From c64c2c1ba230dd3cdc7c980222abc71b6e45eacd Mon Sep 17 00:00:00 2001
From: baraline <antoine.guillaume45@gmail.com>
Date: Tue, 8 Sep 2026 09:20:53 +0200
Subject: [PATCH 01/14] fix(content): raise GlpiContentError and bound HTML
 nesting depth

markdownify walks the parsed document recursively at about two CPython
frames per nesting level, so roughly 494 levels of HTML exhausted the
default 1000-frame limit. The converter ran as a pydantic inbound
validator, so the RecursionError surfaced from inside model_validate --
a bare builtin escaping a package whose error surface is supposed to
derive from GlpiError.

from_transport now measures nesting first with a flat non-recursive O(n)
scan and, past MAX_HTML_DEPTH (200), strips tags instead of parsing. It
degrades and never truncates: every character the converting path would
have produced also appears in the degraded rendering. Anything the
parser still raises is wrapped in the new GlpiContentError, which
inherits GlpiError only -- no ValueError, since no release ever raised a
bare ValueError at these sites.

The limit is set from headroom rather than from the observed cliff: a
200-level document peaks at a measured 403 frames and the client
contributes 8 to 37 at the call site, so it holds until the caller's own
stack passes roughly 590 frames.

sys.setrecursionlimit is rejected, with the reasoning recorded beside
the constant and enforced by an AST guard in the raise-site audit: a
library must not mutate global interpreter state on its consumers'
behalf, and raising the limit past the C stack turns a catchable
RecursionError into an interpreter crash.

Both halves were fuzzed against html.parser over 15000 documents with
zero depth under-counts, zero over-counts and zero text losses. Four
rules the scan needs that are not the obvious ones: a closing tag pops
by name or is ignored, an attribute value may contain < and >, a
childless leaf is still a level, and the markup forms must be matched in
one left-to-right alternation to reproduce the parser's dispatch order.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 glpi_python_client/__init__.py                |   2 +
 glpi_python_client/_errors.py                 |  39 +-
 glpi_python_client/content/conversion.py      | 446 ++++++++++++++-
 .../content/tests/test_conversion.py          | 516 +++++++++++++++++-
 .../testing/tests/test_raise_site_audit.py    |  63 ++-
 glpi_python_client/tests/test_errors.py       |  15 +
 6 files changed, 1056 insertions(+), 25 deletions(-)

diff --git a/glpi_python_client/__init__.py b/glpi_python_client/__init__.py
index 13e3eb8..2e1d48c 100644
--- a/glpi_python_client/__init__.py
+++ b/glpi_python_client/__init__.py
@@ -20,6 +20,7 @@
 from glpi_python_client._async.clients import AsyncGlpiClient
 from glpi_python_client._errors import (
     GlpiAuthError,
+    GlpiContentError,
     GlpiError,
     GlpiNotFoundError,
     GlpiProtocolError,
@@ -145,6 +146,7 @@
     "GetUser",
     "GlpiAuthError",
     "GlpiClient",
+    "GlpiContentError",
     "GlpiEnum",
     "GlpiError",
     "GlpiGlobalValidation",
diff --git a/glpi_python_client/_errors.py b/glpi_python_client/_errors.py
index 20e41b6..dca37f3 100644
--- a/glpi_python_client/_errors.py
+++ b/glpi_python_client/_errors.py
@@ -1,10 +1,10 @@
 """Public exception hierarchy raised by :mod:`glpi_python_client`.
 
 Every exception the client raises for a bad argument, an unexpected HTTP
-status, an unusable response body, or a network-level fault deliberately
-derives from :class:`GlpiError`, so callers can catch the library's failure
-surface with a single ``except`` clause and never need to import the
-underlying HTTP library.
+status, an unusable response body, a network-level fault, or content it
+cannot convert deliberately derives from :class:`GlpiError`, so callers can
+catch the library's failure surface with a single ``except`` clause and
+never need to import the underlying HTTP library.
 
 Two deliberate exceptions to that rule remain:
 
@@ -17,6 +17,8 @@
 :class:`GlpiStatusError`, :class:`GlpiValidationError` and
 :class:`GlpiProtocolError` also inherit :class:`ValueError` so code written
 against earlier releases — which raised bare ``ValueError`` — keeps working.
+:class:`GlpiContentError` and :class:`GlpiTransportError` do not, for the
+reason given on each: nothing was passed in wrongly.
 """
 
 from __future__ import annotations
@@ -137,6 +139,34 @@ class GlpiProtocolError(GlpiError, ValueError):
     """
 
 
+class GlpiContentError(GlpiError):
+    """A rich-text content value could not be converted.
+
+    Raised when :class:`~glpi_python_client.content.GlpiContentConverter`
+    cannot translate a value between GLPI's HTML transport format and the
+    package's canonical Markdown — in either direction. The underlying
+    fault is always attached as ``__cause__``.
+
+    This exists so that no failure of the content layer escapes the
+    package's taxonomy. The conversion runs third-party parsers
+    (``markdownify`` inbound, ``markdown`` outbound), and a parser fault
+    used to reach the caller as a bare builtin — most visibly a
+    ``RecursionError``, which ``except GlpiError`` does not catch and which
+    a caller reading a ticket has no reason to expect from
+    ``get_ticket``. Deeply nested HTML is handled before it gets that far
+    (see :data:`glpi_python_client.content.conversion.MAX_HTML_DEPTH`);
+    this is the backstop for everything else.
+
+    Unlike :class:`GlpiStatusError`, :class:`GlpiValidationError` and
+    :class:`GlpiProtocolError` this does **not** inherit ``ValueError``.
+    Those three do so for back-compatibility with releases that raised
+    bare ``ValueError`` at the same sites; there was never a
+    ``ValueError`` here to be compatible with, and a parser exhausting the
+    interpreter's stack is not a value the caller got wrong. The reasoning
+    matches :class:`GlpiTransportError`.
+    """
+
+
 def status_error_class(status_code: int) -> type[GlpiStatusError]:
     """Return the most specific status-error class for one status code.
 
@@ -164,6 +194,7 @@ def status_error_class(status_code: int) -> type[GlpiStatusError]:
 
 __all__ = [
     "GlpiAuthError",
+    "GlpiContentError",
     "GlpiError",
     "GlpiNotFoundError",
     "GlpiProtocolError",
diff --git a/glpi_python_client/content/conversion.py b/glpi_python_client/content/conversion.py
index bacfeb4..f714a26 100644
--- a/glpi_python_client/content/conversion.py
+++ b/glpi_python_client/content/conversion.py
@@ -2,15 +2,27 @@
 
 This module translates between GLPI's HTML transport format and the package's
 canonical Markdown representation used by the rich content models.
+
+Both conversions run third-party parsers, and both walk the document
+recursively, so both have a nesting ceiling. Inbound content is measured
+before it is parsed and degraded past :data:`MAX_HTML_DEPTH` rather than
+allowed to hit that ceiling; anything else that goes wrong in either
+direction surfaces as :class:`~glpi_python_client.GlpiContentError` so no
+parser fault escapes the package's exception taxonomy.
 """
 
 from __future__ import annotations
 
 import re
+from collections import Counter
+from html import unescape
+from html.entities import html5 as _HTML5_REFERENCES
 
 from markdown import markdown as markdown_to_html
 from markdownify import markdownify as html_to_markdown
 
+from glpi_python_client._errors import GlpiContentError
+
 #: Element names that make a ``<...>`` sequence markup rather than text.
 #:
 #: The HTML5 element set, which is what the parser behind ``markdownify``
@@ -55,6 +67,181 @@
 #: place.
 _CANDIDATE_TAG = re.compile(r"</?([a-zA-Z][a-zA-Z0-9]*)\b[^<>]*>")
 
+#: Elements that cannot contain anything, so nothing nests below them.
+#:
+#: ``html.parser`` -- the parser ``markdownify`` builds its tree with --
+#: closes these itself, so ``<br>`` a thousand times over is a thousand
+#: siblings, not a thousand levels. Measured: ``"<br>" * 5000`` parses one
+#: level deep and converts fine, while ``"<div>" * 5000`` parses 5000 deep
+#: and raises.
+#:
+#: The HTML5 void set, plus the ten legacy names ``bs4``'s HTML-parser tree
+#: builder also treats as empty. **The invariant is that this stays a
+#: subset of what the parser treats as empty**, and the direction matters:
+#: a name missing from here is counted as nesting when it does not, which
+#: costs an unnecessary degradation, while a name wrongly *in* here hides
+#: real nesting, which is a ``RecursionError``. Listing the legacy names
+#: only makes the count exact on old markup. Copied rather than imported --
+#: it lives in ``bs4.builder._htmlparser``, which is private -- and the
+#: subset invariant is asserted against a real parse in the unit tests, so
+#: a future ``bs4`` cannot quietly break it.
+_VOID_ELEMENTS = frozenset(
+    """
+    area base basefont bgsound br col command embed frame hr image img
+    input isindex keygen link menuitem meta nextid param source spacer
+    track wbr
+    """.split()
+)
+
+#: Elements whose boundary becomes a line break when tags are stripped.
+#:
+#: Used only by :func:`_strip_tags`. Removing a block element outright runs
+#: its neighbours together -- ``<p>a</p><p>b</p>`` becomes ``ab`` -- while
+#: putting a separator at *every* tag breaks words apart, turning
+#: ``<b>off</b>line`` into ``off line``. Splitting on the block/inline line
+#: keeps both readable. An unrecognised name counts as inline, matching how
+#: the normal path treats it: markup dropped, body kept in place.
+_BLOCK_ELEMENTS = frozenset(
+    """
+    address article aside blockquote br col dd details dialog div dl dt
+    fieldset figcaption figure footer form h1 h2 h3 h4 h5 h6 header hgroup
+    hr li main menu nav ol p pre search section summary table tbody td
+    tfoot th thead tr ul
+    """.split()
+)
+
+#: Nesting depth past which inbound HTML is stripped instead of converted.
+#:
+#: ``markdownify`` walks the parsed tree recursively and spends about two
+#: CPython frames per nesting level. Measured against the default
+#: 1000-frame limit, from a shallow stack, the deepest document that
+#: converts is 492 levels -- and the same 492 whether the nesting is
+#: ``<div>``, ``<p>``, ``<blockquote>``, ``<ul><li>`` or
+#: ``<table><tr><td>``, which is what identifies the cost as per-level.
+#: One level past it raises ``RecursionError``.
+#:
+#: The ceiling is 200 rather than 492 because the budget is not 1000 frames,
+#: it is whatever is left of the stack when the conversion starts, and that
+#: belongs to the caller. Measured at the conversion call site: 8 frames
+#: through the synchronous client, 16 through the asynchronous one, 37 from
+#: twenty nested awaits. The library's own contribution is negligible; an
+#: application calling from inside a request handler, a template render or a
+#: recursive walk is not. Converting a 200-level document was measured to
+#: peak at 403 frames, so it stays safe until the caller's own stack passes
+#: roughly 590 -- and no document a human wrote nests 200 elements deep.
+#:
+#: **``sys.setrecursionlimit`` is deliberately not called, here or anywhere
+#: in the package.** It is process-global state that belongs to the
+#: application, not to a library an application imported; and raising the
+#: limit past what the C stack can hold turns a catchable ``RecursionError``
+#: into a hard interpreter crash -- on Windows, an access violation with no
+#: traceback. It moves the cliff and makes falling off it worse. Bounding
+#: the input is the fix that does not.
+MAX_HTML_DEPTH = 200
+
+#: Every markup construct, in the order ``html.parser`` dispatches them.
+#:
+#: One alternation rather than a sequence of substitutions, because the
+#: parser reads left to right and the constructs overlap: in
+#: ``<?php x<!-- <div><div> -->`` the processing instruction ends at the
+#: first ``>``, which lands *inside* what looks like a comment, and the
+#: ``<div>`` after it is a real element. Removing comments globally first
+#: gets that document wrong in both directions. ``finditer`` consumes each
+#: match before looking for the next, so a single pattern reproduces the
+#: dispatch for free; the branch order is the parser's own.
+#:
+#: The branches, in order:
+#:
+#: 1. A terminated comment. First, so a legitimate comment containing
+#:    ``>`` is not cut short by branch 3.
+#: 2. A ``CDATA`` section, capturing its body -- the parser keeps that
+#:    body as text, and branch 3 would swallow it.
+#: 3. A doctype, an unterminated comment, a bogus or malformed
+#:    declaration, or a processing instruction, consumed through its first
+#:    ``>``. Measured on the parser: ``<custom><!--oops</custom><br>``
+#:    puts the ``<br>`` *inside* ``custom``, because ``</custom>`` fell in
+#:    the bogus comment and became text -- so reading that ``</custom>``
+#:    as a real close under-counts, the one error that ends in a
+#:    ``RecursionError``. Conversely ``<!--oops><div><div>`` really is two
+#:    levels: recovery ends at the ``>``, it does not swallow the rest of
+#:    the document. Trailing ``>?`` covers running to end-of-input.
+#: 4. A ``<script>`` or ``<style>`` element with its body, closed or not.
+#:    Its content is raw text to the parser, so no tag inside it counts;
+#:    ``strip=["script", "style"]`` discards both on the normal path, so
+#:    the degraded path discards them too. The ``$`` alternative covers an
+#:    unclosed one, whose body the parser also reads to the end as text.
+#: 5. A tag. The ``<`` must abut the name, matching what the parser
+#:    accepts -- which is what keeps ``2 < 3 > 1`` and ``x <= y`` text: a
+#:    space after ``<`` means no tag, so arithmetic never reaches the HTML
+#:    path in the first place.
+#:
+#: Branches 4 and 5 read attributes with :data:`_ATTRIBUTES` rather than
+#: ``[^<>]*``, because an attribute value may legally contain ``<`` and
+#: ``>``. Skipping over quotes is not cosmetic: measured,
+#: ``'<div title="</div>">' * 600`` used to measure **0** levels deep when
+#: the parser builds 600, because the quoted ``</div>`` was read as a real
+#: close. That document went to ``markdownify`` and raised -- the one
+#: direction of error the ceiling exists to prevent.
+_ATTRIBUTES = r"""(?:"[^"]*"|'[^']*'|[^<>"'])*"""
+
+_MARKUP = re.compile(
+    r"<!--.*?-->"
+    r"|<!\[CDATA\[(?P<cdata>.*?)\]\]>"
+    r"|(?P<decl><[!?][^>]*>?)"
+    r"|<(?P<raw>script|style)\b" + _ATTRIBUTES + r">"
+    r"(?P<rawbody>.*?)(?:</(?P=raw)\s*>|(?P<rawcut>$))"
+    r"|</?(?P<name>[a-zA-Z][a-zA-Z0-9]*)" + _ATTRIBUTES + r">",
+    re.DOTALL | re.IGNORECASE,
+)
+
+#: One character reference, with or without its terminating semicolon.
+#:
+#: Resolved by :func:`_resolve_references` rather than by ``html.unescape``
+#: over the whole string. ``unescape`` implements the HTML5 rule of
+#: consuming the longest *known* name it can find, so a semicolon-less
+#: reference that is a prefix of a longer unknown word gets split --
+#: measured, ``http://x/?a=1&copyright=2`` becomes
+#: ``http://x/?a=1©right=2``, and a URL pasted into a ticket is exactly
+#: where ``&copyright=`` and ``&notanentity=`` occur. The parser behind the
+#: converting path leaves those whole, so this does too.
+_CHARACTER_REFERENCE = re.compile(
+    r"&(?:\#[0-9]+;?|\#[xX][0-9a-fA-F]+;?|[A-Za-z][A-Za-z0-9]*;?)"
+)
+
+#: A declaration the parser can resolve, whose text is therefore not text.
+#:
+#: ``html.parser`` turns ``<!DOCTYPE html>`` and ``<!anything>`` into a
+#: declaration node, which ``markdownify`` renders as nothing -- so
+#: :func:`_strip_tags` drops them too. Everything else matched by the
+#: ``decl`` branch (an unterminated comment, an unterminated marked
+#: section, a processing instruction) the parser hands back as character
+#: data and the converting path prints, so it is kept. Measured against
+#: the converting path, construct by construct.
+_RESOLVED_DECLARATION = re.compile(r"<!\s*[A-Za-z]")
+
+
+def _resolve_references(text: str) -> str:
+    """Resolve character references the way the real parser would.
+
+    A numeric reference always resolves. A named one resolves only when
+    the whole name is known, which is the difference from
+    ``html.unescape``: that consumes the longest known *prefix*, so
+    ``&copyright=2`` loses its ``&copy`` and leaves ``right=2`` behind.
+    See :data:`_CHARACTER_REFERENCE`.
+
+    Where the two rules differ this one keeps the reference literal, which
+    is the safe direction for :func:`_strip_tags`, whose promise is that no
+    text goes missing.
+    """
+
+    def resolve(match: re.Match[str]) -> str:
+        token = match.group(0)
+        if token[1] == "#":
+            return unescape(token)
+        return unescape(token) if token[1:] in _HTML5_REFERENCES else token
+
+    return _CHARACTER_REFERENCE.sub(resolve, text)
+
 
 def _looks_like_html(content: str) -> bool:
     """Return whether ``content`` carries at least one real HTML element.
@@ -74,6 +261,196 @@ def _looks_like_html(content: str) -> bool:
     )
 
