Fix region setup and simplify the bilingual documentation

.github/ISSUE_TEMPLATE/community_idea.yml

@@ -24,7 +24,7 @@ body:
         - Feature or project idea
         - Other community feedback
     validations:
-      required: true
+      required: false
 
   - type: dropdown
     id: experience
@@ -37,7 +37,7 @@ body:
         - Repeater, room server, or observer operator
         - Developer or documentation contributor
     validations:
-      required: true
+      required: false
 
   - type: input
     id: summary
@@ -71,7 +71,7 @@ body:
       description: What should change?
       placeholder: Add...
     validations:
-      required: true
+      required: false
 
   - type: textarea
     id: context

.github/workflows/quality.yml

@@ -154,3 +154,11 @@ jobs:
         run: |
           export CHROME_PATH="$(command -v google-chrome || command -v google-chrome-stable)"
           npm run audit:lighthouse
+
+      - name: Save Lighthouse reports
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: lighthouse-reports
+          path: .tmp/lighthouse/*.json
+          retention-days: 7

README.md

@@ -0,0 +1,73 @@
+# MeshCore Canada
+
+Community documentation and network tools for [meshcore.ca](https://meshcore.ca/),
+in English and French. Built with MkDocs Material and small browser scripts.
+
+## Work locally
+
+Use Python 3.13 and Node.js 22.19 or newer. From the repository root:
+
+```sh
+python -m pip install -r requirements-docs.txt
+npm ci
+npm run docs:build
+python -m http.server 4173 --bind 127.0.0.1 --directory .tmp/site
+```
+
+Open `http://127.0.0.1:4173/`. Rebuild after editing. Build output belongs in
+`.tmp/`, not in a commit. `npm run docs:build:preview` builds for subpath hosting.
+
+## Where to make changes
+
+- Pages: `docs/`. Update each English `.md` and French `.fr.md` pair; retain old
+  heading anchors when changing titles.
+- Navigation, theme, and shared templates: `mkdocs.yml` and `overrides/`.
+- Community listings: `data/communities.json` and `data/communities.fr.json`.
+  Run `python scripts/validate-communities.py --write` after editing the source.
+  It generates the directory pages and `docs/assets/radio-profiles.json`.
+- Region tools: `docs/assets/regions/` and `docs/config/editor/`.
+  Follow the boundary proposal workflow; do not hand-edit generated geography.
+- Broker settings: `docs/analyzer/observer-config.json`. The build generates the
+  broker reference table from this file, including its no-JavaScript version.
+- Anonymous submissions: `tools/region-proposal-gateway/`. The site and gateway
+  deploy separately; check the gateway README before changing their contract.
+
+Never commit credentials, private keys, precise private locations, or test
+submissions containing personal information. Human maintainers review changes
+before publication; an automated test is not hardware or policy approval.
+
+## Check a change
+
+```sh
+python scripts/validate-content.py
+python scripts/validate-communities.py
+python scripts/validate_community_submission.py
+python -m unittest discover -s tests/content -p "test_*.py"
+npm run test:content
+npm run test:editor
+npm run check:links
+npx playwright install chromium firefox webkit
+npm run test:browser
+npm run audit:lighthouse
+```
+
+The broker-helper tests need Bash and PowerShell (`pwsh`); on Windows they use
+Git Bash. They run in temporary directories, do not install software, and never
+connect to a real broker. Browser submission tests intercept requests locally.
+
+For region, gateway, or automation changes, also run:
+
+```sh
+python -m pip install -r scripts/requirements-regions.txt
+python -m pip install -r tools/region-proposal-gateway/requirements.txt
+node scripts/validate-regions.cjs
+python scripts/verify-region-geometry.py
+python scripts/verify-region-geometry.py --partition docs/assets/regions/canada-region-partition-digital.geojson
+python -m unittest discover -s tools/region-proposal-gateway/tests
+python -m unittest discover -s tests/automation
+```
+
+The quality workflow runs these checks on pull requests. Publishing is a separate
+reviewed workflow; opening a PR does not authorize deploying it or changing brokers.
+See [the September audit follow-up](maintenance/site-audit-2026-09-04.md) for the
+current fixes, test coverage, and confirmations still needed from maintainers.

docs/analyzer/broker-reference.fr.md

@@ -15,8 +15,6 @@ estimated_time: 8 minutes
 destructive: false
 page_styles:
   - assets/styles/analyzer.css?v=20260722-2
-page_scripts:
-  - assets/javascripts/analyzer-broker-reference.js?v=20260722-2
 ---
 
 # Paramètres de connexion des observateurs
@@ -45,10 +43,13 @@ Ces valeurs proviennent de la [configuration commune des observateurs](observer-
       <tbody id="broker-reference-body"></tbody>
     </table>
   </div>
-  <p class="mc-location-status" id="broker-reference-status" role="status">Chargement des paramètres officiels de connexion…</p>
 </div>
 
