fix(build): copy dist into website/releases/<tool>_alpha.html instead of symlinking

The earlier symlink approach (commit 03f83ad) broke under the canonical
deployment shape. The Caddy systemd unit at
/etc/containers/systemd/caddy.container mounts only

    /home/user/src/zddc/website:/usr/share/caddy/zddc:ro

into the Caddy container, so a symlink at
website/releases/landing_alpha.html → ../../landing/dist/index.html
resolves to /usr/share/caddy/landing/dist/index.html inside the
container — a path that simply doesn't exist there. Result:
GET https://zddc.varasys.io/releases/landing_alpha.html → 404, and
the dev cluster's level-2 stub failed to load.

Revert update_alpha() to a plain copy. Trade-off goes back to: every
dev build dirties the corresponding _alpha.html in git. Commit
alongside source changes (alpha is mutable channel anyway) or
git checkout to discard. cp follows symlinks at the destination, so
the helper now `rm -f`s the dest before copying — handles the
symlink-to-file transition cleanly.

Updates AGENTS.md and CLAUDE.md to describe the copy semantics and
the volume-mount constraint that motivates them. Five _alpha.html
files convert from symlinks back to regular files (typechange).

End-to-end verified: curl https://zddc.varasys.io/releases/landing_alpha.html
returns 200 (30177 bytes) after the rebuild.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

AGENTS.md

@@ -165,7 +165,7 @@ Three channels:
 
 - **Stable**: versioned, immutable. `sh tool/build.sh --release [version]` writes `website/releases/<tool>_v<version>.html`, refreshes the `<tool>_stable.html` symlink, and tags `<tool>-v<version>`. Skips automatically if source has not changed since the latest tag. Pass an explicit version to override auto-increment.
 - **Beta**: mutable. `sh tool/build.sh --release beta` overwrites `website/releases/<tool>_beta.html` in place. No tag. The on-page label is `beta · <date> · <sha>` so the source is recoverable from git via the SHA.
-- **Alpha**: mutable, analogous. `sh tool/build.sh --release alpha`. **Also**: every plain (non-release) `tool/build.sh` invocation reasserts a relative symlink `website/releases/<tool>_alpha.html` → `../../<tool>/dist/<tool>.html`, so the alpha hyperlinks on the website always serve whatever dist currently holds (no file copy, idempotent — git sees nothing on a rebuild). Symlinked alpha pages carry the dev label `Built: <ts> BETA` (red) since the dist file does. A deliberate `--release alpha` overwrites the symlink with a real file labeled `alpha · <date> · <sha>`; the next plain build re-symlinks it. Deployment must serve from the repo working folder (or otherwise resolve `../../<tool>/dist/` relative to `website/releases/`).
+- **Alpha**: mutable, analogous. `sh tool/build.sh --release alpha`. **Also**: every plain (non-release) `tool/build.sh` invocation copies the just-built dist file into `website/releases/<tool>_alpha.html`, so the alpha hyperlinks on the website always serve the latest dev build. Plain copy (not symlink) so the file is reachable regardless of how the web server mounts the working tree (the canonical Caddy setup at `/etc/containers/systemd/caddy.container` mounts only `website/` read-only and cannot follow `../<tool>/dist/` symlinks). Side-effect: every dev build dirties the corresponding `_alpha.html` in `website/releases/`; commit those alongside the source change or `git checkout` them before pushing. Copied alpha pages carry the dev label `Built: <ts> BETA` (red) since the dist file does; `--release alpha` overwrites with the formal `alpha · <date> · <sha>` label.
 
 Stable releases do **not** automatically clobber `<tool>_alpha.html` / `<tool>_beta.html` — those keep whatever was last built into them. Use `./freshen-channel <tool> <channel>` (see "Freshen helper" below) to drag a channel forward to current stable; never `git checkout` the main worktree by hand for this.
 
@@ -173,7 +173,7 @@ After cutting a stable release, run `git push --tags` to publish the tag.
 
