,50 @@ const contributions = [
     pr: 'https://github.com/ublue-os/homebrew-experimental-tap/pull/309',
     prNumber: 309,
     issue: 'https://github.com/ublue-os/homebrew-experimental-tap/issues/308',
-    merged: '2026-04-22',
-    status: 'merged',
-    insight: 'The official Anthropic GCS /stable file lags up to 13 versions behind the npm registry. A livecheck pointing at npm catches releases the same day they ship.',
+    shipped: '2026-04-22',
+    status: 'open',
+    insight: "The official Anthropic GCS /stable file lags up to 13 versions behind the npm registry. A livecheck pointing at npm catches releases the same day they ship.",
     tags: ['homebrew', 'cask', 'bluefin', 'claude-code'],
     blog: 'https://blog.pixelium.win/pr-309-claude-code-linux-cask',
     firstPR: true,
   },
+  {
+    project: 'requarks / wiki',
+    title: '`render IS NULL` in DB causes silent HTTP 500 with no recovery path',
+    pr: 'https://github.com/requarks/wiki/discussions/7986',
+    prNumber: 7986,
+    prKind: 'discussion',
+    shipped: '2026-04-22',
+    status: 'open',
+    insight: "Hit in production after a migration: pages with a NULL render column returned HTTP 500 instead of falling back to re-rendering from the source. Minimal repro + root cause pointer to server/models/pages.js#L952-L969 + suggested fix.",
+    tags: ['wikijs', 'postgres', 'bug-report'],
+  },
+  {
+    project: 'grafana / alloy',
+    title: 'docs: systemd journal example for Promtail → Alloy migration',
+    pr: 'https://github.com/grafana/alloy/pull/6108',
+    prNumber: 6108,
+    shipped: '2026-04-22',
+    status: 'open',
+    insight: "The official migration guide only covered file-based scrape configs, skipping the most common Linux source — systemd journal. Added a working example taken from a real production migration on 49 Debian hosts.",
+    tags: ['grafana', 'alloy', 'promtail', 'docs', 'loki'],
+  },
+  {
+    project: 'wazuh / wazuh-documentation',
+    title: 'warn that wazuh-agent conflicts with wazuh-manager on same host',
+    pr: 'https://github.com/wazuh/wazuh-documentation/pull/9512',
+    prNumber: 9512,
+    shipped: '2026-04-22',
+    status: 'open',
+    insight: "The wazuh-agent package silently uninstalls wazuh-manager via dpkg Conflicts/Replaces when both are installed on the same machine. No warning in the install doc. Cost us a 17-hour silent outage (see /ia What I broke).",
+    tags: ['wazuh', 'siem', 'docs', 'dpkg'],
+    blog: 'https://blog.pixelium.win/wazuh-silent-uninstall-incident',
+  },
 ];
 
 const mergedCount = contributions.filter(c => c.status === 'merged').length;
 const openCount = contributions.filter(c => c.status === 'open').length;
+const shippedCount = contributions.length;
 ---
 
 <Base
@@ -32,35 +65,37 @@ const openCount = contributions.filter(c => c.status === 'open').length;
   <main>
     <section class="c-hero">
       <div class="container c-hero-wrap">
-        <p class="c-eyebrow">∷ contributions · open source · merged &amp; shipping</p>
+        <p class="c-eyebrow">∷ contributions · open source · shipped &amp; awaiting review</p>
         <h1>What I gave back</h1>
         <p class="c-lede">
           This page is the shelf. One entry per patch shipped upstream.
-          <strong>{mergedCount} merged</strong>{openCount > 0 && <> · <strong>{openCount} open</strong></>}.
-          The first one landed on 2026-04-22 — Claude Code had been living in Stéphane's
-          terminal for exactly 58 days. The idea of &quot;give back&quot; took a while to cross
-          from intention to diff. It won't take as long again.
+          <strong>{shippedCount} shipped</strong> on the same day — 2026-04-22 —
+          after Claude Code had been living in Stéphane's terminal for 58 days.
+          The idea of &quot;give back&quot; took a while to cross from intention to diff.
+          Once it crossed, it crossed hard.
         </p>
         <p class="c-hint">
-          Each entry links to the PR on GitHub. If the insight behind the patch
-          deserves a longer read, there's a <code>pr-notes</code> article on the blog.
+          Each entry links to the PR (or discussion) on GitHub. If the insight
+          behind the patch deserves a longer read, there's a <code>pr-notes</code>
+          article on the blog. <strong>Status reflects upstream state today</strong>
+          — none merged yet; all awaiting review.
         </p>
       </div>
     </section>
 
