update

README.md

@@ -56,6 +56,99 @@ The site token lives in Windows Credential Manager under "ODIAN Launcher", one
 entry per site URL. The install id is generated on the PC the first time it saves
 its state, so a cloned drive never carries one.
 
+## Dev mode
+
+A developer's PC can run the whole stack out of git checkouts instead of the
+installed version, so a code change is one Launch away without cutting a pack.
+It is deliberately not a checkbox anyone can find: the Dev section of Settings
+appears only on a PC holding a **dev licence**, an Ed25519 document signed with
+the same key as a pack manifest and verified by the same code
+(`src-tauri/src/devmode.rs` over `odian_packs::signing::verify`).
+
+**This repo carries one.** `dev-licence.json` at the root is a *team* licence: it names no
+machine and no install, and says so in its signed body (`"scope": "team"`). Whoever can
+clone this repo can run dev mode — repo access is the credential, on purpose, because an
+operator has the installed launcher and never the source.
+
+- A launcher started **from this repo** (`npm run tauri dev`) finds it by itself: the
+  launcher looks beside its own exe and two levels up, which is the repo root.
+- For the launcher **installed on your PC**, run it once:
+  `powershell -ExecutionPolicy Bypass -File tools\enable-dev-mode.ps1`
+
+It still expires, and it is still refused if the signature does not match the release key.
+A licence that simply *forgot* its binding is refused as unbound — only one that claims the
+team scope is let through, so the weaker rule can never be reached by accident.
+
+For a stricter licence — a single PC, or a kit on one drive — mint one on the machine that
+has the signing key:
+
+```bash
+python -m odian_packs dev-licence --machine ODIAN-DEV-01 --expires 2027-01-31 --out licence.json
+```
+
+`--machine` is `%COMPUTERNAME%`, or use `--install-id` to bind it to one install
+instead (the id in `state\launcher.json`). A licence with neither binding is
+refused — an unbound one would work on every PC it is copied to.
+
+The launcher looks in these places on every refresh, best first:
+
+1. `<checkout folder>\dev-licence.json` — where a developer's kit lives, so the licence
+   travels with the checkouts on the same drive.
+2. Beside the running executable, and two levels above it — the repo root for a launcher
+   built from source, which is what makes the committed team licence work with no setup.
+3. `<install_dir>\state\dev-licence.json` — always supported, and the only place a PC with
+   **no licence yet** can use: the Dev section is hidden until one is found, so there is no
+   way to name a checkout folder before then. This is where `enable-dev-mode.ps1` puts it.
+
+It is signed and bound either way, so where it is read from changes nothing about what it
+permits. A refusal is logged once, naming the file it refused.
+
+With a licence, Settings gains:
+
+| Control | What it does |
+|---|---|
+| Checkout folder | The folder holding `ODIAN_Engine` (e.g. `E:\ODIAN_Dev`) |
+| Launch the whole stack from the checkout | Runs the checkout's API, tile server and `Odian.exe` |
+| Build it first, every launch | Runs `_APIuild.bat` then `toolsuilduild.bat Release` before launching |
+| Run as | An operator name to run as, instead of the one signed in |
+| Launch starts | ODIAN, the web client, or **both** |
+
+**Both is the one worth having.** There is one Postgres, one API and one tile server either
+way, so the `.exe` and the browser show the same rows from the same database at the same
+moment. This codebase holds the two clients to each other in a dozen places — the satellite
+propagator, the network graph, the track filters, the APP-6 placement and sizing — and a
+divergence there is invisible in review and obvious the moment both are on screen.
+
+The web client is the checkout's `_WEB` on Vite's own `:5173`, with hot reload, and the
+launcher opens a browser at
+`http://localhost:5173/?api=http://127.0.0.1:18080&user=<operator>` — `?api=` because the
+web's own default is `localhost:8080` (the repo's `api.bat`), not this stack's API, and
+`?user=` so both clients author as the same operator, a swapped one included. Its endpoint
+guard already trusts any loopback port, so nothing in `_WEB` needed changing. On first run
+"Build it first, every launch" also runs the web client's `npm install`, whenever
+`package.json` or `package-lock.json` is newer than `node_modules` — so a dependency that
+arrives with a pull is fetched, without paying for npm on every launch. (It has to be the
+manifest times, not "does node_modules exist": a pull leaves the folder in place and Vite
+then fails with `Failed to resolve import "<name>"`, which reads like broken source.)
+
+One thing is **not** local yet: `_WEB/vite.config.ts` proxies `/basemap`, `/netlayer` and
+`/mvt` to `https://tiles.odian.fr`, so the browser's map comes from the internet while the
+`.exe` beside it draws from this PC's tiles. The data — the part the two clients are held to
+agree on — is local for both.
+
+In dev mode every process gets **its own console window** — the whole point is
+seeing the API's and the client's output — and the same database, tiles and
+Postgres as an operator run, on the launcher's own ports (55432 / 18080 / 18081),
+so a dev run and the repo's `run-local.bat` (8080) do not collide. Stop still
+cuts everything: the job object owns the consoles too.
+
+**Run as switches the identity without Keycloak**, because the local API mints
+its own session from a shared secret and the launcher tells it who to be
+(`ODIAN_LAUNCH_USER`). What it cannot do is carry that identity to the DHP — work
+authored as someone else would arrive there under the account that signed in — so
+**while a different name is set, the launcher does not sync at all**, and says so.
+Typing your own name in changes nothing and costs nothing.
+
 ## The local stack
 
 `launch` starts four processes, all on 127.0.0.1, in this order, each waiting for the previous one: