# D41. A web target beside SCORM 1.2: one build, a module for a plain web server (14 Oct 2026) The first public version needs courses shown on the marketing site (free navigation, nothing kept), an online review with comments, and publication on Elabora's servers. All three are the same thing to the core: a module served as static files, without an LMS. One build chain keeps two targets; the hosting (Cloudflare R2 and D1, a separate content domain, EU jurisdiction), accounts and the review's hooks come later and build on this. - **The target.** `elabora build --target web` (MCP `elabora_build` `target: "web"`, the engine's build request `target`, `@elabora/node` `build({ target: 'web', web })`) writes `dist/--web/`, a folder to serve as it is, and its ZIP (both by default). Everything the SCORM package holds but `imsmanifest.xml`; no LMS profile, suspend data budget, package limit or forbidden extension applies (`validateProject` takes `target: 'web'`), file names stay portable (they are URLs). Still deterministic (D8): the same course and settings give the same bytes. `--profile` is refused with it, the web settings without it. The report and the proof dossier say `target: "web"` and the settings; the pending human gate is a trial at the published address instead of the LMS smoke test. - **Progress: `local` (default) or `none`.** The player takes a third adapter (`packages/player/src/web.ts`) when the course data says `delivery.target: "web"`, and then never looks for an LMS: `local` keeps the lesson location, status, score and suspend data in `localStorage` under `elabora:web:` (the same encoding and permanent keys as in an LMS, D4, so a learner resumes across updates), never the interactions or the session time (an LMS's journal); `none` reads and writes nothing, the narration's preferences included, and a reload starts again. Neither shows a banner nor Quit (no platform to go back to). SCORM packages and the preview's standalone adapter (sessionStorage, its banner) are unchanged. - **Navigation: `authored` (default) or `free`.** `free` is applied by the compiler, in the course data, so the player has no second set of rules: `navigation.mode: "free"` (every screen reachable from the outline), `lockUntilComplete: false` (Next, Continue and narrated steps wait for nothing: no activity, visited controls or narration to finish first), the outline shown, and the narrations' `seek: "seen"` becomes `free` (`none`, a timeline without a bar, stays). Events, visited controls and conditions still work as written; they no longer hold the learner back. - **Defaults: a publication.** `local` + `authored`: a module built for the web without a word is the course as designed, and a learner who comes back finds where they left. The locks are pedagogical choices (an assessment after its practice, a narration heard before going on), so opening them is a decision someone takes, never a default; losing progress silently is worse than keeping it in the learner's own browser (nothing leaves it; no account, no cookie, no server). A showcase says `--progress none --navigation free` (nothing kept on a marketing site, a visitor goes where they like); a review link will say `--navigation free --noindex`, its progress to choose with the review. - **The page.** `index.html` gets the course's `title` and `description` (``, Open Graph `og:title`, `og:description`, `og:type`, a Twitter card), `--noindex` (``), `--url` (the absolute address of the module: ``, `og:url`; an address without a file name is the module's folder), and `--image` (a PNG, JPEG or WebP copied as `share.`, `og:image` absolute with `--url`). **The course has no thumbnail**: the app draws one per project in its data folder (`/thumbnail.png`, machine-local, never in the course), so the build takes the image it is given rather than invent one; `E_WEB_IMAGE`, `E_WEB_URL`, `W_WEB_IMAGE_WITHOUT_URL` (sharing previews only read absolute addresses). - **What hosting must give.** One origin per publisher at least (localStorage is per origin: two courses with the same id on one origin share their progress; a course's pages could read another's), HTTPS, and the folder served as it is; `X-Robots-Tag: noindex` on a whole review publication is the host's (the free objects' frames are pages of their own). *Revisit if:* the review needs progress kept per reviewer, or publication needs progress on the server (accounts): a fourth adapter beside `local`, the course data unchanged; or the format gets a sharing image or a short description of its own (course.json `share`). *Amended on 14 Oct 2026 (the privacy policy's drafts):* with `--progress local` the learner is told, quietly and in the module's language, that the progress stays in this browser, and may clear it: a last line of the outline (and of the page an `exit` leaves), « Votre progression reste dans ce navigateur. » and « Effacer ma progression », which asks once (« Effacer » / « Annuler »), then ends the visit without saving it, removes `elabora:web:` and starts the module again (labels `progressKept`, `clearProgress`, `clearProgressConfirm`, `clearProgressYes`, `cancel`, in the seven languages). It is in the player, as the adapter it resets is: `player.js` and `player.css` change for every build, and nothing else does; a module with `showMenu: false` says it only when the visit ends. *Amended on 29 Oct 2026 (the founder's policy for handles, elabora-cloud C33):* the progress kept with `local` is dated at each save (`savedAt`, milliseconds, beside the kept elements) and forgotten a year after the last one: the adapter removes `elabora:web:` and starts afresh (`WEB_PROGRESS_KEPT_MS`). Each visit saves, so each visit renews it. Elabora's hosting enforces the same year for everything an origin keeps, whatever player runs there, with a cookie of its own and `Clear-Site-Data` (C33); the player's rule holds on any other server too. A module on Elabora's hosting may meet a new address when its author changes their handle: a new origin, so learners start again there (no redirect, the founder's decision).