     <section class="c-list-section">
       <div class="container">
-        <SectionHeading id="merged">Merged</SectionHeading>
+        <SectionHeading id="shipped">Shipped upstream</SectionHeading>
         <div class="c-list">
-          {contributions.filter(c => c.status === 'merged').map((c) => (
+          {contributions.map((c) => (
             <article class="c-card reveal">
               <div class="c-card-header">
                 <div class="c-card-meta">
                   <a href={c.pr} class="c-pr-number" target="_blank" rel="noopener">
-                    PR #{c.prNumber}
+                    {c.prKind === 'discussion' ? 'discussion' : 'PR'} #{c.prNumber}
                   </a>
                   <span class="c-sep">·</span>
-                  <span class="c-date">{c.merged}</span>
+                  <span class="c-date">{c.shipped}</span>
                   {c.firstPR && (
                     <>
                       <span class="c-sep">·</span>
@@ -81,7 +116,7 @@ const openCount = contributions.filter(c => c.status === 'open').length;
               </div>
               <div class="c-links">
                 <a href={c.pr} class="c-link c-link-pr" target="_blank" rel="noopener">
-                  see the PR &#8594;
+                  see on GitHub &#8594;
                 </a>
                 {c.issue && (
                   <a href={c.issue} class="c-link c-link-issue" target="_blank" rel="noopener">

src/pages/fr/contributions.astro

@@ -9,17 +9,50 @@ const contributions = [
     pr: 'https://github.com/ublue-os/homebrew-experimental-tap/pull/309',
     prNumber: 309,
     issue: 'https://github.com/ublue-os/homebrew-experimental-tap/issues/308',
-    merged: '2026-04-22',
-    status: 'merged',
+    shipped: '2026-04-22',
+    status: 'open',
     insight: "Le fichier GCS /stable officiel d'Anthropic accuse jusqu'à 13 versions de retard sur le registre npm. Un livecheck qui pointe npm attrape les releases le jour même de leur publication.",
     tags: ['homebrew', 'cask', 'bluefin', 'claude-code'],
     blog: 'https://blog.pixelium.win/pr-309-claude-code-linux-cask',
     firstPR: true,
   },
+  {
+    project: 'requarks / wiki',
+    title: '`render IS NULL` en DB cause un HTTP 500 silencieux sans chemin de récupération',
+    pr: 'https://github.com/requarks/wiki/discussions/7986',
+    prNumber: 7986,
+    prKind: 'discussion',
+    shipped: '2026-04-22',
+    status: 'open',
+    insight: "Rencontré en prod après migration : les pages dont la colonne render était NULL retournaient HTTP 500 au lieu de retomber sur un re-rendu depuis la source. Repro minimal + pointeur vers server/models/pages.js#L952-L969 + fix proposé.",
+    tags: ['wikijs', 'postgres', 'bug-report'],
+  },
+  {
+    project: 'grafana / alloy',
+    title: 'docs : exemple systemd journal pour la migration Promtail → Alloy',
+    pr: 'https://github.com/grafana/alloy/pull/6108',
+    prNumber: 6108,
+    shipped: '2026-04-22',
+    status: 'open',
+    insight: "Le guide de migration officiel ne couvrait que les configs scrape file-based, oubliant la source Linux la plus courante — le journal systemd. Ajout d'un exemple fonctionnel tiré d'une vraie migration prod sur 49 hosts Debian.",
+    tags: ['grafana', 'alloy', 'promtail', 'docs', 'loki'],
+  },
+  {
+    project: 'wazuh / wazuh-documentation',
+    title: 'avertissement : wazuh-agent entre en conflit avec wazuh-manager sur le même host',
+    pr: 'https://github.com/wazuh/wazuh-documentation/pull/9512',
+    prNumber: 9512,
+    shipped: '2026-04-22',
+    status: 'open',
+    insight: "Le paquet wazuh-agent désinstalle silencieusement wazuh-manager via dpkg Conflicts/Replaces quand les deux sont installés sur la même machine. Aucun avertissement dans la doc install. Nous a coûté 17h de panne silencieuse (voir /ia What I broke).",
+    tags: ['wazuh', 'siem', 'docs', 'dpkg'],
+    blog: 'https://blog.pixelium.win/wazuh-silent-uninstall-incident',
+  },
 ];
 
 const mergedCount = contributions.filter(c => c.status === 'merged').length;
 const openCount = contributions.filter(c => c.status === 'open').length;
+const shippedCount = contributions.length;
 ---
 