 
+def _html_nesting_depth(content: str) -> int:
+    """Return how deeply ``content`` nests, without recursing to find out.
+
+    One linear pass over the tag candidates, keeping the open elements on a
+    list and its high-water mark. Linear in the length of the input and flat
+    in the stack, which is the point: the number this returns decides
+    whether a recursive parser is safe to run, so computing it must not need
+    one. Measured, it costs 4-6% of the ``markdownify`` call it guards.
+
+    Four rules make the count match the tree ``html.parser`` will actually
+    build. The first two are what an open/close counter would get wrong:
+
+    * **A closing tag pops by name, or is ignored.** ``bs4`` looks up the
+      stack for a matching open element and pops nothing when there is
+      none. A plain counter decrements anyway, and then
+      ``"<div></p>" * 600`` -- a Word or Outlook paste, not an adversarial
+      input -- measures 1 when the parser builds 600. Measured: that
+      document reached ``markdownify`` and raised. Interleaved tags
+      (``<b><i>x</b></i>``) pop the same way the parser does.
+    * **A childless node is still a node.** A void element or a ``<foo/>``
+      sits one level below its parent, so ``"<br>" * 5000`` is one level,
+      not none.
+    * **Unknown names count.** ``html.parser`` gives ``<foo>`` a node like
+      any other, so it nests like any other -- measured, ``"<foo>" * 600``
+      inside a document with one real element raises just as ``<div>``
+      does. Whether ``markdownify`` later knows how to *render* the element
+      is a separate question from whether it has to walk it.
+    * **An unclosed tag still counts.** ``html.parser`` does not auto-close
+      ``<p>`` or ``<li>``, so ``"<p>" * 5000`` really is 5000 levels, and
+      raises exactly like the balanced shape.
+
+    Comments, declarations, processing instructions and raw-text elements
+    are skipped by :data:`_MARKUP` itself, which is where the ordering
+    subtleties live. That is not only about over-counting a ``<div>`` in a
+    code sample: a closing tag swallowed by a bogus comment is a level the
+    parser keeps and a careless scan gives back.
+
+    The result was checked against a ground-truth iterative walk of the
+    tree ``bs4`` actually builds, over 15000 fuzzed documents mixing every
+    construct above plus attribute values containing ``<``, ``>`` and
+    whole tags: **worst error 0 in either direction.** Where the two could
+    still disagree, over-counting is the direction to err in -- it costs a
+    document that degrades when it need not have, while under-counting is
+    a crash.
+
+    Parameters
+    ----------
+    content : str
+        Raw HTML, or text that may contain angle brackets.
+
+    Returns
+    -------
+    int
+        The depth of the deepest element the parser would build. ``0`` for
+        text with no tags at all.
+    """
+
+    if "<" not in content:
+        return 0
+    stack: list[str] = []
+    open_names: Counter[str] = Counter()
+    deepest = 0
+    for match in _MARKUP.finditer(content):
+        if match.group("raw") is not None:
+            # Raw-text elements hold no markup, but the element is still a
+            # node one level below whatever is open around it.
+            deepest = max(deepest, len(stack) + 1)
+            continue
+        name = match.group("name")
+        if name is None:
+            continue  # a comment, a declaration or a processing instruction
+        name = name.lower()
+        token = match.group(0)
+        if token[1] == "/":
+            if not open_names[name]:
+                continue  # nothing of that name is open, so bs4 pops nothing
+            while True:
+                popped = stack.pop()
+                open_names[popped] -= 1
+                if popped == name:
+                    break
+        elif token.endswith("/>") or name in _VOID_ELEMENTS:
+            deepest = max(deepest, len(stack) + 1)
+        else:
+            stack.append(name)
+            open_names[name] += 1
+            deepest = max(deepest, len(stack))
+    return deepest
+
+
+def _strip_tags(content: str) -> str:
+    """Reduce HTML to its text without parsing it, keeping every word.
+
+    The degraded path for a document too deeply nested to convert. One pass
+    of :data:`_MARKUP` -- the same scanner the depth measurement uses, so
+    the two agree about what is markup -- then whitespace tidying. No tree,
+    no recursion, no depth ceiling of its own, so it answers for input of
+    any shape. Measured at 4-8 MB/s depending on tag density, roughly ten
+    times faster than the ``markdownify`` call it stands in for.
+
+    It **degrades and never truncates.** The property, stated as something
+    checkable: after collapsing whitespace, every character the converting
+    path would have produced also appears here, in order. A superset, not
+    an equality -- so no body says less because of the path it took, which
+    is the only guarantee worth making about a fallback. Checked as a
+    subsequence over 15000 fuzzed documents mixing tags, quoted
+    attributes, entities, comments, marked sections, declarations,
+    processing instructions and raw-text elements: **0 losing text.**
+
+    Establishing that meant measuring what the converting path really
+    keeps, construct by construct, rather than assuming. Three answers
+    were counter-intuitive and each one was a silent deletion here before
+    it was checked: a ``<script>``/``<style>`` body is *kept* (see
+    :func:`_strip_tags` for why), so is a ``CDATA`` body, and so is the
+    inside of any ``<!``/``<?`` construct the parser could not resolve.
+
+    What it does **not** reproduce, none of which loses a character of
+    prose:
+
+    * Markup that only the converter can express: a link becomes its text
+      without the target, an image contributes nothing, and a fenced block
+      loses its fence -- so ``<pre>`` indentation is normalised away with
+      the rest. A pasted log comes back as its own lines of text, not as
+      a code block.
+    * Whitespace is normalised harder. Runs of spaces collapse, and
+      ``&nbsp;`` counts as whitespace, so ``&nbsp;``-padded column
+      alignment does not survive.
+    * Character references are resolved even inside a region the parser
+      handed back as raw data, so a broken comment's ``&amp;`` comes back
+      as ``&``. In the other direction, a handful of semicolon-less
+      references stay literal here that the converter resolves -- see
+      :func:`_resolve_references`, which errs that way on purpose.
+    * A processing instruction keeps its ``<?`` and ``>`` as literal
+      text, where the converter strips them.
+
+    Parameters
+    ----------
+    content : str
+        Raw HTML.
+
+    Returns
+    -------
+    str
+        The document's text, block boundaries preserved as line breaks and
+        character references resolved.
+    """
+
+    pieces: list[str] = []
+    cursor = 0
+    for match in _MARKUP.finditer(content):
+        pieces.append(content[cursor : match.start()])
+        cursor = match.end()
+        cdata = match.group("cdata")
+        if cdata is not None:
+            pieces.append(cdata)
+            continue
+        name = match.group("name")
+        if name is not None:
+            if name.lower() in _BLOCK_ELEMENTS:
+                pieces.append("\n")
+            continue
+        if match.group("raw") is not None:
+            # A `<script>`/`<style>` body. Kept, because -- against
+            # first expectations -- the converting path keeps it:
+            # ``markdownify``'s ``strip=`` removes an element's *markup*
+            # and still walks its children, so the body arrives as text.
+            # Dropping it here would make the same document say different
+            # things depending on how deeply it happened to nest. An
+            # *unterminated* one is the exception: the parser reads the
+            # rest of the input as script text and prints none of it.
+            if match.group("rawcut") is None:
+                pieces.append("\n" + (match.group("rawbody") or "") + "\n")
+            continue
+        decl = match.group("decl")
+        if decl is not None and not _RESOLVED_DECLARATION.match(decl):
+            # An unterminated comment, an unterminated marked section, or
+            # a processing instruction. ``html.parser`` resolves none of
+            # them, gives up, and emits the region as character data --
+            # so the converting path prints it and this keeps it. Only a
+            # resolvable declaration is text on neither path.
+            pieces.append(decl)
+    pieces.append(content[cursor:])
+
+    text = _resolve_references("".join(pieces))
+    text = re.sub(r"[^\S\n]*\n[^\S\n]*", "\n", text)
+    text = re.sub(r"[^\S\n]{2,}", " ", text)
+    text = re.sub(r"\n{3,}", "\n\n", text)
+    return text.strip()
+
+
 class GlpiContentConverter:
     """Convert content between GLPI HTML payloads and canonical Markdown.
 
@@ -93,6 +470,22 @@ def from_transport(value: object) -> str:
         is also wired as the inbound validator for caller-authored content:
         text sent down the HTML path loses whatever the parser does not
         recognise, and Markdown sent down it comes back escaped.
+
+        There are therefore three outcomes, not two. Real HTML nested no
+        deeper than :data:`MAX_HTML_DEPTH` is converted. Real HTML nested
+        deeper than that is stripped to its text instead -- ``markdownify``
+        recurses per level and would exhaust the interpreter's stack, so the
+        depth is measured first, flatly, by :func:`_html_nesting_depth`. The
+        caller gets a readable body either way; **this method degrades, it
+        does not truncate, and it does not raise for depth.**
+
+        Raises
+        ------
+        GlpiContentError
+            The parser failed for some reason other than depth. The original
+            exception is attached as ``__cause__``. Nothing is expected to
+            reach this -- it is here so a parser fault cannot escape
+            ``except GlpiError`` the way a bare ``RecursionError`` used to.
         """
 
         content = str(value or "")
@@ -100,15 +493,23 @@ def from_transport(value: object) -> str:
             return ""
         if not _looks_like_html(content):
             return content.strip()
+        if _html_nesting_depth(content) > MAX_HTML_DEPTH:
+            return _strip_tags(content)
 
-        markdown = html_to_markdown(
-            content,
-            heading_style="ATX",
-            bullets="-",
-            strip=["script", "style"],
-            escape_underscores=False,
-            escape_asterisks=False,
-        )
+        try:
+            markdown = html_to_markdown(
+                content,
+                heading_style="ATX",
+                bullets="-",
+                strip=["script", "style"],
+                escape_underscores=False,
+                escape_asterisks=False,
+            )
+        except Exception as exc:
+            raise GlpiContentError(
+                "Could not convert GLPI HTML content to Markdown "
+                f"({type(exc).__name__}: {exc})."
+            ) from exc
         return str(markdown).strip()
 
     @staticmethod
@@ -117,14 +518,33 @@ def to_transport(value: object) -> str:
 
         Empty Markdown stays empty, while non-empty content is rendered through
         the configured Markdown extensions used by the package.
+
+        There is no depth ceiling on this direction and no degraded path.
+        Inbound content is whatever GLPI happens to hold, so it has to be
+        survivable; outbound content is what the caller just wrote, so a
+        failure is worth reporting rather than papering over. ``markdown``
+        recurses on nested constructs too -- measured, a list indented 495
+        levels raises -- so the failure is caught and named.
+
+        Raises
+        ------
+        GlpiContentError
+            The Markdown could not be rendered. The original exception is
+            attached as ``__cause__``.
         """
 
         markdown = str(value or "")
         if not markdown.strip():
             return ""
-        html = markdown_to_html(
-            markdown,
-            extensions=_MARKDOWN_EXTENSIONS,
-            output_format="html5",
-        )
+        try:
+            html = markdown_to_html(
+                markdown,
+                extensions=_MARKDOWN_EXTENSIONS,
+                output_format="html5",
+            )
+        except Exception as exc:
+            raise GlpiContentError(
+                "Could not render Markdown content as GLPI HTML "
+                f"({type(exc).__name__}: {exc})."
+            ) from exc
         return str(html).strip()
diff --git a/glpi_python_client/content/tests/test_conversion.py b/glpi_python_client/content/tests/test_conversion.py
index e708c95..473920e 100644
--- a/glpi_python_client/content/tests/test_conversion.py
+++ b/glpi_python_client/content/tests/test_conversion.py
@@ -1,8 +1,15 @@
 from __future__ import annotations
 
 import pytest
-
-from glpi_python_client.content.conversion import GlpiContentConverter
+from bs4 import BeautifulSoup
+
+from glpi_python_client import GlpiContentError, GlpiError
+from glpi_python_client.content import conversion
+from glpi_python_client.content.conversion import (
+    MAX_HTML_DEPTH,
+    GlpiContentConverter,
+    _html_nesting_depth,
+)
 
 
 def test_content_converter_uses_markdown_in_python_and_html_for_glpi() -> None:
@@ -108,3 +115,508 @@ def test_incoming_text_is_not_backslash_escaped(html: str, expected: str) -> Non
     """
 
