astro check restored: tsconfig excludes public/ (the 2 MB vendored CMS bundle was what exhausted the heap) and extends tsconfigs/strict; type annotations in template scripts, z from astro/zod; exact version pins; compressHTML true (lossless whitespace, no words glued to links) and explicit trailingSlash/build.format; README: upgrading section

README.md

@@ -50,9 +50,12 @@ git clone https://astro-git.isl-dev.grid.cyfronet.pl/ctao/content.git ../ctao-co
 ./scripts/link-content.sh   # copies news/pages/uploads into the dev tree
 npm run dev        # http://localhost:4321
 npm run build      # static output in dist/
-npm run check      # deterministic gate: build + internal-link check
+npm run check      # deterministic gate: astro check (types) + build + internal-link check
 ```
 
+`tsconfig.json` excludes `public/` on purpose: the vendored CMS bundle there is
+2 MB of minified JS and would make `astro check` run out of memory.
+
 ## Layout
 
 | Path | What |
@@ -76,3 +79,17 @@ Saving commits to `main`; the machine polls and republishes automatically
 Note for styling work: `public/admin/preview.css` mirrors the `.prose` rules
 from `global.css` so the editor preview matches the site 1:1 — keep them in
 sync (both files carry a KEEP IN SYNC comment).
+
+## Upgrading
+
+Versions are pinned exactly; an upgrade is a deliberate change, never a side
+effect of `npm install`. Astro ships security fixes only for the current and
+one previous major, so plan one upgrade per major rather than skipping several.
+
+```
+npx @astrojs/upgrade      # moves astro and official integrations together
+npm run check             # types + build + links must pass
+npm run preview           # verify the real dist/ output, not the dev server
+```
+
+No experimental flags in `astro.config.mjs`: they can change in minor releases.