 The "skip if no source change since last tag" guard for stable releases compares **HEAD** to the latest tag — uncommitted working-tree changes are invisible. If you edit a tool and want a stable release to actually fire, commit the change first; otherwise the build prints `no source changes since <tool>-vX.Y.Z — skipping` and exits 0. Alpha and beta channel builds always rebuild (no skip check).
 
-Agents must **never** write to `website/releases/<tool>_v*.html`, `website/releases/<tool>_stable.html`, `website/releases/<tool>_beta.html`, or `website/index.html` directly — always go through `--release` or `./freshen-channel`. (The `<tool>_alpha.html` files are an exception: every plain build reasserts them as symlinks into `<tool>/dist/`, as described above.)
+Agents must **never** write to `website/releases/<tool>_v*.html`, `website/releases/<tool>_stable.html`, `website/releases/<tool>_beta.html`, or `website/index.html` directly — always go through `--release` or `./freshen-channel`. (The `<tool>_alpha.html` files are an exception: every plain build rewrites them with a copy of the current dist, as described above.)
 
 `landing/build.sh --release <version>` additionally writes `website/index.html` (the root URL of zddc.varasys.io).
 

CLAUDE.md

@@ -38,7 +38,7 @@ No lint/typecheck/format commands exist — vanilla JS + POSIX sh by design.
 ## Things that bite if you forget
 
 - **`dist/` is gitignored but force-committed** (`git add -f tool/dist/tool.html`). Never hand-edit a `dist/` file.
-- **Never write to `website/index.html`, `website/releases/<tool>_v*.html`, `website/releases/<tool>_stable.html`, or `website/releases/<tool>_beta.html` directly** — promote via `sh tool/build.sh --release [version|alpha|beta]`. Stable releases write `website/releases/<tool>_v<ver>.html` (immutable) and refresh `<tool>_stable.html`; alpha/beta overwrite `<tool>_<channel>.html` in place. **Exception: `<tool>_alpha.html` files** — every plain `tool/build.sh` reasserts them as relative symlinks into `<tool>/dist/`, so dev builds stay clean in git. `--release alpha` overwrites the symlink with a real file; the next plain build re-symlinks.
+- **Never write to `website/index.html`, `website/releases/<tool>_v*.html`, `website/releases/<tool>_stable.html`, or `website/releases/<tool>_beta.html` directly** — promote via `sh tool/build.sh --release [version|alpha|beta]`. Stable releases write `website/releases/<tool>_v<ver>.html` (immutable) and refresh `<tool>_stable.html`; alpha/beta overwrite `<tool>_<channel>.html` in place. **Exception: `<tool>_alpha.html` files** — every plain `tool/build.sh` mirrors the dist file there as a real copy (not symlink — the canonical Caddy serves only `website/` and can't follow `../` paths). Side-effect: dev builds dirty those files; commit alongside the source change or `git checkout` to discard.
 - **Always build before running tests** — Playwright opens `dist/tool.html` via `file://`.
 - **`</` in JS string/template literals breaks inline `<script>`** embedding. `shared/build-lib.sh` provides `escape_js_close_tags`; every tool's `build.sh` runs JS through it before inlining.
 - **All ZDDC parsing/formatting/hashing goes through `window.zddc`** (from `shared/zddc.js` + `shared/hash.js` + `shared/zddc-filter.js`). API: `parseFilename`, `parseFolder`, `parseRevision`, `formatFilename`, `formatFolder`, `compareRevisions`, `isValidStatus`, `splitExtension`, `joinExtension`, `crypto.{sha256Hex, sha256String, sha256File, bytesToHex}`, `filter.{parse, matches}`. File objects across tools use `trackingNumber` (string) and `extension` (string, **no leading dot** — use `zddc.joinExtension(name, ext)` to build a filename). Add edge cases to `tests/zddc.spec.js`, not per-tool tests.