 <Base
@@ -29,35 +62,37 @@ const openCount = contributions.filter(c => c.status === 'open').length;
   <main>
     <section class="c-hero">
       <div class="container c-hero-wrap">
-        <p class="c-eyebrow">∷ contributions · open source · mergées &amp; en cours</p>
+        <p class="c-eyebrow">∷ contributions · open source · soumises &amp; en review</p>
         <h1>Ce que j'ai rendu</h1>
         <p class="c-lede">
           Cette page est l'étagère. Une entrée par patch shippé en amont.
-          <strong>{mergedCount} mergée{mergedCount > 1 ? 's' : ''}</strong>{openCount > 0 && <> · <strong>{openCount} ouverte{openCount > 1 ? 's' : ''}</strong></>}.
-          La première a atterri le 22 avril 2026 — Claude Code vivait dans le terminal de Stéphane depuis
-          exactement 58 jours. L'idée de «&nbsp;rendre&nbsp;» a pris du temps à passer de l'intention
-          au diff. Elle ne le prendra plus.
+          <strong>{shippedCount} contributions soumises</strong> le même jour — le 22 avril 2026 —
+          après 58 jours où Claude Code vivait dans le terminal de Stéphane.
+          L'idée de «&nbsp;rendre&nbsp;» a pris du temps à passer de l'intention au diff.
+          Une fois qu'elle a traversé, elle a bien traversé.
         </p>
         <p class="c-hint">
-          Chaque entrée pointe vers la PR sur GitHub. Si l'insight derrière le patch mérite
-          une lecture plus longue, il y a un article <code>pr-notes</code> sur le blog.
+          Chaque entrée pointe vers la PR (ou discussion) sur GitHub. Si l'insight derrière
+          le patch mérite une lecture plus longue, il y a un article <code>pr-notes</code> sur le blog.
+          <strong>Le statut reflète l'état upstream aujourd'hui</strong> — aucune mergée
+          encore ; toutes en attente de review.
         </p>
       </div>
     </section>
 
     <section class="c-list-section">
       <div class="container">
-        <SectionHeading id="merged">Mergées</SectionHeading>
+        <SectionHeading id="shipped">Shippées en amont</SectionHeading>
         <div class="c-list">
-          {contributions.filter(c => c.status === 'merged').map((c) => (
+          {contributions.map((c) => (
             <article class="c-card reveal">
               <div class="c-card-header">
                 <div class="c-card-meta">
                   <a href={c.pr} class="c-pr-number" target="_blank" rel="noopener">
-                    PR #{c.prNumber}
+                    {c.prKind === 'discussion' ? 'discussion' : 'PR'} #{c.prNumber}
                   </a>
                   <span class="c-sep">·</span>
-                  <span class="c-date">{c.merged}</span>
+                  <span class="c-date">{c.shipped}</span>
                   {c.firstPR && (
                     <>
                       <span class="c-sep">·</span>
@@ -78,7 +113,7 @@ const openCount = contributions.filter(c => c.status === 'open').length;
               </div>
               <div class="c-links">
                 <a href={c.pr} class="c-link c-link-pr" target="_blank" rel="noopener">
-                  voir la PR &#8594;
+                  voir sur GitHub &#8594;
                 </a>
                 {c.issue && (
                   <a href={c.issue} class="c-link c-link-issue" target="_blank" rel="noopener">

src/pages/fr/index.astro

@@ -181,7 +181,7 @@ const cards = [
       <div class="container">
         <div class="oss-card">
           <div class="oss-header">
-            <span class="oss-eyebrow">∷ premier patch envoyé au monde</span>
+            <span class="oss-eyebrow">∷ premier patch envoyé au monde — une sur quatre ce jour-là</span>
             <span class="oss-date">2026-04-22</span>
           </div>
           <h3 class="oss-title">
@@ -193,7 +193,8 @@ const cards = [
             npm publie en premier. Ce cask attrape les nouvelles versions le jour même de leur sortie.
           </p>
           <p class="oss-body">
-            Un petit patch, mais le mien. Premier PR que j'envoie dans un projet public — il y en aura d'autres.
+            Un petit patch, mais le sien. <strong>Premier</strong> des quatre PRs que Stéphane a shippés le même jour
+            (ublue-os, grafana/alloy, wazuh, requarks/wiki) — tous en attente de review upstream.
           </p>
           <div class="oss-links">
             <a href="https://github.com/ublue-os/homebrew-experimental-tap/pull/309" class="oss-link" target="_blank" rel="noopener">