-Si le tableau ne s’affiche pas, ouvrez [observer-config.json](observer-config.json).
+## Accès en lecture seule
+
+La [liste des comptes MQTT en lecture seule](data-collection-access.md#read-only-mqtt-accounts) indique les abonnés autorisés, dont QuinteMesh. Pour demander un accès, contactez un administrateur ci-dessous.
+
+Les réglages JWT de cette page concernent les **observateurs qui publient des paquets**. Les abonnés en lecture seule utilisent les identifiants et les instructions fournis par un administrateur. N’utilisez pas la clé privée d’un observateur pour cet accès.
 
 ## Administrateurs des courtiers
 

docs/analyzer/broker-reference.md

@@ -15,8 +15,6 @@ estimated_time: 8 minutes
 destructive: false
 page_styles:
   - assets/styles/analyzer.css?v=20260722-2
-page_scripts:
-  - assets/javascripts/analyzer-broker-reference.js?v=20260722-2
 ---
 
 # Observer connection reference
@@ -44,10 +42,13 @@ These values come from the shared [observer configuration](observer-config.json)
       <tbody id="broker-reference-body"></tbody>
     </table>
   </div>
-  <p class="mc-location-status" id="broker-reference-status" role="status">Loading official connection settings…</p>
 </div>
 
-If the table does not load, open [observer-config.json](observer-config.json).
+## Read-only access
+
+See the [read-only MQTT account list](data-collection-access.md#read-only-mqtt-accounts) for approved subscribers, including QuinteMesh. Ask an administrator below to request access.
+
+The JWT settings on this page are for **observers publishing packets**. Read-only subscribers use the credentials and connection instructions supplied by an administrator. Do not use an observer’s private key for subscriber access.
 
 ## Broker administrators
 

docs/analyzer/builds/mctomqtt.fr.md

@@ -63,8 +63,8 @@ Sur un hôte à liaison série, l’outil :
 
 Pour la capture d’un compagnon, il met à jour
 `~/.meshcore-packet-capture/.env.local`, crée une sauvegarde horodatée,
-configure les emplacements 1 et 2, désactive les emplacements 3 à 6 et peut
-redémarrer le service de capture.
+met à jour les emplacements MeshCore Canada existants ou utilise des emplacements
+vides. Les autres connexions sont conservées. Il peut redémarrer le service de capture.
 
 Les options d’installation téléchargent et exécutent des programmes
 d’installation distincts provenant des projets d’origine. Ne les utilisez pas
@@ -128,7 +128,7 @@ Après avoir examiné la version actuellement publiée de l’outil, vous pouvez
 exécuter directement ce même fichier :
 
 ```bash
-bash <(curl -fsSL https://meshcore.ca/analyzer/scripts/add-meshcore-ca-broker.sh) --device serial-host --iata YOW
+bash add-meshcore-ca-broker.sh --device serial-host --iata YOW
 ```
 
 La méthode de téléchargement présentée plus haut facilite l’examen et la

docs/analyzer/builds/mctomqtt.md

@@ -59,7 +59,7 @@ On a serial host, the helper:
 - adds the primary and backup MeshCore Canada addresses and location code; and
 - restarts `mctomqtt` unless `--no-restart` is used.
 
-For companion capture, it updates `~/.meshcore-packet-capture/.env.local`, makes a timestamped backup, configures slots 1 and 2, disables slots 3–6, and may restart the capture service.
+For companion capture, it updates `~/.meshcore-packet-capture/.env.local`, makes a timestamped backup, updates existing Canada broker slots or uses empty slots, and may restart the capture service.
 
 Install flags download and run separate upstream installers. Do not use them until you have reviewed the named upstream installer too.
 
@@ -114,7 +114,7 @@ The service should stay active without repeated TLS or authentication errors.
 After reviewing the current published helper, you can run that same file directly:
 
 ```bash
-bash <(curl -fsSL https://meshcore.ca/analyzer/scripts/add-meshcore-ca-broker.sh) --device serial-host --iata YOW
+bash add-meshcore-ca-broker.sh --device serial-host --iata YOW
 ```
 
 The downloaded-file method above is easier to review and recover.

docs/analyzer/builds/mqtt-firmware.fr.md

@@ -15,7 +15,8 @@ destructive: true
 page_styles:
   - assets/styles/analyzer.css?v=20260722-2
 page_scripts:
-  - assets/javascripts/analyzer-command-builder.js?v=20260722-2
+  - assets/javascripts/radio-profiles.js?v=20260904-1
+  - assets/javascripts/analyzer-command-builder.js?v=20260904-1
 ---
 