     assert GlpiContentConverter.from_transport(html) == expected
+
+
+# ---------------------------------------------------------------------------
+# Nesting depth
+# ---------------------------------------------------------------------------
+#
+# ``markdownify`` walks the parsed tree recursively, so a deeply nested body
+# used to exhaust the interpreter's stack -- and because the converter was
+# wired as a Pydantic ``BeforeValidator``, the ``RecursionError`` surfaced
+# from inside ``model_validate``, i.e. from inside ``get_ticket``. These
+# tests pin the three things that fixed it: the depth is measured without
+# recursing, the ceiling is enforced, and past it the body degrades to text
+# rather than raising or being cut short.
+
+
+@pytest.mark.parametrize(
+    ("html", "expected"),
+    [
+        ("", 0),
+        ("no tags here", 0),
+        ("<p>one</p>", 1),
+        ("<p>The printer is <strong>offline</strong>.</p>", 2),
+        ("<div>" * 7 + "x" + "</div>" * 7, 7),
+        # An unclosed tag still nests: ``html.parser`` does not auto-close
+        # ``<p>`` or ``<li>``, so this really is 40 levels to walk.
+        ("<p>" * 40, 40),
+        # Nothing nests below a void or self-closed element, but the element
+        # itself is still a node one level below its parent.
+        ("<p>" + "<br>" * 40 + "x</p>", 2),
+        ("<br>" * 40, 1),
+        ("<p>a</p>" + "<div/>" * 40, 1),
+        # A close with nothing open, and a close for a void element, are
+        # ignored rather than pushed below zero.
+        ("</div>" * 40 + "<p>x</p>", 1),
+        ("<div><b>x</b></br></div>", 2),
+        # An unrecognised name is a node like any other to the parser.
+        ("<foo>" * 12, 12),
+        # Siblings are not depth.
+        ("<p>a</p>" * 40, 1),
+    ],
+)
+def test_the_depth_scan_measures_what_the_parser_will_build(
+    html: str, expected: int
+) -> None:
+    """The flat scan agrees with the tree ``html.parser`` produces."""
+
+    assert _html_nesting_depth(html) == expected
+
+
+def test_the_depth_scan_does_not_itself_recurse() -> None:
+    """Measuring 100k levels must not need 100k frames.
+
+    The whole point of the scan is to decide whether a recursive parser is
+    safe to run, so it cannot be recursive itself.
+    """
+
+    assert _html_nesting_depth("<div>" * 100_000) == 100_000
+
+
+@pytest.mark.parametrize(
+    "html",
+    [
+        pytest.param("<div>" * 500 + "text" + "</div>" * 500, id="balanced"),
+        pytest.param("<p>" * 5000 + "text", id="unclosed"),
+        pytest.param("<ul><li>" * 500 + "text" + "</li></ul>" * 500, id="lists"),
+        pytest.param("<foo>" * 5000 + "<p>text</p>", id="unknown-elements"),
+        pytest.param(
+            "<table><tr><td>" * 400 + "text" + "</td></tr></table>" * 400,
+            id="tables",
+        ),
+        pytest.param("<div>" * 100_000 + "text", id="absurd"),
+    ],
+)
+def test_deep_html_degrades_instead_of_raising(html: str) -> None:
+    """Past the ceiling the caller gets a usable body, not an exception.
+
+    494 levels was enough to exhaust the default 1000-frame limit from a
+    shallow stack. Every shape here is past ``MAX_HTML_DEPTH``, including
+    the unclosed and unknown-element ones -- both of which the parser nests
+    just as deeply as the balanced case.
+    """
+
+    assert GlpiContentConverter.from_transport(html) == "text"
+
+
+def test_the_degraded_path_keeps_every_word() -> None:
+    """It degrades; it does not truncate.
+
+    A body too deep to convert is still the only copy of what someone
+    wrote, so the fallback's contract is that all of the text comes back.
+    """
+
+    lines = [f"line {index}" for index in range(400)]
+    html = "".join(f"<div><p>{line}</p>" for line in lines) + "</div>" * 400
+
+    stripped = GlpiContentConverter.from_transport(html)
+
+    assert all(line in stripped for line in lines)
+    assert "<" not in stripped
+
+
+def test_the_degraded_path_resolves_entities_and_block_boundaries() -> None:
+    """Blocks become line breaks, inline tags vanish, references resolve.
+
+    Dropping every tag outright would run ``<p>a</p><p>b</p>`` together as
+    ``ab``; separating at every tag would break ``<b>off</b>line`` into two
+    words. Only the block boundary gets a separator.
+    """
+
+    html = "<div>" * 300 + "<b>off</b>line &amp; <p>next</p>" + "</div>" * 300
+
+    assert GlpiContentConverter.from_transport(html) == "offline &\nnext"
+
+
+@pytest.mark.parametrize(
+    ("construct", "kept"),
+    [
+        pytest.param("<!-- SECRET -->", False, id="resolved-comment"),
+        pytest.param("<!DOCTYPE SECRET>", False, id="doctype"),
+        pytest.param("<!SECRET>", False, id="bogus-declaration"),
+        pytest.param("<script>SECRET</script>", True, id="script-body"),
+        pytest.param("<style>SECRET</style>", True, id="style-body"),
+        pytest.param("<![CDATA[SECRET]]>", True, id="marked-section"),
+        pytest.param("<![CDATA[SECRET>", True, id="unterminated-marked-section"),
+        pytest.param("<?php SECRET ?>", True, id="processing-instruction"),
+    ],
+)
+def test_the_degraded_path_keeps_exactly_what_the_converter_keeps(
+    construct: str, kept: bool
+) -> None:
+    """Parity, construct by construct, and not one of these was a guess.
+
+    Each expectation here was read off the converting path rather than
+    reasoned about, and three came back the opposite way round from the
+    obvious answer -- a ``<script>`` body is *kept*, because
+    ``markdownify``'s ``strip=`` removes an element's markup and still
+    walks its children; so is a ``CDATA`` body; and so is the inside of
+    any construct the parser could not resolve. Each of those was a silent
+    deletion in the degraded path until it was measured.
+
+    The bar is that a body must not say less because of the path it took,
+    so a divergence here is a bug even when the dropped text is
+    JavaScript.
+    """
+
+    shallow = f"<p>a</p>{construct}<p>b</p>"
+    deep = "<div>" * 300 + shallow + "</div>" * 300
+
+    converted = GlpiContentConverter.from_transport(shallow)
+    degraded = GlpiContentConverter.from_transport(deep)
+
+    assert ("SECRET" in converted) is kept
+    assert ("SECRET" in degraded) is kept
+
+
+def test_an_unterminated_raw_text_element_swallows_the_rest_on_both_paths() -> None:
+    """The one raw-text case where dropping the body IS parity.
+
+    An unclosed ``<script>`` makes the parser read everything after it as
+    script text, and the converting path prints none of it -- so keeping it
+    here would be the divergence.
+    """
+
+    shallow = "<p>keep</p><script>SECRET"
+    deep = "<div>" * 300 + shallow + "</div>" * 300
+
+    assert GlpiContentConverter.from_transport(shallow) == "keep"
+    assert GlpiContentConverter.from_transport(deep) == "keep"
+
+
+def test_a_document_at_the_ceiling_is_still_converted() -> None:
+    """The ceiling is inclusive, and below it nothing changes.
+
+    Pinned because an off-by-one here silently downgrades ordinary content
+    to stripped text -- a quality regression with no error to notice.
+    """
+
+    depth = MAX_HTML_DEPTH - 1  # the <strong> below is the last level
+    html = "<div>" * depth + "<strong>offline</strong>" + "</div>" * depth
+
+    assert GlpiContentConverter.from_transport(html) == "**offline**"
+
+
+def test_void_elements_do_not_spend_the_depth_budget() -> None:
+    """5000 ``<br>`` is one level, so this must take the converting path.
+
+    The surviving ``**`` proves it: the degraded path strips markup, so
+    emphasis would be gone if the void tags had been counted.
+    """
+
+    html = "<p>" + "<br>" * 5000 + "<strong>offline</strong></p>"
+
+    assert "**offline**" in GlpiContentConverter.from_transport(html)
+
+
+# ---------------------------------------------------------------------------
+# Failure taxonomy
+# ---------------------------------------------------------------------------
+
+
+def test_a_parser_fault_surfaces_as_a_glpi_error(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """No parser fault escapes ``except GlpiError``.
+
+    The depth guard means no ordinary input reaches this, so the fault is
+    injected. It matters anyway: the frame budget is whatever the caller
+    left behind, so a shallow-enough document can still run out of stack in
+    a deep-enough application -- and a caller who wrote ``except GlpiError``
+    around ``get_ticket`` would have watched a ``RecursionError`` sail
+    straight through it.
+    """
+
+    def _boom(*args: object, **kwargs: object) -> str:
+        raise RecursionError("maximum recursion depth exceeded")
+
+    monkeypatch.setattr(conversion, "html_to_markdown", _boom)
+
+    with pytest.raises(GlpiContentError) as caught:
+        GlpiContentConverter.from_transport("<p>offline</p>")
+
+    assert isinstance(caught.value, GlpiError)
+    assert isinstance(caught.value.__cause__, RecursionError)
+
+
+def test_an_outbound_render_fault_surfaces_as_a_glpi_error(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """The outbound direction is wrapped too; ``markdown`` recurses as well."""
+
+    def _boom(*args: object, **kwargs: object) -> str:
+        raise RecursionError("maximum recursion depth exceeded")
+
+    monkeypatch.setattr(conversion, "markdown_to_html", _boom)
+
+    with pytest.raises(GlpiContentError) as caught:
+        GlpiContentConverter.to_transport("offline")
+
+    assert isinstance(caught.value, GlpiError)
+    assert isinstance(caught.value.__cause__, RecursionError)
+
+
+def test_deeply_nested_markdown_does_not_raise_a_bare_recursion_error() -> None:
+    """The real outbound cliff, unmocked.
+
+    ``markdown`` breaks between 495 and 500 levels of list indentation
+    (measured). Unlike the inbound direction this is not degraded --
+    outbound content is what the caller just wrote, so a failure is worth
+    reporting -- but it has to be reported as a library error.
+    """
+
+    markdown = "\n".join("  " * level + "- x" for level in range(500))
+
+    with pytest.raises(GlpiContentError):
+        GlpiContentConverter.to_transport(markdown)
+
+
+# ---------------------------------------------------------------------------
+# The scan against the tree the parser really builds
+# ---------------------------------------------------------------------------
+#
+# The three cases below are the ones a plain open/close counter gets wrong,
+# and the first is not a corner case: a stray ``</p>`` or ``</span>`` is
+# what a Word or Outlook paste leaves in a GLPI body. Each was measured
+# under-counting -- the one direction that turns into a crash -- before the
+# scan learned to pop by name.
+
+
+def _parser_depth(html: str) -> int:
+    """Return the deepest element ``html.parser`` actually builds.
+
+    The ground truth the scan is checked against, walked iteratively so
+    that measuring a pathological document does not hit the very limit
+    under test.
+    """
+
+    soup = BeautifulSoup(html, "html.parser")
+    deepest = 0
+    pending = [(child, 1) for child in soup.children if getattr(child, "name", None)]
+    while pending:
+        node, depth = pending.pop()
+        deepest = max(deepest, depth)
+        pending.extend(
+            (child, depth + 1)
+            for child in node.children
+            if getattr(child, "name", None)
+        )
+    return deepest
+
+
+@pytest.mark.parametrize(
+    "html",
+    [
+        pytest.param("<div></p>" * 600 + "kept", id="stray-close-p"),
+        pytest.param("<div></span>" * 600 + "kept", id="stray-close-span"),
+        pytest.param("<p></b>" * 600 + "kept", id="stray-close-b"),
+        pytest.param("<b><i>x</b></i>", id="interleaved"),
+        pytest.param("<div>" * 400 + "<br>" + "</div>" * 400, id="void-leaf"),
+        pytest.param("<div>" * 400 + "<img/>" + "</div>" * 400, id="self-closed-leaf"),
+        pytest.param("<br>" * 5000, id="void-only"),
+        pytest.param("<div><b>x</b></br></div>", id="close-of-a-void"),
+        pytest.param("<p>The printer is <strong>offline</strong>.</p>", id="realistic"),
+        pytest.param("<div><!-- <div><div> --><p>x</p></div>", id="tags-in-a-comment"),
+        pytest.param(
+            "<div><script>var s='<div><div>'</script>x</div>", id="tags-in-js"
+        ),
+        pytest.param("<table><tr><td>" * 60 + "x", id="tables"),
+        pytest.param("<blockquote>" * 300 + "x", id="blockquotes"),
+        pytest.param("<p>a</p>" * 100, id="siblings"),
+    ],
+)
+def test_the_depth_scan_agrees_with_the_parser(html: str) -> None:
+    """The flat scan returns what a real parse would nest to.
+
+    Equality, not an upper bound: over-counting is survivable but it
+    degrades documents that did not need degrading, so it is worth pinning
+    too. The cases where the scan is deliberately allowed to over-count are
+    covered separately.
+    """
+
+    assert _html_nesting_depth(html) == _parser_depth(html)
+
+
+@pytest.mark.parametrize(
+    "html",
+    [
+        pytest.param("<div></p>" * 600 + "kept", id="stray-close-p"),
+        pytest.param("<div></span>" * 800 + "kept", id="stray-close-span"),
+        pytest.param("<li></tr>" * 700 + "kept", id="stray-close-tr"),
+    ],
+)
+def test_a_stray_closing_tag_does_not_hide_real_nesting(html: str) -> None:
+    """The regression test for the under-count that reached ``markdownify``.
+
+    A closing tag with no matching open element pops nothing in ``bs4``, so
+    these documents nest as deeply as their opening tags say. Counting the
+    close as a level down measured them at 1, they went to the recursive
+    converter, and it raised.
+    """
+
+    assert GlpiContentConverter.from_transport(html) == "kept"
+
+
+def test_the_degraded_path_keeps_a_cdata_body() -> None:
+    """A ``CDATA`` section's body is text, and text is what survives.
+
+    The declaration pattern that strips ``<!DOCTYPE ...>`` reaches the
+    first ``>``, and a ``CDATA`` section has none until its end, so it used
+    to take the body with it -- a silent deletion in the one path whose
+    whole promise is that nothing is deleted.
+    """
+
+    html = "<div>" * 300 + "<p>a<![CDATA[secret words]]>b</p>" + "</div>" * 300
+
+    assert GlpiContentConverter.from_transport(html) == "asecret wordsb"
+
+
+@pytest.mark.parametrize(
+    "html",
+    [
+        # A comment with no ``-->`` is a *bogus comment*: the parser gives up
+        # at the first ``>``, so the ``</custom>`` inside it is text and the
+        # ``<br>`` lands inside ``<custom>``. Read that ``</custom>`` as a
+        # real close and the count comes back one level short -- which is
+        # how a document that needed degrading reached the converter.
+        pytest.param("<custom><!--oops</custom><br>", id="bogus-comment-eats-a-close"),
+        # ... and recovery ends at that ``>``. It does not swallow the rest
+        # of the document, so these really are two levels.
+        pytest.param("<!--oops><div><div>", id="bogus-comment-ends-at-its-close"),
+        # A processing instruction ends at the first ``>`` too, and here
+        # that lands inside what looks like a comment -- so the second
+        # ``<div>`` is a real element. Stripping comments globally before
+        # scanning gets this wrong in both directions at once.
+        pytest.param("<?php x<!-- <div><div> -->", id="pi-overlapping-a-comment"),
+        pytest.param("<div><!-- <div><div> --></div>", id="terminated-comment"),
+        pytest.param("<!DOCTYPE html><div><p>x</p></div>", id="doctype"),
+        pytest.param("<div><![CDATA[a<div>b]]><p>x</p></div>", id="marked-section"),
+        pytest.param("<div><script>a<div><div></script><p>x</p></div>", id="raw-text"),
+        pytest.param("<div><script>a<div>", id="unclosed-raw-text"),
+    ],
+)
+def test_the_depth_scan_dispatches_like_the_parser(html: str) -> None:
+    """Comments, declarations and raw text change where the tags are.
+
+    Each of these was measured against a real parse. They are in the suite
+    because they are the cases where reading the constructs in the wrong
+    order, or independently of one another, changes the answer -- and one
+    direction of wrong is a ``RecursionError``.
+    """
+
+    assert _html_nesting_depth(html) == _parser_depth(html)
+
+
+def test_the_degraded_path_keeps_the_text_of_a_broken_comment() -> None:
+    """Parity with the normal path, even where the parser gave up.
+
+    ``html.parser`` cannot resolve a comment with no ``-->``, so it hands
+    the region back as character data -- meaning ``markdownify`` would have
+    kept it. The degraded path is only trustworthy if which path a body
+    took never changes what it says, so it keeps it too.
+    """
+
+    html = "<div>" * 300 + "<p>keep</p>" + "</div>" * 300 + "<!--oops but keep this"
+
+    stripped = GlpiContentConverter.from_transport(html)
+
+    assert stripped == "keep\n\n<!--oops but keep this"
+
+
+def test_the_degraded_path_drops_a_comment_the_parser_understood() -> None:
+    """A resolved comment is text on neither path, so it goes.
+
+    The mirror of the test above, and the reason the two cannot share one
+    rule: telling them apart is the whole job of the ``-->``.
+    """
+
+    html = "<div>" * 300 + "<p>keep</p><!-- drop this -->" + "</div>" * 300
+
+    assert GlpiContentConverter.from_transport(html) == "keep"
+
+
+def test_no_name_in_the_void_set_actually_nests() -> None:
+    """The one direction of the void set that would be a crash.
+
+    A name listed as void that the parser really nests hides real depth,
+    and the document then reaches the recursive converter. The set is a
+    hand-copy of a private ``bs4`` table, so the invariant is asserted
+    against a real parse rather than against that table: for every name
+    claimed void, 300 of them must build one level, not 300.
+    """
+
+    understated = [
+        name
+        for name in sorted(conversion._VOID_ELEMENTS)
+        if _html_nesting_depth(f"<{name}>" * 300 + "x")
+        < _parser_depth(f"<{name}>" * 300 + "x")
+    ]
+
+    assert understated == []
+
+
+@pytest.mark.parametrize(
+    "html",
+    [
+        pytest.param('<div title="</div>">x</div>', id="close-tag-in-attribute"),
+        pytest.param('<div title="<div>">x</div>', id="open-tag-in-attribute"),
+        pytest.param('<div title="a>b">x</div>', id="gt-in-attribute"),
+        pytest.param("<div data-x='a>b'><p>x</p></div>", id="single-quoted"),
+        pytest.param('<p title=">">one</p><p>two</p>', id="attribute-is-just-gt"),
+        pytest.param('<div title="</div>">' * 5 + "x", id="nested-and-quoted"),
+    ],
+)
+def test_a_tag_inside_a_quoted_attribute_is_not_read_as_markup(html: str) -> None:
+    """An attribute value may legally contain ``<`` and ``>``.
+
+    Reading a quoted ``</div>`` as a real close tag under-counted without
+    bound: ``'<div title="</div>">' * 600`` measured **0** levels when the
+    parser builds 600, so the document sailed past the ceiling into
+    ``markdownify`` and raised. This is the regression test for that, and
+    it is the one class of error the ceiling exists to prevent.
+    """
+
+    assert _html_nesting_depth(html) == _parser_depth(html)
+
+
+def test_a_quoted_close_tag_at_depth_still_degrades() -> None:
+    """The same shape scaled past the ceiling: degrades, does not raise."""
+
+    html = '<div title="</div>">' * 600 + "keep"
+
+    assert GlpiContentConverter.from_transport(html) == "keep"
+
+
+@pytest.mark.parametrize(
+    ("raw", "expected"),
+    [
+        # A URL in a ticket body is exactly where a semicolon-less
+        # reference that is a prefix of a longer word shows up.
+        ("http://x/?a=1&copyright=2", "http://x/?a=1&copyright=2"),
+        ("http://x/?a=1&notanentity=2", "http://x/?a=1&notanentity=2"),
+        # Terminated references still resolve, named and numeric.
+        ("a &amp; b &lt; c", "a & b < c"),
+        ("&#65;&#x42;", "AB"),
+        # ... and so does a semicolon-less reference whose whole name is
+        # known, because that is what the parser does.
+        ("&copy 2026", "\u00a9 2026"),
+        ("a&b", "a&b"),
+    ],
+)
+def test_the_degraded_path_resolves_references_like_the_parser(
+    raw: str, expected: str
+) -> None:
+    """``html.unescape`` alone corrupts URLs; the parser's rule does not.
+
+    ``unescape`` implements HTML5's longest-known-*prefix* rule, so
+    ``&copyright=2`` comes back as ``(c)right=2`` -- a query parameter
+    silently rewritten. The parser behind the converting path resolves a
+    semicolon-less reference only when the entire name is known, so it
+    leaves that URL alone, and the degraded path has to agree or a body
+    changes meaning according to how deeply it nests.
+    """
+
+    html = "<div>" * 300 + f"<p>{raw}</p>" + "</div>" * 300
+
+    assert GlpiContentConverter.from_transport(html) == expected
diff --git a/glpi_python_client/testing/tests/test_raise_site_audit.py b/glpi_python_client/testing/tests/test_raise_site_audit.py
index 40a32de..b0523c1 100644
--- a/glpi_python_client/testing/tests/test_raise_site_audit.py
+++ b/glpi_python_client/testing/tests/test_raise_site_audit.py
@@ -1,12 +1,19 @@
 """Audit every raise statement in library code against the error contract.
 
 This is a structural guard, not a behavioural one. It exists because the
-0.4.0 error migration is a mechanical sweep across raise sites in
-non-test library code -- as of this writing 24 ``GlpiValidationError``,
-9 ``GlpiProtocolError``, 4 ``RuntimeError``, 2 ``TypeError``,
-1 ``GlpiServerError``, plus 2 ``status_error_class(...)`` dispatch sites
-(42 total) -- and a missed one is invisible: a bare ValueError still
-passes every existing ``pytest.raises(ValueError)`` test.
+0.4.0 error migration was a mechanical sweep across every raise site in
+non-test library code, and a missed one is invisible: a bare
+``ValueError`` still passes every existing ``pytest.raises(ValueError)``
+test. The same goes for a raise site added later, which is what makes this
+worth keeping rather than a one-off checklist.
+
+(There used to be a per-class tally of the raise sites here. It was prose
+asserted by nothing and it rotted -- by 0.5.0 it was out by a third. The
+allow-list below is the part that has to be right, and the suite enforces
+it.)
+
+The module also guards one thing the library must *never* call. See
+:func:`test_the_library_never_touches_the_recursion_limit`.
 
 The RuntimeError and TypeError sites are deliberately exempt. Converting
 them to GlpiValidationError -- which inherits ValueError, not TypeError --
@@ -25,6 +32,7 @@
 _ALLOWED = {
     "GlpiValidationError",
     "GlpiProtocolError",
+    "GlpiContentError",
     "GlpiServerError",
     "GlpiStatusError",
     "error_class",  # status_error_class(...) dispatch result
@@ -136,3 +144,46 @@ def test_every_raise_site_uses_an_allowed_exception() -> None:
 
     offenders = [site for site in _raise_sites() if site[2] not in _ALLOWED]
     assert offenders == [], f"unexpected raise sites: {offenders}"
+
+
+def test_the_library_never_touches_the_recursion_limit() -> None:
+    """``sys.setrecursionlimit`` is a rejected option, not an unused one.
+
+    The content converter has a recursion ceiling -- ``markdownify``
+    recurses about twice per level of HTML nesting -- and raising the
+    interpreter's limit is the obvious-looking way to move it. It is the
+    wrong way twice over, so the prohibition is asserted rather than left
+    as a comment for the next person to weigh up again:
+
+    * The limit is process-global state belonging to the application, not
+      to a library the application imported. Writing it changes the
+      behaviour of code that never asked.
+    * Past what the C stack can actually hold, it converts a catchable
+      ``RecursionError`` into a hard interpreter crash -- on Windows, an
+      access violation with no traceback. It moves the cliff and makes
+      falling off it worse.
+
+    Bounding the input instead is
+    :data:`glpi_python_client.content.conversion.MAX_HTML_DEPTH`, and the
+    backstop for anything that gets past it is
+    :class:`glpi_python_client.GlpiContentError`.
+
+    Matched on the AST rather than the text, so that the module docstrings
+    which explain the prohibition do not trip the guard that enforces it.
+    """
+
+    offenders: list[tuple[str, int]] = []
+    for path in _library_modules():
+        tree = ast.parse(path.read_text(encoding="utf-8"))
+        for node in ast.walk(tree):
+            named = (
+                isinstance(node, ast.Attribute) and node.attr == "setrecursionlimit"
+            ) or (isinstance(node, ast.Name) and node.id == "setrecursionlimit")
+            if named:
+                offenders.append(
+                    (path.relative_to(_PACKAGE_ROOT).as_posix(), node.lineno)
+                )
+    assert offenders == [], (
+        "the library must not write the interpreter's recursion limit; "
+        f"bound the input instead. Sites: {offenders}"
+    )
diff --git a/glpi_python_client/tests/test_errors.py b/glpi_python_client/tests/test_errors.py
index 8b5d699..cfdb737 100644
--- a/glpi_python_client/tests/test_errors.py
+++ b/glpi_python_client/tests/test_errors.py
@@ -9,6 +9,7 @@
 
 from glpi_python_client import (
     GlpiAuthError,
+    GlpiContentError,
     GlpiError,
     GlpiNotFoundError,
     GlpiProtocolError,
@@ -33,6 +34,7 @@ def test_every_public_error_derives_from_glpi_error() -> None:
         GlpiServerError,
         GlpiValidationError,
         GlpiProtocolError,
+        GlpiContentError,
     ):
         assert issubclass(cls, GlpiError)
 
@@ -49,6 +51,19 @@ def test_transport_errors_are_not_value_errors() -> None:
     assert not issubclass(GlpiTransportError, ValueError)
 
 
+def test_content_errors_are_not_value_errors() -> None:
+    """A parser exhausting the stack is not a value the caller got wrong.
+
+    The three ``ValueError`` inheritors below carry that base only for
+    back-compatibility with releases that raised bare ``ValueError`` at the
+    same sites. There was never a ``ValueError`` at a conversion site, so
+    inheriting one here would widen the contract for no one's benefit --
+    the same reasoning as :class:`GlpiTransportError`.
+    """
+
+    assert not issubclass(GlpiContentError, ValueError)
+
+
 @pytest.mark.parametrize(
     "cls", [GlpiStatusError, GlpiValidationError, GlpiProtocolError]
 )

From 66e7ebb4ba8ba42fb8e38c1144516c71765a64b5 Mon Sep 17 00:00:00 2001
From: baraline <antoine.guillaume45@gmail.com>
Date: Tue, 8 Sep 2026 09:21:46 +0200
Subject: [PATCH 02/14] refactor(models)!: convert rich-text content on access,
 not on validation

BREAKING CHANGE: the six read models carrying rich text now store the
wire value in content_html (and description_html on GetKBArticle) and
expose content as a cached_property. Reading .content is unchanged, but
"content" is no longer a field: model_dump() emits content_html holding
HTML where it used to emit content holding Markdown, and
"content" not in GetTicket.model_fields.

Converting inside the validator meant every record on a page paid for a
conversion nobody had asked for, and one unconvertible body failed the
whole page, because _resource_list builds every item in one
comprehension. Converting on access moves the cost and the blast radius
to the record whose body is actually read: a list read converts nothing,
and a failure is confined to one record.

The validation alias accepts both spellings, so GLPI's payloads and
GetTicket(content=...) both still work. Write models stay eager -- a
caller's own Markdown is worth validating where it was supplied, and
there is no list path there to make lazy.

This needed a latent bug in GlpiModel fixed first: _capture_unknown_fields
runs before pydantic resolves aliases, so it was diverting the wire's
"content" into extra_payload and leaving the body None with an HTTP 200
and no warning. It now compares against every alias a field declares,
resolved once per model class and cached.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 glpi_python_client/models/__init__.py         |   7 +-
 glpi_python_client/models/_base.py            |  80 ++++++-
 .../models/api_schema/__init__.py             |   7 +
 .../models/api_schema/_content.py             | 157 ++++++++++++--
 .../models/api_schema/assistance/_ticket.py   |  39 +++-
 .../assistance/timeline/_followup.py          |  37 +++-
 .../assistance/timeline/_solution.py          |  37 +++-
 .../api_schema/assistance/timeline/_task.py   |  37 +++-
 .../api_schema/knowledgebase/_article.py      |  56 ++++-
 .../api_schema/knowledgebase/_revision.py     |  33 ++-
 .../models/api_schema/tests/__init__.py       |   1 +
 .../models/api_schema/tests/test_content.py   |  73 +++++++
 .../models/custom_schema/_ticket_context.py   |  12 ++
 glpi_python_client/models/tests/test_base.py  | 116 +++++++++++
 .../testing/tests/test_content_roundtrip.py   | 195 ++++++++++++++++++
 15 files changed, 816 insertions(+), 71 deletions(-)
 create mode 100644 glpi_python_client/models/api_schema/tests/__init__.py
 create mode 100644 glpi_python_client/models/api_schema/tests/test_content.py

diff --git a/glpi_python_client/models/__init__.py b/glpi_python_client/models/__init__.py
index b0af301..afd90d8 100644
--- a/glpi_python_client/models/__init__.py
+++ b/glpi_python_client/models/__init__.py
@@ -3,9 +3,10 @@
 The models are organised in two layers:
 
 * :mod:`glpi_python_client.models.api_schema` -- raw Pydantic shapes that
-  mirror ``docs/glpi_api_contract.json`` one for one. One model per HTTP
-  verb is exposed under the ``Get<Name>``, ``Post<Name>``, ``Patch<Name>``
-  and ``Delete<Name>`` naming convention. Use these models from new client
+  mirror ``docs/glpi_api_contract.json`` one for one, apart from the
+  rich-text slots documented there. One model per HTTP verb is exposed
+  under the ``Get<Name>``, ``Post<Name>``, ``Patch<Name>`` and
+  ``Delete<Name>`` naming convention. Use these models from new client
   mixins.
 * :mod:`glpi_python_client.models.custom_schema` -- aggregated views, such
   as :class:`GlpiTicketContext`, that group several API objects into one
diff --git a/glpi_python_client/models/_base.py b/glpi_python_client/models/_base.py
index d534a1f..8fdab84 100644
--- a/glpi_python_client/models/_base.py
+++ b/glpi_python_client/models/_base.py
@@ -20,6 +20,8 @@
 from typing import Any
 
 from pydantic import (
+    AliasChoices,
+    AliasPath,
     BaseModel,
     ConfigDict,
     Field,
@@ -38,6 +40,67 @@
 #: :meth:`GlpiModel._localise_naive_datetimes`.
 SERVER_TIMEZONE_CONTEXT_KEY = "server_timezone"
 
+#: Per-class cache of the payload keys that map onto a declared field.
+#:
+#: One entry per :class:`GlpiModel` subclass ever validated, computed once.
+#: Worth caching rather than recomputing: it is read once per record, so on
+#: a page of search results it is read once per row per model.
+_PAYLOAD_KEYS: dict[type[BaseModel], frozenset[str]] = {}
+
+
+def _payload_keys(model_class: type[BaseModel]) -> frozenset[str]:
+    """Return every payload key that maps onto a declared field.
+
+    Field *names* are not the whole answer, because a field may be fed by a
+    validation alias instead -- the read models take the wire's ``content``
+    into a field called ``content_html``. Comparing incoming keys against
+    names alone put that ``content`` in ``extra_payload`` before Pydantic
+    could resolve the alias, so the body silently arrived as ``None``.
+
+    All three alias shapes are covered. ``alias=`` and ``validation_alias=``
+    are both valid spellings of the same thing, an
+    :class:`~pydantic.AliasChoices` holds a list of either strings or
+    :class:`~pydantic.AliasPath` objects, and only the *first* segment of an
+    ``AliasPath`` is a key of the incoming mapping -- the rest index into
+    the value.
+
+    Parameters
+    ----------
+    model_class : type of pydantic.BaseModel
+        The concrete model class whose payload keys are wanted.
+
+    Returns
+    -------
+    frozenset of str
+        Field names plus every key any of their aliases can consume.
+    """
+
+    cached = _PAYLOAD_KEYS.get(model_class)
+    if cached is not None:
+        return cached
+
+    keys = set(model_class.model_fields)
+    pending: list[str | AliasPath | AliasChoices] = []
+    for field in model_class.model_fields.values():
+        if field.validation_alias is not None:
+            pending.append(field.validation_alias)
+        if field.alias is not None:
+            pending.append(field.alias)
+    while pending:
+        candidate = pending.pop()
+        if isinstance(candidate, str):
+            keys.add(candidate)
+        elif isinstance(candidate, AliasChoices):
+            pending.extend(candidate.choices)
+        else:
+            head = candidate.path[0]
+            if isinstance(head, str):
+                keys.add(head)
+
+    resolved = frozenset(keys)
+    _PAYLOAD_KEYS[model_class] = resolved
+    return resolved
+
 
 class GlpiModel(BaseModel):
     """Base class for field-validated GLPI data models.
@@ -55,16 +118,21 @@ class GlpiModel(BaseModel):
     def _capture_unknown_fields(cls, data: Any) -> Any:
         """Funnel unknown payload keys into ``extra_payload``.
 