shared/build-lib.sh

@@ -25,18 +25,17 @@
 #                                   driven by $channel and $build_version. For
 #                                   stable, also update the _stable.html
 #                                   symlink and create the git tag.
-#   update_alpha <tool>            — (re)point website/releases/<tool>_alpha.html
-#                                   as a relative symlink at the just-built dist
-#                                   file, so the site's alpha hyperlinks always
-#                                   serve whatever dist currently holds. Called
-#                                   automatically by each tool's build.sh on
-#                                   plain (non-release) builds. Idempotent —
-#                                   reasserting the link on every build leaves
-#                                   git clean. `--release alpha` still works:
-#                                   promote_release replaces the symlink with a
-#                                   real file labeled "alpha · <date> · <sha>"
-#                                   (a deliberate snapshot that persists until
-#                                   the next dev build re-symlinks).
+#   update_alpha <tool>            — copy the just-built dist file to
+#                                   website/releases/<tool>_alpha.html so the
+#                                   site's alpha hyperlinks always serve the
+#                                   latest dev build. Called automatically by
+#                                   each tool's build.sh on plain (non-release)
+#                                   builds. Plain copy (not symlink) so it
+#                                   survives deployments whose web server only
+#                                   mounts website/. `--release alpha` writes
+#                                   the same file with the formal
+#                                   "alpha · <date> · <sha>" label; the next
+#                                   plain build clobbers it.
 #
 # Channels and release args:
 #   <none>            dev build, dist/ only, label "Built: <ts> BETA" (red).
@@ -209,19 +208,34 @@ promote_release() {
     echo "Tagged ${_tool}-v${build_version} — run: git push --tags"
 }
 
-# (Re)point website/releases/<tool>_alpha.html at the just-built dist file via
-# a relative symlink, so the website's alpha hyperlinks always serve whatever
-# dist currently holds. Called by each tool's build.sh whenever a release is
-# NOT being cut. Idempotent: if the link already points at the right target,
-# git sees no change. `--release alpha` overwrites this link with a real file
-# (with the "alpha · date · sha" label); the next plain build re-symlinks it.
+# Mirror the just-built dist file to website/releases/<tool>_alpha.html so
+# the website's alpha hyperlinks always serve whatever dist currently holds.
+# Plain copy (not symlink): symlinks pointing outside website/ break under
+# deployments whose web server only mounts website/ (notably the canonical
+# Caddy setup at /etc/containers/systemd/caddy.container, which mounts
+# /home/user/src/zddc/website read-only and cannot follow ../ paths to
+# landing/dist or archive/dist on the host filesystem).
+#
+# Trade-off: every dev build that touches a tool's source dirties the
+# corresponding _alpha.html file in git. Commit those alongside the source
+# change (or `git checkout` them before pushing) since the alpha channel is
+# explicitly mutable.
+#
+# `--release alpha` overwrites the same file with a "alpha · date · sha"
+# labeled build; the next plain build clobbers it again. That's the alpha-
+# is-mutable contract.
+#
 # Reads $output_html and $root_dir from caller scope.
 update_alpha() {
     _tool="$1"
     _releases_dir="$root_dir/../website/releases"
-    _dist_basename=$(basename "$output_html")
-    _target="../../${_tool}/dist/${_dist_basename}"
+    _dest="${_releases_dir}/${_tool}_alpha.html"
     mkdir -p "$_releases_dir"
-    (cd "$_releases_dir" && ln -sfn "$_target" "${_tool}_alpha.html")
-    echo "Linked ${_tool}_alpha.html -> $_target"
+    # rm first: if the dest is currently a symlink to dist (legacy from the
+    # earlier symlink approach), `cp` would follow the symlink and try to
+    # write to the same file it's reading from. Removing first replaces the
+    # symlink with a plain regular file copy.
+    rm -f "$_dest"
+    cp "$output_html" "$_dest"
+    echo "Mirrored to $_dest"
 }

website/releases/archive_alpha.html

@@ -1 +0,0 @@
-../../archive/dist/archive.html

website/releases/classifier_alpha.html

@@ -1 +0,0 @@
-../../classifier/dist/classifier.html

website/releases/landing_alpha.html

@@ -1 +0,0 @@
-../../landing/dist/index.html

website/releases/mdedit_alpha.html

@@ -1 +0,0 @@
-../../mdedit/dist/mdedit.html

website/releases/transmittal_alpha.html

@@ -1 +0,0 @@
-../../transmittal/dist/transmittal.html