 # Configurer un observateur MQTT autonome
@@ -100,6 +101,10 @@ propre à la communauté, la configuration canadienne de départ est :
 
 ### 3. Générer les commandes
 
+Ces commandes remplacent les emplacements MQTT **1 et 2**. S’ils servent déjà à un
+autre réseau, ajoutez le Canada dans des emplacements libres avec **Configure via USB**.
+Les emplacements 3 à 6 restent inchangés. La répétition est désactivée par défaut.
+
 L’interface en ligne de commande n’a pas de règle générale documentée pour les
 guillemets. Le générateur rejette les espaces, les guillemets, les barres
 obliques inverses, les caractères de contrôle et les autres valeurs Wi-Fi
@@ -146,11 +151,14 @@ représenter de façon sûre.
     <label class="mc-command-field--wide">
       <strong>Trafic du réseau maillé</strong>
       <select id="observer-repeat">
-        <option value="on">Observer et relayer les paquets</option>
-        <option value="off">Observer seulement</option>
+        <option value="off">Observer seulement (recommandé)</option>
+        <option value="on">Observer et relayer — à coordonner localement</option>
       </select>
     </label>
   </div>
+  <label><strong>Réseau radio</strong><select id="observer-radio"><option value="keep">Conserver les réglages actuels</option></select></label>
+  <p>Choisissez le profil de votre communauté. L’emplacement seul ne détermine pas les réglages radio.</p>
+  <label><strong>Taille de l’identifiant d’annonce</strong><select id="observer-hash"><option value="keep">Conserver les réglages actuels</option><option value="2">3 octets</option><option value="1">2 octets</option><option value="0">1 octet</option></select></label>
   <p class="mc-command-notice" id="observer-location-status" aria-live="polite">Chargement des suggestions d’emplacements canadiens…</p>
   <p class="mc-command-notice" id="observer-secret-help">Le SSID et le mot de passe restent uniquement dans cette page. Ils sont effacés lorsque vous la quittez et masqués dans l’aperçu jusqu’à ce que vous choisissiez de les afficher.</p>
   <div class="mc-command-errors" id="observer-command-errors" role="alert" aria-live="assertive"></div>
@@ -175,23 +183,17 @@ sensibles :
 
 ```text
 set name YOW-Repeater-01
-set radio 910.525,62.5,7,5
-set path.hash.mode 2
 set mqtt.iata YOW
 set wifi.powersave none
 set mqtt1.preset meshcore-ca-1
 set mqtt2.preset meshcore-ca-2
-set mqtt3.preset none
-set mqtt4.preset none
-set mqtt5.preset none
-set mqtt6.preset none
 set mqtt.status on
 set mqtt.packets on
 set mqtt.raw off
 set mqtt.rx on
 set mqtt.tx advert
 set bridge.enabled on
-set repeat on
+set repeat off
 advert
 ```
 
@@ -233,7 +235,7 @@ La carte est correctement configurée lorsque :
 - le code d’emplacement est exact;
 - les préréglages sont `meshcore-ca-1` et `meshcore-ca-2`;
 - la publication des paquets et le mode pont sont activés;
-- le mode de hachage des chemins est `2`.
+- le profil radio et la taille d’identifiant correspondent à vos choix.
 
 ## Vérifier dans CoreScope { #check-in-corescope }
 

docs/analyzer/builds/mqtt-firmware.md

@@ -15,7 +15,8 @@ destructive: true
 page_styles:
   - assets/styles/analyzer.css?v=20260722-2
 page_scripts:
-  - assets/javascripts/analyzer-command-builder.js?v=20260722-2
+  - assets/javascripts/radio-profiles.js?v=20260904-1
+  - assets/javascripts/analyzer-command-builder.js?v=20260904-1
 ---
 
 # Build a standalone MQTT observer
@@ -88,6 +89,10 @@ Use the local mesh settings. When no community override exists, the Canadian onb
 
 ### 3. Build the commands
 
+These commands replace MQTT slots **1 and 2**. Check those slots first; if they
+serve another network, use **Configure via USB** to add Canada in unused slots.
+Slots 3–6 are left unchanged. Repeating is off unless you choose to enable it.
+
 The CLI has no documented general quoting contract. The builder rejects spaces, quotes, backslashes, control characters, and other ambiguous Wi-Fi values. Use **Configure via USB** for a network it cannot represent safely.
 