-        The validator only runs when ``data`` is a mapping. Keys that are
-        not declared as fields on the concrete subclass (and are not the
-        ``extra_payload`` meta field itself) are removed from the incoming
-        mapping and merged into the ``extra_payload`` mapping. Any keys the
-        caller already placed in ``extra_payload`` win on conflicts.
+        The validator only runs when ``data`` is a mapping. Keys that no
+        declared field on the concrete subclass can consume (and that are
+        not the ``extra_payload`` meta field itself) are removed from the
+        incoming mapping and merged into the ``extra_payload`` mapping. Any
+        keys the caller already placed in ``extra_payload`` win on
+        conflicts.
+
+        "Can consume" means field names *and* validation aliases -- see
+        :func:`_payload_keys`. This validator runs before Pydantic resolves
+        aliases, so a key it removes is a key the alias never gets to see.
         """
 
         if not isinstance(data, dict):
             return data
-        known = set(cls.model_fields.keys())
+        known = _payload_keys(cls)
         existing_extras = data.get("extra_payload")
         captured: dict[str, Any] = {}
         for key in list(data.keys()):
diff --git a/glpi_python_client/models/api_schema/__init__.py b/glpi_python_client/models/api_schema/__init__.py
index 4d7a04b..e9a4116 100644
--- a/glpi_python_client/models/api_schema/__init__.py
+++ b/glpi_python_client/models/api_schema/__init__.py
@@ -13,4 +13,11 @@
 ``docs/glpi_api_contract.json`` are honoured. Mandatory and optional behaviour
 is left to GLPI: every field is declared optional in Python because the
 contract does not advertise ``required`` arrays.
+
+One deliberate departure from the contract's field names: a rich-text slot
+on a ``Get`` model is stored under ``<name>_html`` -- ``content_html``,
+``description_html`` -- because the model holds the wire value and exposes
+the converted Markdown under the contract's own name as a property. The
+contract spelling is still accepted on the way in, as a validation alias.
+See :mod:`glpi_python_client.models.api_schema._content`.
 """
diff --git a/glpi_python_client/models/api_schema/_content.py b/glpi_python_client/models/api_schema/_content.py
index 61ea729..048f10e 100644
--- a/glpi_python_client/models/api_schema/_content.py
+++ b/glpi_python_client/models/api_schema/_content.py
@@ -2,20 +2,48 @@
 
 GLPI exchanges rich-text fields (ticket ``content``, followup ``content``,
 task ``content``, solution ``content``, ...) over the wire as HTML
-(``format: html`` in the OpenAPI contract), but the public package surface
-is intentionally Markdown-only: callers should never need to author or read
-HTML. The annotated type defined here wires
-:class:`glpi_python_client.content.conversion.GlpiContentConverter` into
-Pydantic so the conversion happens transparently on every model boundary:
-
-* On validation (incoming HTML payloads from GLPI) the value is normalised
-  to canonical Markdown before being assigned to the field, so attribute
-  access always returns Markdown.
+(``format: html`` in the OpenAPI contract), while the public package
+surface is Markdown: a caller never has to author HTML, and reading
+``.content`` on any model gives Markdown back. The annotated types here
+wire :class:`glpi_python_client.content.conversion.GlpiContentConverter`
+into Pydantic to make that so, and they are deliberately not symmetric.
+
+**Write models** (``Post*``, ``Patch*``) use :data:`GlpiMarkdownContent`,
+which converts eagerly:
+
+* On validation the caller's Markdown is normalised, so it is checked at
+  the point the caller supplied it rather than somewhere later.
 * On serialisation (outgoing request bodies built via
   :func:`glpi_python_client._sync.clients.commons._payloads.model_to_payload`)
   the Markdown value is rendered back to HTML so GLPI receives the format
   it expects.
 
+**Read models** (``Get*``) use :data:`GlpiRawContent` or
+:data:`GlpiRawDescription` on a field named ``content_html`` /
+``description_html``, which holds exactly what GLPI sent and converts
+nothing. Each read model pairs that field with a ``cached_property`` --
+``content``, ``description`` -- that converts on first access and caches
+the result, over :func:`markdown_view`.
+
+The asymmetry is the point. Conversion used to run inside the Pydantic
+validator, which cost two things a caller could not opt out of:
+
+* **A list read converted every body.** Someone who wanted only ``id``
+  and ``date_mod`` still paid HTML-to-Markdown on every record of every
+  page.
+* **A failure took its page-mates with it.**
+  ``TransportMixin._resource_list`` builds every item of a page in one
+  comprehension, so one unconvertible body made the whole page
+  unreadable. Conversion now happens at the attribute, so whatever can go
+  wrong is scoped to the attribute.
+
+The field keeps ``content`` as a validation alias, so a GLPI payload and a
+hand-written ``GetTicket(content=...)`` both still populate it -- which is
+why :class:`glpi_python_client.models._base.GlpiModel` has to know about
+aliases when it captures unknown keys: that validator runs *before*
+Pydantic resolves them, and would otherwise divert the wire's ``content``
+into ``extra_payload``.
+
 Plain-text content is preserved verbatim on the inbound path and rendered
 as HTML paragraphs on the outbound path, matching the converter's default
 behaviour. "Plain text" means text carrying no recognised HTML element:
@@ -29,23 +57,36 @@
 so caller-authored Markdown passes through it before the serializer renders
 it. That is why the plain-text path has to stay verbatim -- routing Markdown
 through the HTML normaliser escapes it, and GLPI receives literal asterisks.
+
+One sharp edge comes with the read side, from ``functools.cached_property``:
+assigning to ``content_html`` after ``content`` has been read leaves the
+cached Markdown in place, and so does
+``model_copy(update={"content_html": ...})``. Neither equality, ``repr``
+nor any ``model_dump`` shows it. Treat a read model as immutable once
+validated; if something really must rewrite the raw value, drop the cache
+with ``obj.__dict__.pop("content", None)`` or rebuild the model through
+``model_validate``.
 """
 
 from __future__ import annotations
 
 from typing import Annotated
 
-from pydantic import BeforeValidator, PlainSerializer
+from pydantic import AliasChoices, BeforeValidator, Field, PlainSerializer
 
 from glpi_python_client.content.conversion import GlpiContentConverter
 
 
 def _from_transport(value: object) -> str | None:
-    """Normalise an inbound GLPI content value into canonical Markdown.
+    """Normalise a content value supplied to a write model into Markdown.
 
     Pydantic invokes this before validation, so the field type stays ``str``
     while the caller-visible value is always Markdown. ``None`` is preserved
     unchanged so optional content fields keep their tri-state semantics.
+
+    Only write models still normalise on validation; a read model stores
+    what GLPI sent and converts at the attribute instead, through
+    :func:`markdown_view`.
     """
 
     if value is None:
@@ -53,6 +94,43 @@ def _from_transport(value: object) -> str | None:
     return GlpiContentConverter.from_transport(value)
 
 
+def markdown_view(raw: str | None) -> str | None:
+    """Convert one stored raw transport value into Markdown.
+
+    The body of every ``content`` / ``description`` ``cached_property`` on
+    the read models. It is a plain function rather than a method so the
+    seven properties share one implementation while each keeps its own
+    docstring and its own cache slot.
+
+    ``None`` passes through, so a field GLPI never sent reads back as
+    ``None`` rather than as an empty string.
+
+    Parameters
+    ----------
+    raw : str or None
+        The raw transport value as stored, normally HTML.
+
+    Returns
+    -------
+    str or None
+        Canonical Markdown, or ``None``.
+
+    Raises
+    ------
+    GlpiContentError
+        The value could not be converted. Content nested past
+        :data:`glpi_python_client.content.conversion.MAX_HTML_DEPTH` is
+        degraded to text instead, so this is a backstop rather than an
+        expected outcome -- but note that it surfaces from the attribute
+        read, not from ``model_validate``, which is the deliberate
+        difference from the write-model path.
+    """
+
+    if raw is None:
+        return None
+    return GlpiContentConverter.from_transport(raw)
+
+
 def _to_transport(value: str | None) -> str | None:
     """Render an outbound Markdown content value as the HTML GLPI expects.
 
@@ -73,11 +151,56 @@ def _to_transport(value: str | None) -> str | None:
 ]
 """Annotated ``str | None`` that round-trips Markdown through GLPI's HTML wire format.
 
-Use this annotation on every model field that maps to a GLPI ``format: html``
-content slot (ticket descriptions, followup bodies, task bodies, solution
-bodies). The conversion is invisible to package users: the field accepts
-Markdown on construction, exposes Markdown on attribute access, and emits
-HTML on serialisation.
+Use this annotation on a **write** model field that maps to a GLPI
+``format: html`` content slot (ticket descriptions, followup bodies, task
+bodies, solution bodies). The conversion is invisible to package users: the
+field accepts Markdown on construction, exposes Markdown on attribute
+access, and emits HTML on serialisation.
+
+A read model wants :data:`GlpiRawContent` instead, and a
+``cached_property`` beside it. See the module docstring for why the two
+directions differ.
 """
 
-__all__ = ["GlpiMarkdownContent"]
+GlpiRawContent = Annotated[
+    str | None,
+    Field(
+        validation_alias=AliasChoices("content", "content_html"),
+        serialization_alias="content",
+    ),
+]
+"""Annotated ``str | None`` holding one raw GLPI ``content`` value, unconverted.
+
+Use this on a **read** model field named ``content_html``, paired with a
+``content`` ``cached_property`` over :func:`markdown_view`. Nothing is
+converted on validation, so building a page of records costs nothing per
+body and no body can spoil another.
+
+The validation alias accepts both spellings, so a GLPI payload
+(``content``) and a hand-written ``GetTicket(content_html=...)`` both
+populate the field. The name must be listed in the alias alongside the
+wire key: a bare ``validation_alias="content"`` would silently divert
+by-name construction into ``extra_payload`` rather than raising, because
+the base model allows extra keys.
+"""
+
+GlpiRawDescription = Annotated[
+    str | None,
+    Field(
+        validation_alias=AliasChoices("description", "description_html"),
+        serialization_alias="description",
+    ),
+]
+""":data:`GlpiRawContent` for the second content slot on a knowledge-base article.
+
+``KBArticle`` carries both ``content`` and ``description`` as
+``format: html``, and an alias names one wire key, so the two need
+separate annotations.
+"""
+
+__all__ = [
+    "GlpiMarkdownContent",
+    "GlpiRawContent",
+    "GlpiRawDescription",
+    "markdown_view",
+]
diff --git a/glpi_python_client/models/api_schema/assistance/_ticket.py b/glpi_python_client/models/api_schema/assistance/_ticket.py
index b38a38b..40c85fe 100644
--- a/glpi_python_client/models/api_schema/assistance/_ticket.py
+++ b/glpi_python_client/models/api_schema/assistance/_ticket.py
@@ -9,21 +9,30 @@
 ``internal_resolution_date``, ``internal_take_into_account_date``) are
 excluded from the request models.
 
-Ticket ``content`` is exchanged with GLPI as HTML (``format: html``). The
-schema models the raw transport string; HTML/Markdown conversion belongs
-to the client layer.
+Ticket ``content`` is exchanged with GLPI as HTML (``format: html``).
+:class:`PostTicket` and :class:`PatchTicket` accept Markdown and render it
+on serialisation; :class:`GetTicket` stores the wire value in
+``content_html`` and exposes Markdown through the ``content`` property,
+converting on first read. See
+:mod:`glpi_python_client.models.api_schema._content` for why the two
+directions differ.
 """
 
 from __future__ import annotations
 
 from datetime import datetime
+from functools import cached_property
 
 from glpi_python_client.models._base import GlpiModel
 from glpi_python_client.models.api_schema._common import (
     IdNameCompletenameRef,
     IdNameRef,
 )
-from glpi_python_client.models.api_schema._content import GlpiMarkdownContent
+from glpi_python_client.models.api_schema._content import (
+    GlpiMarkdownContent,
+    GlpiRawContent,
+    markdown_view,
+)
 from glpi_python_client.models.api_schema.enums import (
     GlpiGlobalValidation,
     GlpiPriority,
@@ -70,10 +79,10 @@ class GetTicket(GlpiModel):
         Native GLPI identifier (``readOnly``).
     name : str | None, optional
         Title of the ticket.
-    content : GlpiMarkdownContent
-        Body of the ticket exchanged as HTML over the wire
-        (``format: html``); transparent Markdown conversion is applied
-        on the model boundary. Defaults to :data:`None`.
+    content_html : GlpiRawContent
+        Body of the ticket exactly as GLPI sent it, which is HTML
+        (``format: html``). Accepts the wire spelling ``content`` too.
+        Read :attr:`content` for Markdown. Defaults to :data:`None`.
     user_recipient : IdNameRef | None, optional
         Reference to the user designated as the ticket recipient (no
         contract description).
@@ -183,7 +192,7 @@ class GetTicket(GlpiModel):
 
     id: int | None = None
     name: str | None = None
-    content: GlpiMarkdownContent = None
+    content_html: GlpiRawContent = None
     user_recipient: IdNameRef | None = None
     user_editor: IdNameRef | None = None
     is_deleted: bool | None = None
@@ -225,6 +234,18 @@ class GetTicket(GlpiModel):
     entity: IdNameCompletenameRef | None = None
     team: list[_TicketTeamMember] | None = None
 
+    @cached_property
+    def content(self) -> str | None:
+        """The ticket body as Markdown, or ``None`` if GLPI sent none.
+
+        Converted from ``content_html`` on the first read and cached, so
+        listing tickets costs nothing per body and a body that cannot be
+        converted affects only this record. ``content_html`` holds the HTML
+        exactly as it arrived.
+        """
+
+        return markdown_view(self.content_html)
+
 
 class PostTicket(GlpiModel):
     """Request body for ``POST /Assistance/Ticket``.
diff --git a/glpi_python_client/models/api_schema/assistance/timeline/_followup.py b/glpi_python_client/models/api_schema/assistance/timeline/_followup.py
index bddf3bb..a2f347a 100644
--- a/glpi_python_client/models/api_schema/assistance/timeline/_followup.py
+++ b/glpi_python_client/models/api_schema/assistance/timeline/_followup.py
@@ -5,17 +5,26 @@
 ``components.schemas.Followup`` from the GLPI OpenAPI contract.
 
 Read-only contract fields (``id``) are excluded from request models.
-``content`` is exchanged as HTML; HTML/Markdown conversion is left to the
-client transport layer.
+``content`` is exchanged as HTML. The write models accept Markdown and
+render it on serialisation; the read model stores the wire value in
+``content_html`` and exposes Markdown through the ``content`` property,
+converting on first read. See
+:mod:`glpi_python_client.models.api_schema._content` for why the two
+directions differ.
 """
 
 from __future__ import annotations
 
 from datetime import datetime
+from functools import cached_property
 
 from glpi_python_client.models._base import GlpiModel
 from glpi_python_client.models.api_schema._common import IdNameRef
-from glpi_python_client.models.api_schema._content import GlpiMarkdownContent
+from glpi_python_client.models.api_schema._content import (
+    GlpiMarkdownContent,
+    GlpiRawContent,
+    markdown_view,
+)
 from glpi_python_client.models.api_schema.enums import GlpiTimelinePosition
 
 
@@ -34,10 +43,10 @@ class GetFollowup(GlpiModel):
         GLPI item type the followup belongs to, typically ``"Ticket"``.
     items_id : int | None, optional
         Identifier of the parent GLPI item.
-    content : GlpiMarkdownContent
-        Body of the followup exchanged as HTML over the wire
-        (``format: html``); transparent Markdown conversion is applied
-        on the model boundary. Defaults to :data:`None`.
+    content_html : GlpiRawContent
+        Body of the followup exactly as GLPI sent it, which is HTML
+        (``format: html``). Accepts the wire spelling ``content`` too.
+        Read :attr:`content` for Markdown. Defaults to :data:`None`.
     is_private : bool | None, optional
         Whether the followup is visible only to technicians.
     user : IdNameRef | None, optional
@@ -69,7 +78,7 @@ class GetFollowup(GlpiModel):
     id: int | None = None
     itemtype: str | None = None
     items_id: int | None = None
-    content: GlpiMarkdownContent = None
+    content_html: GlpiRawContent = None
     is_private: bool | None = None
     user: IdNameRef | None = None
     user_editor: IdNameRef | None = None
@@ -81,6 +90,18 @@ class GetFollowup(GlpiModel):
     source_item_id: int | None = None
     source_of_item_id: int | None = None
 
+    @cached_property
+    def content(self) -> str | None:
+        """The followup body as Markdown, or ``None`` if GLPI sent none.
+
+        Converted from ``content_html`` on the first read and cached, so
+        reading a ticket's timeline costs nothing per body and a body that
+        cannot be converted affects only this record. ``content_html``
+        holds the HTML exactly as it arrived.
+        """
+
+        return markdown_view(self.content_html)
+
 
 class PostFollowup(GlpiModel):
     """Request body for ``POST`` on ticket timeline followup endpoints.
diff --git a/glpi_python_client/models/api_schema/assistance/timeline/_solution.py b/glpi_python_client/models/api_schema/assistance/timeline/_solution.py
index a5a106c..f5eefc6 100644
--- a/glpi_python_client/models/api_schema/assistance/timeline/_solution.py
+++ b/glpi_python_client/models/api_schema/assistance/timeline/_solution.py
@@ -5,17 +5,26 @@
 ``components.schemas.Solution`` from the GLPI OpenAPI contract.
 
 Read-only contract fields (``id``) are excluded from request models.
-``content`` is exchanged as HTML; HTML/Markdown conversion is left to the
-client transport layer.
+``content`` is exchanged as HTML. The write models accept Markdown and
+render it on serialisation; the read model stores the wire value in
+``content_html`` and exposes Markdown through the ``content`` property,
+converting on first read. See
+:mod:`glpi_python_client.models.api_schema._content` for why the two
+directions differ.
 """
 
 from __future__ import annotations
 
 from datetime import datetime
+from functools import cached_property
 
 from glpi_python_client.models._base import GlpiModel
 from glpi_python_client.models.api_schema._common import IdNameRef
-from glpi_python_client.models.api_schema._content import GlpiMarkdownContent
+from glpi_python_client.models.api_schema._content import (
+    GlpiMarkdownContent,
+    GlpiRawContent,
+    markdown_view,
+)
 from glpi_python_client.models.api_schema.enums import GlpiSolutionStatus
 
 
@@ -35,10 +44,10 @@ class GetSolution(GlpiModel):
         Identifier of the parent GLPI item.
     type : IdNameRef | None, optional
         Reference to the solution type.
-    content : GlpiMarkdownContent
-        Body of the solution exchanged as HTML over the wire
-        (``format: html``); transparent Markdown conversion is applied
-        on the model boundary. Defaults to :data:`None`.
+    content_html : GlpiRawContent
+        Body of the solution exactly as GLPI sent it, which is HTML
+        (``format: html``). Accepts the wire spelling ``content`` too.
+        Read :attr:`content` for Markdown. Defaults to :data:`None`.
     user : IdNameRef | None, optional
         Reference to the author of the solution.
     user_editor : IdNameRef | None, optional
@@ -66,7 +75,7 @@ class GetSolution(GlpiModel):
     itemtype: str | None = None
     items_id: int | None = None
     type: IdNameRef | None = None
-    content: GlpiMarkdownContent = None
+    content_html: GlpiRawContent = None
     user: IdNameRef | None = None
     user_editor: IdNameRef | None = None
     approver: IdNameRef | None = None
@@ -76,6 +85,18 @@ class GetSolution(GlpiModel):
     date_mod: datetime | None = None
     date_approval: datetime | None = None
 
+    @cached_property
+    def content(self) -> str | None:
+        """The solution body as Markdown, or ``None`` if GLPI sent none.
+
+        Converted from ``content_html`` on the first read and cached, so
+        reading a ticket's timeline costs nothing per body and a body that
+        cannot be converted affects only this record. ``content_html``
+        holds the HTML exactly as it arrived.
+        """
+
+        return markdown_view(self.content_html)
+
 
 class PostSolution(GlpiModel):
     """Request body for ``POST`` on ticket timeline solution endpoints.
diff --git a/glpi_python_client/models/api_schema/assistance/timeline/_task.py b/glpi_python_client/models/api_schema/assistance/timeline/_task.py
index 20c395f..60b39fb 100644
--- a/glpi_python_client/models/api_schema/assistance/timeline/_task.py
+++ b/glpi_python_client/models/api_schema/assistance/timeline/_task.py
@@ -5,17 +5,26 @@
 OpenAPI contract.
 
 Read-only contract fields (``id``, ``uuid``) are excluded from request
-models. ``content`` is exchanged as HTML; HTML/Markdown conversion is left
-to the client transport layer.
+models. ``content`` is exchanged as HTML. The write models accept Markdown
+and render it on serialisation; the read model stores the wire value in
+``content_html`` and exposes Markdown through the ``content`` property,
+converting on first read. See
+:mod:`glpi_python_client.models.api_schema._content` for why the two
+directions differ.
 """
 
 from __future__ import annotations
 
 from datetime import datetime
+from functools import cached_property
 
 from glpi_python_client.models._base import GlpiModel
 from glpi_python_client.models.api_schema._common import IdNameRef
-from glpi_python_client.models.api_schema._content import GlpiMarkdownContent
+from glpi_python_client.models.api_schema._content import (
+    GlpiMarkdownContent,
+    GlpiRawContent,
+    markdown_view,
+)
 from glpi_python_client.models.api_schema.enums import (
     GlpiTaskState,
     GlpiTimelinePosition,
@@ -37,10 +46,10 @@ class GetTicketTask(GlpiModel):
         Server-generated universally unique identifier matching the
         pattern ``/^[0-9a-f]{8}-...-4...-[89ab]...-...$/i``
         (``readOnly``).
-    content : GlpiMarkdownContent
-        Body of the task exchanged as HTML over the wire
-        (``format: html``); transparent Markdown conversion is applied
-        on the model boundary. Defaults to :data:`None`.
+    content_html : GlpiRawContent
+        Body of the task exactly as GLPI sent it, which is HTML
+        (``format: html``). Accepts the wire spelling ``content`` too.
+        Read :attr:`content` for Markdown. Defaults to :data:`None`.
     is_private : bool | None, optional
         Whether the task is visible only to technicians.
     user : IdNameRef | None, optional
@@ -86,7 +95,7 @@ class GetTicketTask(GlpiModel):
 
     id: int | None = None
     uuid: str | None = None
-    content: GlpiMarkdownContent = None
+    content_html: GlpiRawContent = None
     is_private: bool | None = None
     user: IdNameRef | None = None
     user_editor: IdNameRef | None = None
@@ -105,6 +114,18 @@ class GetTicketTask(GlpiModel):
     source_item_id: int | None = None
     source_of_item_id: int | None = None
 
+    @cached_property
+    def content(self) -> str | None:
+        """The task body as Markdown, or ``None`` if GLPI sent none.
+
+        Converted from ``content_html`` on the first read and cached, so
+        reading a ticket's timeline costs nothing per body and a body that
+        cannot be converted affects only this record. ``content_html``
+        holds the HTML exactly as it arrived.
+        """
+
+        return markdown_view(self.content_html)
+
 
 class PostTicketTask(GlpiModel):
     """Request body for ``POST`` on ticket timeline task endpoints.
diff --git a/glpi_python_client/models/api_schema/knowledgebase/_article.py b/glpi_python_client/models/api_schema/knowledgebase/_article.py
index cd5da3b..7caf533 100644
--- a/glpi_python_client/models/api_schema/knowledgebase/_article.py
+++ b/glpi_python_client/models/api_schema/knowledgebase/_article.py
@@ -1,8 +1,15 @@
 """GLPI ``KBArticle`` schemas for the ``/Knowledgebase/Article`` endpoints.
 
 The field layout mirrors ``components.schemas.KBArticle`` from the GLPI
-OpenAPI contract (2.3.0). ``content`` and ``description`` are exchanged as
-HTML (``format: html``) and use the transparent Markdown annotation.
+OpenAPI contract (2.3.0). ``content`` and ``description`` are both
+exchanged as HTML (``format: html``). :class:`PostKBArticle` and
+:class:`PatchKBArticle` accept Markdown and render it on serialisation;
+:class:`GetKBArticle` stores the wire values in ``content_html`` and
+``description_html`` and exposes Markdown through the ``content`` and
+``description`` properties, converting on first read. See
+:mod:`glpi_python_client.models.api_schema._content` for why the two
+directions differ.
+
 Server-managed fields (``id``, ``views``, ``revisions``, ``translations``)
 are excluded from the request models; revisions and translations are
 managed through the dedicated revision endpoints.
@@ -11,10 +18,16 @@
 from __future__ import annotations
 
 from datetime import datetime
+from functools import cached_property
 
 from glpi_python_client.models._base import GlpiModel
 from glpi_python_client.models.api_schema._common import IdNameRef
-from glpi_python_client.models.api_schema._content import GlpiMarkdownContent
+from glpi_python_client.models.api_schema._content import (
+    GlpiMarkdownContent,
+    GlpiRawContent,
+    GlpiRawDescription,
+    markdown_view,
+)
 
 
 class _KBArticleRevisionRef(GlpiModel):
@@ -37,13 +50,20 @@ class _KBArticleTranslationRef(GlpiModel):
 class GetKBArticle(GlpiModel):
     """Response shape returned by ``GET /Knowledgebase/Article`` endpoints.
 
-    Mirrors ``components.schemas.KBArticle``. ``content`` and
-    ``description`` round-trip Markdown through GLPI's HTML wire format.
+    Mirrors ``components.schemas.KBArticle``. ``content_html`` and
+    ``description_html`` hold the HTML exactly as GLPI sent it, and both
+    accept their wire spellings (``content``, ``description``) as well; the
+    :attr:`content` and :attr:`description` properties convert to Markdown
+    on first read.
+
+    An article body is the largest content GLPI serves, and searching the
+    knowledge base returns whole articles, so this is the model where
+    converting only what is read matters most.
     """
 
     id: int | None = None
     name: str | None = None
-    content: GlpiMarkdownContent = None
+    content_html: GlpiRawContent = None
     categories: list[IdNameRef] | None = None
     is_faq: bool | None = None
     entity: IdNameRef | None = None
@@ -51,7 +71,7 @@ class GetKBArticle(GlpiModel):
     user: IdNameRef | None = None
     views: int | None = None
     show_in_service_catalog: bool | None = None
-    description: GlpiMarkdownContent = None
+    description_html: GlpiRawDescription = None
     illustration: str | None = None
     is_pinned: bool | None = None
     date_creation: datetime | None = None
@@ -61,6 +81,28 @@ class GetKBArticle(GlpiModel):
     revisions: list[_KBArticleRevisionRef] | None = None
     translations: list[_KBArticleTranslationRef] | None = None
 
+    @cached_property
+    def content(self) -> str | None:
+        """The article body as Markdown, or ``None`` if GLPI sent none.
+
+        Converted from ``content_html`` on the first read and cached, so
+        searching the knowledge base costs nothing per body and a body that
+        cannot be converted affects only this record. ``content_html``
+        holds the HTML exactly as it arrived.
+        """
+
+        return markdown_view(self.content_html)
+
+    @cached_property
+    def description(self) -> str | None:
+        """The article summary as Markdown, or ``None`` if GLPI sent none.
+
+        The short counterpart to :attr:`content`, converted from
+        ``description_html`` on the first read and cached the same way.
+        """
+
+        return markdown_view(self.description_html)
+
 
 class PostKBArticle(GlpiModel):
     """Request body for ``POST /Knowledgebase/Article``.
diff --git a/glpi_python_client/models/api_schema/knowledgebase/_revision.py b/glpi_python_client/models/api_schema/knowledgebase/_revision.py
index 123b377..61d3678 100644
--- a/glpi_python_client/models/api_schema/knowledgebase/_revision.py
+++ b/glpi_python_client/models/api_schema/knowledgebase/_revision.py
@@ -3,33 +3,56 @@
 The endpoints live under
 ``/Knowledgebase/Article/{article_id}/Revision`` (and the language-scoped
 variant). Revisions are read-only, so this module exposes only a ``Get``
-model. ``content`` is exchanged as HTML (``format: html``) and round-trips
-Markdown on the model boundary.
+model. ``content`` is exchanged as HTML (``format: html``): the wire value
+is stored in ``content_html`` and the ``content`` property converts it to
+Markdown on first read. See
+:mod:`glpi_python_client.models.api_schema._content` for why.
 """
 
 from __future__ import annotations
 
 from datetime import datetime
+from functools import cached_property
 
 from glpi_python_client.models._base import GlpiModel
 from glpi_python_client.models.api_schema._common import IdNameRef
-from glpi_python_client.models.api_schema._content import GlpiMarkdownContent
+from glpi_python_client.models.api_schema._content import (
+    GlpiRawContent,
+    markdown_view,
+)
 
 
 class GetKBArticleRevision(GlpiModel):
     """Response shape returned by ``GET`` on KB revision endpoints.
 