 <div class="mc-command-builder" id="observer-command-builder" data-location-source="../../location-codes.json">
@@ -130,11 +135,14 @@ The CLI has no documented general quoting contract. The builder rejects spaces,
     <label class="mc-command-field--wide">
       <strong>Mesh traffic</strong>
       <select id="observer-repeat">
-        <option value="on">Observe and repeat packets</option>
-        <option value="off">Observe only</option>
+        <option value="off">Observe only (recommended)</option>
+        <option value="on">Observe and repeat packets — coordinate locally first</option>
       </select>
     </label>
   </div>
+  <label><strong>Radio network</strong><select id="observer-radio"><option value="keep">Keep current settings</option></select></label>
+  <p>Choose your community’s profile explicitly. Location alone does not select a radio network.</p>
+  <label><strong>Advert ID size</strong><select id="observer-hash"><option value="keep">Keep current settings</option><option value="2">3 bytes</option><option value="1">2 bytes</option><option value="0">1 byte</option></select></label>
   <p class="mc-command-notice" id="observer-location-status" aria-live="polite">Loading Canadian location suggestions…</p>
   <p class="mc-command-notice" id="observer-secret-help">SSID and password stay in this page only. They are cleared when you leave and hidden from the preview until you reveal them.</p>
   <div class="mc-command-errors" id="observer-command-errors" role="alert" aria-live="assertive"></div>
@@ -152,27 +160,23 @@ Check the non-sensitive summary and redacted preview. Reveal and copy commands o
 
 ### Enter commands by hand
 
+These commands preserve radio settings and presets 3–6, but replace presets 1 and 2. On an existing observer, check those slots first. Choose radio values in the builder above; changes take effect after reboot. Observing does not require repeating. Enable repeating only after coordinating with nearby operators.
+
 If you prefer manual entry, set the non-sensitive values first:
 
 ```text
 set name YOW-Repeater-01
-set radio 910.525,62.5,7,5
-set path.hash.mode 2
 set mqtt.iata YOW
 set wifi.powersave none
 set mqtt1.preset meshcore-ca-1
 set mqtt2.preset meshcore-ca-2
-set mqtt3.preset none
-set mqtt4.preset none
-set mqtt5.preset none
-set mqtt6.preset none
 set mqtt.status on
 set mqtt.packets on
 set mqtt.raw off
 set mqtt.rx on
 set mqtt.tx advert
 set bridge.enabled on
-set repeat on
+set repeat off
 advert
 ```
 
@@ -210,7 +214,7 @@ The board is configured correctly when:
 - the location code is correct;
 - presets are `meshcore-ca-1` and `meshcore-ca-2`;
 - packet publishing and bridge mode are on; and
-- path hash mode is `2`.
+- the radio profile and path hash mode match your explicit choices.
 
 ## Verify in CoreScope
 

docs/analyzer/builds/pymc.fr.md

@@ -50,7 +50,9 @@ Notez l’état actuel du service :
 
 ```bash
 sudo systemctl status pymc-repeater --no-pager
-sudo cp -- /etc/pymc_repeater/config.yaml /etc/pymc_repeater/config.yaml.pre-meshcore-ca
+backup="/etc/pymc_repeater/config.yaml.pre-meshcore-ca.$(date -u +%Y%m%dT%H%M%S).$"
+sudo cp --no-clobber -- /etc/pymc_repeater/config.yaml "$backup"
+printf 'Backup: %s\n' "$backup"
 ```
 
 ## Ce qui sera modifié
@@ -140,7 +142,7 @@ bon état ne confirme pas que les paquets se sont rendus à CoreScope.
 Restaurez exactement la sauvegarde créée avant la modification :
 
 ```bash
-sudo cp -- /etc/pymc_repeater/config.yaml.pre-meshcore-ca /etc/pymc_repeater/config.yaml
+sudo cp -- "${backup:?Set backup to the saved backup path first}" /etc/pymc_repeater/config.yaml
 sudo systemctl restart pymc-repeater
 sudo systemctl status pymc-repeater --no-pager
 ```

docs/analyzer/builds/pymc.md

@@ -45,7 +45,9 @@ Record the current service state:
 
 ```bash
 sudo systemctl status pymc-repeater --no-pager
-sudo cp -- /etc/pymc_repeater/config.yaml /etc/pymc_repeater/config.yaml.pre-meshcore-ca
+backup="/etc/pymc_repeater/config.yaml.pre-meshcore-ca.$(date -u +%Y%m%dT%H%M%S).$"
+sudo cp --no-clobber -- /etc/pymc_repeater/config.yaml "$backup"
+printf 'Backup: %s\n' "$backup"
 ```
 
 ## What this changes
@@ -128,7 +130,7 @@ Finish with [Check your observer](../verify.md). A healthy systemd service is no
 Restore the exact backup made before editing:
 
 ```bash
-sudo cp -- /etc/pymc_repeater/config.yaml.pre-meshcore-ca /etc/pymc_repeater/config.yaml
+sudo cp -- "${backup:?Set backup to the saved backup path first}" /etc/pymc_repeater/config.yaml
 sudo systemctl restart pymc-repeater
 sudo systemctl status pymc-repeater --no-pager
 ```