-    Mirrors ``components.schemas.KBArticleRevision``.
+    Mirrors ``components.schemas.KBArticleRevision``. ``content_html``
+    holds the HTML exactly as GLPI sent it and also accepts the wire
+    spelling ``content``; the :attr:`content` property converts it to
+    Markdown on first read.
+
+    Revision history is the clearest case for that: listing an article's
+    revisions returns every past body, and a caller comparing dates or
+    revision numbers reads none of them.
     """
 
     id: int | None = None
     kbarticle: IdNameRef | None = None
     revision: int | None = None
     name: str | None = None
-    content: GlpiMarkdownContent = None
+    content_html: GlpiRawContent = None
     language: str | None = None
     user: IdNameRef | None = None
     date: datetime | None = None
 
+    @cached_property
+    def content(self) -> str | None:
+        """The revision's body as Markdown, or ``None`` if GLPI sent none.
+
+        Converted from ``content_html`` on the first read and cached.
+        ``content_html`` holds the HTML exactly as it arrived.
+        """
+
+        return markdown_view(self.content_html)
+
 
 __all__ = ["GetKBArticleRevision"]
diff --git a/glpi_python_client/models/api_schema/tests/__init__.py b/glpi_python_client/models/api_schema/tests/__init__.py
new file mode 100644
index 0000000..7cdb581
--- /dev/null
+++ b/glpi_python_client/models/api_schema/tests/__init__.py
@@ -0,0 +1 @@
+"""Unit tests for the shared API-schema helpers."""
diff --git a/glpi_python_client/models/api_schema/tests/test_content.py b/glpi_python_client/models/api_schema/tests/test_content.py
new file mode 100644
index 0000000..f3905ba
--- /dev/null
+++ b/glpi_python_client/models/api_schema/tests/test_content.py
@@ -0,0 +1,73 @@
+"""Unit tests for :mod:`glpi_python_client.models.api_schema._content`.
+
+The annotated types and the ``markdown_view`` helper had no unit tests of
+their own -- their behaviour was covered incidentally by the model suites,
+which left the ``None`` paths on both directions executed by nothing at
+all. Those paths are what keeps ``exclude_none`` working, so they are the
+ones worth pinning explicitly.
+
+The wider read/write contract lives in
+``glpi_python_client/testing/tests/test_content_roundtrip.py``; this module
+is only the helpers.
+"""
+
+from __future__ import annotations
+
+from glpi_python_client._sync.clients.commons._payloads import model_to_payload
+from glpi_python_client.models.api_schema._content import (
+    _from_transport,
+    _to_transport,
+    markdown_view,
+)
+from glpi_python_client.models.api_schema.assistance import GetTicket, PostTicket
+
+
+def test_markdown_view_passes_none_through() -> None:
+    """A slot GLPI never sent reads back as ``None``, not as ``""``.
+
+    The distinction matters on the way back out: an empty string is a
+    caller asking to clear the body, and ``None`` is a caller not
+    mentioning it.
+    """
+
+    assert markdown_view(None) is None
+
+
+def test_markdown_view_converts_a_raw_value() -> None:
+    """The body of every read model's content property, in one line."""
+
+    assert markdown_view("<p>The printer is <strong>offline</strong>.</p>") == (
+        "The printer is **offline**."
+    )
+
+
+def test_the_inbound_validator_passes_none_through() -> None:
+    """An explicit ``content=None`` on a write model stays ``None``.
+
+    Reached only by naming the field, since an unset field never runs the
+    validator -- which is why nothing exercised it before.
+    """
+
+    assert _from_transport(None) is None
+    assert PostTicket(content=None).content is None
+
+
+def test_the_outbound_serialiser_passes_none_through() -> None:
+    """``None`` has to survive serialisation for ``exclude_none`` to work.
+
+    ``model_to_payload`` dumps with ``exclude_none=True``, so a rendered
+    empty string here would put an empty body in the request instead of
+    leaving the field out.
+    """
+
+    assert _to_transport(None) is None
+    assert "content" not in model_to_payload(PostTicket(content=None))
+
+
+def test_a_read_model_reads_none_when_glpi_sent_no_body() -> None:
+    """The read side of the same tri-state, through the real model."""
+
+    ticket = GetTicket.model_validate({"id": 1})
+
+    assert ticket.content_html is None
+    assert ticket.content is None
diff --git a/glpi_python_client/models/custom_schema/_ticket_context.py b/glpi_python_client/models/custom_schema/_ticket_context.py
index 07d9d1e..23e8974 100644
--- a/glpi_python_client/models/custom_schema/_ticket_context.py
+++ b/glpi_python_client/models/custom_schema/_ticket_context.py
@@ -238,6 +238,18 @@ def to_markdown(
             Markdown transcript suitable for direct display or for
             forwarding into a downstream Markdown renderer. The string
             never ends with trailing whitespace.
+
+        Raises
+        ------
+        GlpiContentError
+            One of the bodies could not be converted from GLPI's HTML.
+            This is where the read models' HTML-to-Markdown conversion
+            actually happens -- they hold the wire value and convert on
+            first read, and this method is normally the first reader.
+            Content nested past
+            :data:`glpi_python_client.content.conversion.MAX_HTML_DEPTH`
+            is degraded to plain text rather than raising, so this is a
+            backstop rather than an expected outcome.
         """
 
         opts = options if options is not None else TicketMarkdownOptions()
diff --git a/glpi_python_client/models/tests/test_base.py b/glpi_python_client/models/tests/test_base.py
index bdb6188..9f50e33 100644
--- a/glpi_python_client/models/tests/test_base.py
+++ b/glpi_python_client/models/tests/test_base.py
@@ -8,6 +8,10 @@
 from __future__ import annotations
 
 from datetime import datetime, timedelta, timezone
+from typing import Annotated
+
+import pytest
+from pydantic import AliasChoices, AliasPath, Field, ValidationError
 
 from glpi_python_client.models._base import GlpiModel
 
@@ -181,3 +185,115 @@ def test_the_serialisation_timezone_reaches_a_nested_model() -> None:
     dumped = nested.model_dump(mode="json", context={"server_timezone": _PARIS_WINTER})
 
     assert dumped["inner"]["date"] == "2024-01-01T13:00:00"
+
+
+# ---------------------------------------------------------------------------
+# Alias-aware capture of unknown keys
+# ---------------------------------------------------------------------------
+#
+# ``_capture_unknown_fields`` runs before Pydantic resolves aliases, so a key
+# it removes is a key the alias never gets to see. That made the read models'
+# ``content`` -> ``content_html`` rename fail in the worst possible way:
+# HTTP 200, no warning, no error, and every ticket body reading back as
+# ``None`` with the HTML sitting in ``extra_payload``. These tests pin both
+# halves -- an aliased key must reach its field, and a genuinely unknown key
+# must still be captured.
+
+
+class _Aliased(GlpiModel):
+    """Model whose field is fed by a validation alias, like the read models."""
+
+    id: int | None = None
+    body_html: Annotated[
+        str | None,
+        Field(validation_alias=AliasChoices("body", "body_html")),
+    ] = None
+
+
+class _PathAliased(GlpiModel):
+    """Model fed through an ``AliasPath``, where only segment 0 is a key."""
+
+    inner: Annotated[
+        str | None, Field(validation_alias=AliasPath("wrapper", "value"))
+    ] = None
+
+
+def test_an_aliased_payload_key_reaches_its_field() -> None:
+    """The wire spelling populates the field instead of ``extra_payload``."""
+
+    parsed = _Aliased.model_validate({"id": 1, "body": "<p>hello</p>"})
+
+    assert parsed.body_html == "<p>hello</p>"
+    assert parsed.extra_payload == {}
+
+
+def test_the_field_name_spelling_also_reaches_the_field() -> None:
+    """Listing the field's own name in ``AliasChoices`` is what allows this.
+
+    A bare ``validation_alias="body"`` would not raise on by-name
+    construction -- the base model allows extra keys, so the value would go
+    quietly to ``extra_payload`` and the field would stay ``None``.
+    """
+
+    parsed = _Aliased.model_validate({"body_html": "<p>hello</p>"})
+
+    assert parsed.body_html == "<p>hello</p>"
+    assert parsed.extra_payload == {}
+
+
+def test_a_genuinely_unknown_key_is_still_captured() -> None:
+    """Widening the known set must not stop the escape hatch working.
+
+    The other direction of the same fix: if ``known`` became "any key at
+    all", the ``extra_payload`` contract would silently stop collecting the
+    helper fields GLPI adds outside the contract.
+    """
+
+    parsed = _Aliased.model_validate({"body": "<p>x</p>", "href": "/Ticket/1"})
+
+    assert parsed.body_html == "<p>x</p>"
+    assert parsed.extra_payload == {"href": "/Ticket/1"}
+
+
+def test_only_the_first_segment_of_an_alias_path_is_a_payload_key() -> None:
+    """``AliasPath("wrapper", "value")`` consumes ``wrapper``, not ``value``.
+
+    The remaining segments index into the value, so treating them as keys
+    would exempt names that really are unknown.
+    """
+
+    parsed = _PathAliased.model_validate({"wrapper": {"value": "deep"}, "junk": 1})
+
+    assert parsed.inner == "deep"
+    assert parsed.extra_payload == {"junk": 1}
+
+
+class _PlainAliased(GlpiModel):
+    """Model using the ``alias=`` spelling rather than ``validation_alias=``."""
+
+    value: Annotated[str | None, Field(alias="wire_value")] = None
+
+
+def test_the_plain_alias_spelling_is_also_recognised() -> None:
+    """``alias=`` is a validation spelling too, so it has to be collected.
+
+    Pydantic mirrors ``alias=`` into ``validation_alias`` today, which makes
+    reading both belt and braces -- but the belt is one line and the braces
+    are an undocumented implementation detail of another library.
+    """
+
+    parsed = _PlainAliased.model_validate({"wire_value": "x", "junk": 1})
+
+    assert parsed.value == "x"
+    assert parsed.extra_payload == {"junk": 1}
+
+
+def test_a_non_mapping_payload_is_passed_through_untouched() -> None:
+    """The capture validator only has work to do on a mapping.
+
+    Anything else is handed straight to Pydantic, which produces the real
+    error. Capturing keys from a list would mean inventing them.
+    """
+
+    with pytest.raises(ValidationError):
+        _Stamped.model_validate([1, 2, 3])
diff --git a/glpi_python_client/testing/tests/test_content_roundtrip.py b/glpi_python_client/testing/tests/test_content_roundtrip.py
index 817aeb0..9f65521 100644
--- a/glpi_python_client/testing/tests/test_content_roundtrip.py
+++ b/glpi_python_client/testing/tests/test_content_roundtrip.py
@@ -9,9 +9,12 @@
 
 from __future__ import annotations
 
+from functools import cached_property
+
 import pytest
 
 from glpi_python_client._sync.clients.commons._payloads import model_to_payload
+from glpi_python_client.content import conversion
 from glpi_python_client.models.api_schema.assistance import (
     GetTicket,
     PatchTicket,
@@ -25,6 +28,30 @@
     PostSolution,
     PostTicketTask,
 )
+from glpi_python_client.models.api_schema.knowledgebase import (
+    GetKBArticle,
+    GetKBArticleRevision,
+)
+
+
+def _count_conversions(monkeypatch: pytest.MonkeyPatch) -> list[str]:
+    """Record every call to the inbound converter, and return the log.
+
+    A list rather than a counter so an assertion can show what was
+    converted, not only how often.
+    """
+
+    seen: list[str] = []
+    real = conversion.GlpiContentConverter.from_transport
+
+    def _record(value: object) -> str:
+        seen.append(str(value))
+        return real(value)
+
+    monkeypatch.setattr(
+        conversion.GlpiContentConverter, "from_transport", staticmethod(_record)
+    )
+    return seen
 
 
 @pytest.mark.parametrize(
@@ -187,3 +214,171 @@ def test_round_trip_corpus(markdown: str) -> None:
     incoming = GetTicket.model_validate({"name": "Round trip", **outgoing})
 
     assert incoming.content == markdown
+
+
+# ---------------------------------------------------------------------------
+# Lazy conversion on the read models
+# ---------------------------------------------------------------------------
+#
+# Conversion used to run inside the Pydantic validator, which meant a caller
+# who wanted only ``id`` and ``date_mod`` paid HTML-to-Markdown on every
+# record of every page, and one unconvertible body took its page-mates down
+# with it -- ``_resource_list`` builds a page in a single comprehension. The
+# tests here pin the three consequences of moving it to the attribute: the
+# raw value is available, nothing converts until something is read, and a
+# failure is confined to the record whose body was read.
+
+#: Every read model with a content slot, and the fields on each.
+#:
+#: Named explicitly rather than discovered, so that adding a read model with
+#: a content field and forgetting the property is a failure here rather than
+#: a silently eager model.
+READ_CONTENT_MODELS = [
+    pytest.param(GetTicket, ["content"], id="GetTicket"),
+    pytest.param(GetFollowup, ["content"], id="GetFollowup"),
+    pytest.param(GetSolution, ["content"], id="GetSolution"),
+    pytest.param(GetTicketTask, ["content"], id="GetTicketTask"),
+    pytest.param(GetKBArticle, ["content", "description"], id="GetKBArticle"),
+    pytest.param(GetKBArticleRevision, ["content"], id="GetKBArticleRevision"),
+]
+
+
+@pytest.mark.parametrize(("model_cls", "slots"), READ_CONTENT_MODELS)
+def test_read_models_keep_the_raw_wire_value(model_cls: type, slots: list[str]) -> None:
+    """``<slot>_html`` holds exactly what GLPI sent, unconverted."""
+
+    html = "<p>The printer is <strong>offline</strong>.</p>"
+
+    instance = model_cls.model_validate({slot: html for slot in slots})
+
+    for slot in slots:
+        assert getattr(instance, f"{slot}_html") == html
+        assert getattr(instance, slot) == "The printer is **offline**."
+
+
+@pytest.mark.parametrize(("model_cls", "slots"), READ_CONTENT_MODELS)
+def test_no_read_model_still_declares_the_slot_as_a_field(
+    model_cls: type, slots: list[str]
+) -> None:
+    """A leftover field declaration would shadow the property, silently.
+
+    Pydantic keeps a field of that name if one is declared anywhere in the
+    MRO, puts the validated value straight into ``__dict__``, and the
+    non-data ``cached_property`` descriptor never runs -- no error, no
+    warning, and ``.content`` hands back raw HTML. Deleting the old line is
+    half the change, so it is asserted rather than assumed.
+    """
+
+    for slot in slots:
+        assert slot not in model_cls.model_fields
+        assert f"{slot}_html" in model_cls.model_fields
+        assert isinstance(model_cls.__dict__.get(slot), cached_property)
+
+
+def test_building_a_page_of_records_converts_nothing(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """Validation is free; the cost moves to whoever reads a body.
+
+    This is the reason for the whole change. A search returning a hundred
+    tickets used to run HTML-to-Markdown a hundred times whether or not the
+    caller looked at a single body.
+    """
+
+    calls = _count_conversions(monkeypatch)
+    payload = {"id": 1, "content": "<p>The printer is <strong>offline</strong>.</p>"}
+
+    page = [GetTicket.model_validate(payload) for _ in range(100)]
+
+    assert calls == []
+    assert page[7].content == "The printer is **offline**."
+    assert len(calls) == 1
+
+
+def test_a_body_is_converted_once_however_often_it_is_read(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """``cached_property``, so repeated reads are free.
+
+    Worth pinning: without the cache, moving conversion to the attribute
+    would make the common read-it-twice case slower than the eager version
+    it replaced.
+    """
+
+    calls = _count_conversions(monkeypatch)
+    ticket = GetTicket.model_validate({"content": "<p>a <em>b</em></p>"})
+
+    first, second, third = ticket.content, ticket.content, ticket.content
+
+    assert first == second == third == "a *b*"
+    assert len(calls) == 1
+
+
+def test_one_unconvertible_body_leaves_its_page_mates_readable(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """A failure is scoped to the record whose body was actually read.
+
+    ``TransportMixin._resource_list`` validates a whole page in one
+    comprehension, so a converter that raised on any single record used to
+    abort the page and take every other body with it -- including the
+    records the caller wanted. Now the two other tickets read fine and the
+    bad one raises only when touched.
+    """
+
+    def _selective(value: object) -> str:
+        if "poison" in str(value):
+            raise RecursionError("maximum recursion depth exceeded")
+        return "converted"
+
+    monkeypatch.setattr(
+        conversion.GlpiContentConverter, "from_transport", staticmethod(_selective)
+    )
+
+    page = [
+        GetTicket.model_validate({"id": 1, "content": "<p>fine</p>"}),
+        GetTicket.model_validate({"id": 2, "content": "<p>poison</p>"}),
+        GetTicket.model_validate({"id": 3, "content": "<p>fine too</p>"}),
+    ]
+
+    assert [ticket.id for ticket in page] == [1, 2, 3]
+    assert page[0].content == "converted"
+    assert page[2].content == "converted"
+    with pytest.raises(RecursionError):
+        _ = page[1].content
+
+
+def test_a_body_too_deep_to_convert_no_longer_breaks_get_ticket() -> None:
+    """The end-to-end regression test for the bug behind all of this.
+
+    Around 494 levels of nesting exhausted the interpreter's stack inside
+    ``markdownify``. With the conversion in a ``BeforeValidator`` that
+    ``RecursionError`` came out of ``model_validate`` -- so out of
+    ``get_ticket``, from a library whose whole error surface is supposed to
+    derive from ``GlpiError``. Two changes had to land for this to pass:
+    the depth ceiling that degrades instead of recursing, and the move off
+    the validator so nothing converts before it is asked for.
+    """
+
+    deep = "<div>" * 600 + "the printer is offline" + "</div>" * 600
+
+    ticket = GetTicket.model_validate({"id": 42, "content": deep})
+
+    assert ticket.id == 42
+    assert ticket.content == "the printer is offline"
+
+
+def test_reading_content_off_a_write_model_still_works() -> None:
+    """Write models keep converting eagerly, and keep the field name.
+
+    The asymmetry is deliberate -- a caller's own Markdown is worth
+    checking where it was supplied, and there is no list path on a write
+    model to make lazy -- but ``.content`` has to read back the same way on
+    both, or the read-modify-write flow breaks.
+    """
+
+    ticket = PostTicket(content="The printer is **offline**.")
+
+    assert ticket.content == "The printer is **offline**."
+    assert "content" in PostTicket.model_fields
+    assert not hasattr(ticket, "content_html")

From 17ec37ac755596f17f5d8dd4183e894babe20fe0 Mon Sep 17 00:00:00 2001
From: baraline <antoine.guillaume45@gmail.com>
Date: Tue, 8 Sep 2026 09:22:20 +0200
Subject: [PATCH 03/14] chore(release): 0.5.0

Documents the content-conversion fix and the content_html rename, and
bumps the version everywhere the version-agreement test looks:
pyproject.toml, __version__ and the nine skill stamps.

0.4.3 is tagged and the field rename is breaking, so these notes get
their own minor version rather than being filed under a released
heading. The user guide gains a rich-text conversion section covering
where conversion happens, the depth ceiling and how to catch
GlpiContentError; the api reference documents the new exception and the
content helpers.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 CHANGELOG.md                                  | 146 ++++++++++++++++++
 README.md                                     |   6 +-
 docs/api_reference.rst                        |  59 ++++++-
 docs/development.md                           |  10 +-
 docs/user_guide.rst                           |  90 ++++++++++-
 glpi_python_client/__init__.py                |   2 +-
 pyproject.toml                                |   2 +-
 skills/glpi-client-setup/SKILL.md             |  17 +-
 skills/glpi-document-workflow/SKILL.md        |   2 +-
 skills/glpi-knowledge-base/SKILL.md           |   4 +-
 skills/glpi-plugin-fields/SKILL.md            |   4 +-
 skills/glpi-reporting-and-context/SKILL.md    |   4 +-
 skills/glpi-team-members/SKILL.md             |   2 +-
 skills/glpi-ticket-timeline/SKILL.md          |   5 +-
 skills/glpi-ticket-workflow/SKILL.md          |   6 +-
 .../glpi-user-location-provisioning/SKILL.md  |   2 +-
 16 files changed, 328 insertions(+), 33 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c6f1c90..9773acb 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,152 @@ All notable changes to this project are documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## 0.5.0 — 2026-09-08
+
+### Fixed
+
+- **Deeply nested HTML raised `RecursionError` while a model was being
+  validated.** `markdownify` walks the parsed document recursively and
+  spends about two CPython frames per nesting level, so roughly 494 levels
+  exhausted the default 1000-frame limit — measured, and the same 494
+  whether the nesting is `<div>`, `<p>`, `<blockquote>`, `<ul><li>` or
+  `<table><tr><td>`, which is what identifies the cost as per-level. An
+  unclosed tag counts too: `html.parser` does not auto-close `<p>` or
+  `<li>`, so `"<p>" * 5000` really is 5000 levels.
+
+  Because the converter was wired as a Pydantic `BeforeValidator`, the
+  failure landed inside `model_validate` — that is, inside `get_ticket` —
+  as a bare builtin from a library whose whole error surface is supposed
+  to derive from `GlpiError`.
+
+  `from_transport` now measures nesting first, with a flat non-recursive
+  O(n) scan, and past `MAX_HTML_DEPTH` (200) strips tags instead of
+  parsing. **It degrades, it never truncates, and it does not raise for
+  depth**: every character the converting path would have produced also
+  appears in the degraded rendering.
+
+  Both halves were fuzzed against the real parser over 15000 documents,
+  with zero under-counts, zero over-counts and zero text losses. Getting
+  there took several rules that are not the obvious ones:
+
+  - A closing tag pops by name or is ignored — `bs4` pops nothing when no
+    element of that name is open, so `"<div></p>" * 600` really is 600
+    deep where a naive counter says 1.
+  - An attribute value may contain `<` and `>`, so
+    `'<div title="</div>">' * 600` also measured 0 against a real 600
+    until the scan learned to skip quoted values.
+  - An unclosed tag counts, a childless node still occupies a level, and
+    a bogus comment swallows the tags inside it.
+  - The degraded path had to be measured against the converting path
+    construct by construct rather than reasoned about. Three answers came
+    back the opposite way round: a `<script>`/`<style>` body is *kept*
+    (`markdownify`'s `strip=` removes an element's markup and still walks
+    its children), so is a `CDATA` body, and so is the inside of any
+    `<!`/`<?` construct the parser could not resolve.
+
+  What the degraded rendering does not reproduce, none of it prose: link
+  targets and image alt text, fenced-block and `<pre>` indentation,
+  `&nbsp;`-padded alignment, and a processing instruction's `<?`/`>`
+  delimiters, which survive as literal text.
+
+  Character references are resolved by the parser's rule rather than by
+  `html.unescape`, which implements HTML5's longest-known-*prefix* rule
+  and would rewrite a pasted URL: `?a=1&copyright=2` becomes
+  `?a=1©right=2` under `unescape` and is left alone by the parser. A
+  semicolon-less reference resolves only when its whole name is known.
+
+  The ceiling is 200 rather than 492 because the budget is not 1000
+  frames, it is whatever is left of the stack when conversion starts, and
+  that belongs to the caller. Measured at the call site: 8 frames through
+  the synchronous client, 16 through the asynchronous one, 37 from twenty
+  nested awaits. The library's own contribution is negligible; an
+  application converting from inside a request handler or a recursive
+  walk is not. Converting a 200-level document peaks at a measured 403
+  frames, so it stays safe until the caller's own stack passes roughly
+  590 — and no document a human wrote nests 200 elements deep.
+
+  **`sys.setrecursionlimit` was considered and rejected.** It is
+  process-global state belonging to the application, not to a library the
+  application imported; and past what the C stack can hold it converts a
+  catchable `RecursionError` into a hard interpreter crash — on Windows,
+  an access violation with no traceback. It moves the cliff and makes
+  falling off it worse. The prohibition is asserted by
+  `testing/tests/test_raise_site_audit.py` rather than left as a comment
+  for the next person to weigh up again.
+
+- **`GlpiModel` now recognises validation aliases when it captures unknown
+  keys.** `_capture_unknown_fields` runs before Pydantic resolves aliases
+  and compared incoming keys against field *names* only, so an aliased key
+  was diverted into `extra_payload` before its field could see it — HTTP
+  200, no warning, and the value silently `None`. Latent until this
+  release, which introduces the package's first alias.
+
+### Added
+
+- **`GlpiContentError`** — a new `GlpiError` leaf for a rich-text body
+  that could not be converted, in either direction, with the underlying
+  fault attached as `__cause__`. Exported from the package root and
+  documented in the API reference.
+
+  Content conversion previously sat outside the taxonomy altogether: a
+  parser fault escaped `except GlpiError` and reached the caller as a bare
+  builtin. The depth ceiling above means no ordinary input gets here, so
+  this is the backstop — including for the outbound direction, where
+  `markdown` has its own cliff at around 500 levels of list indentation.
+
+  Unlike `GlpiStatusError`, `GlpiValidationError` and `GlpiProtocolError`
+  it does **not** inherit `ValueError`. Those three carry it for
+  compatibility with releases that raised bare `ValueError` at the same
+  sites; there was never a `ValueError` at a conversion site, and a parser
+  exhausting the stack is not a value the caller got wrong. Same reasoning
+  as `GlpiTransportError`.
+
+- **`content_html` on the read models**, holding the wire value verbatim:
+  `GetTicket`, `GetFollowup`, `GetTicketTask`, `GetSolution`,
+  `GetKBArticleRevision`, and `GetKBArticle` (which also gains
+  `description_html`).
+
+### Changed (breaking)
+
+- **Read models convert to Markdown on first access instead of during
+  validation.** `content` is now a `functools.cached_property` over
+  `content_html`:
+
+  ```python
+  ticket = client.get_ticket(42)
+  ticket.content_html   # '<p>Printer is <strong>offline</strong></p>'
+  ticket.content        # 'Printer is **offline**'  (converted here, once)
+  ```
+
+  **Callers that read `.content` need no change.** The field carries the
+  validation alias `content`, so a GLPI payload and a hand-written
+  `GetTicket(content=...)` both still populate it, and `.content` still
+  returns Markdown. What changes is *when*.
+
+  Two things follow. A caller who wants only `id` and `date_mod` no longer
+  pays HTML-to-Markdown on every record of every page. And a body that
+  cannot be converted no longer takes its page-mates with it:
+  `TransportMixin._resource_list` builds every item of a page in one
+  comprehension, so one unconvertible record used to make the whole page
+  unreadable — the failure is now scoped to the record whose body is
+  actually read.
+
+  Write models (`Post*`, `Patch*`) are deliberately unchanged: they keep
+  the plain `content` field and convert eagerly, so a caller's own
+  Markdown is still checked where it was supplied, and there is no list
+  path on a write model to make lazy.
+
+  What does break: `content` is no longer in `GetTicket.model_fields`, and
+  `GetTicket(...).model_dump()` emits `content_html` holding HTML where it
+  used to emit `content` holding Markdown (`by_alias=True` gives a dump
+  keyed the way GLPI keys it).
+
+  One sharp edge comes with the cache. Assigning to `content_html` after
+  `.content` has been read leaves the stale Markdown in place, and so does
+  `model_copy(update={"content_html": ...})` — and neither equality,
+  `repr` nor any `model_dump` reveals it. Treat a read model as immutable
+  once validated, or rebuild it through `model_validate`.
+
 ## 0.4.3 — 2026-08-13
 
 ### Changed (breaking)
diff --git a/README.md b/README.md
index 188d330..d4a2d41 100644
--- a/README.md
+++ b/README.md
@@ -12,7 +12,11 @@ The goal is to let GLPI integrations work with domain objects instead of raw
 JSON payloads. The package exposes Pydantic models for tickets, users,
 followups, documents, locations, and related records, while converting GLPI
 HTML content into Markdown for Python-side workflows and rendering Markdown
-back to HTML for outgoing payloads.
+back to HTML for outgoing payloads. On a response model that conversion is
+lazy — `.content` converts on first read and caches, so listing records
+costs nothing per body — and it degrades to plain text rather than failing
+on pathologically nested HTML. See
+[Rich-text content](https://glpi-python-client.readthedocs.io/en/latest/user_guide.html#content-conversion).
 
 It currently focuses on ticket-centric workflows and exposes two high-level
 clients built on top of the GLPI v2 REST API:
diff --git a/docs/api_reference.rst b/docs/api_reference.rst
index 61ab4af..31af3a5 100644
--- a/docs/api_reference.rst
+++ b/docs/api_reference.rst
@@ -27,11 +27,13 @@ from it, so neither wraps the other and the two cannot drift apart.
 Exceptions
 ----------
 
-Exceptions raised for a bad argument, an unexpected HTTP status, or an
-unusable response body derive from :class:`GlpiError`.
-:class:`GlpiStatusError`, :class:`GlpiValidationError` and
-:class:`GlpiProtocolError` also inherit :class:`ValueError` for backwards
-compatibility with releases that raised bare ``ValueError``.
+Exceptions raised for a bad argument, an unexpected HTTP status, an
+unusable response body, or content that cannot be converted derive from
+:class:`GlpiError`. :class:`GlpiStatusError`, :class:`GlpiValidationError`
+and :class:`GlpiProtocolError` also inherit :class:`ValueError` for
+backwards compatibility with releases that raised bare ``ValueError``;
+:class:`GlpiContentError` and :class:`GlpiTransportError` do not, because
+nothing was passed in wrongly in either case.
 
 Network-level faults (connection failures, DNS errors, timeouts) are
 raised as :class:`GlpiTransportError`, or its :class:`GlpiTimeoutError`
@@ -80,6 +82,53 @@ guide for the full picture, including which methods raise which type.
    :members:
    :show-inheritance:
 
+.. autoexception:: GlpiContentError
+   :members:
+   :show-inheritance:
+
+Rich-text content
+-----------------
+
+GLPI exchanges ticket, followup, task, solution and knowledge-base bodies
+as HTML. The package's surface is Markdown in both directions, but the two
+directions work differently, and the difference is visible.
+
+A **write** model (``Post*``, ``Patch*``) takes Markdown in ``content`` and
+renders it to HTML when the request is built. Nothing to think about.
+
+A **read** model (``Get*``) keeps two views of the same body:
+
+``content_html``
+   what GLPI sent, verbatim. Also accepts the wire spelling ``content`` on
+   construction.
+
+``content``
+   the same body as Markdown, converted on the first read and cached.
+   :class:`GetKBArticle` has ``description`` / ``description_html`` as
+   well.
+
+Reading ``.content`` is what a caller wants and what earlier releases
+returned, so no read-side code needs changing. What changed is *when* the
+conversion happens, which buys two things: listing records costs nothing
+per body, and a body that cannot be converted no longer stops the rest of
+its page being read.
+
+Very deeply nested HTML is the case worth knowing about.
+``markdownify`` walks the document recursively and runs out of stack at
+around 494 levels of nesting, so past
+:data:`glpi_python_client.content.conversion.MAX_HTML_DEPTH` (200) the
+converter strips tags instead of parsing. It degrades, it never
+truncates, and it does not raise: every character the normal rendering
+would have produced still appears. What is lost is structure rather than
+words — link targets and image alt text, code fencing and ``<pre>``
+indentation, ``&nbsp;`` alignment. Anything else that goes wrong in
+either direction raises :class:`GlpiContentError`.
+
+Because the conversion is cached on first read, a read model should be
+treated as immutable afterwards: assigning to ``content_html``, or
+``model_copy(update={"content_html": ...})``, leaves the cached Markdown
+in place. Rebuild through ``model_validate`` if you need to change it.
+
 Aggregated Models
 -----------------
 
diff --git a/docs/development.md b/docs/development.md
index c4346c6..287e227 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -82,7 +82,15 @@ python -m pytest
 - `glpi_python_client.models` contains typed request and response
   models.
 - `glpi_python_client.content` handles HTML/Markdown conversion for
-  ticket descriptions, followups, tasks, and solutions.
+  ticket descriptions, followups, tasks, solutions, knowledge-base
+  articles (`content` and `description`) and article revisions. It is
+  wired into the models by `models/api_schema/_content.py`, eagerly on
+  the write models and through a cached property on the read ones.
+  Inbound HTML nested past `MAX_HTML_DEPTH` is tag-stripped rather than
+  parsed, because `markdownify` recurses per nesting level; that
+  constant carries the derivation, and the rejected alternative
+  (`sys.setrecursionlimit`) beside it. The prohibition is enforced by
+  `testing/tests/test_raise_site_audit.py`, not just written down.
 - `glpi_python_client.testing` exposes `make_client` and
   `make_async_client` factories that produce in-memory clients with no
   real HTTP plumbing for downstream test suites, plus the shared
diff --git a/docs/user_guide.rst b/docs/user_guide.rst
index dd918b0..de87416 100644
--- a/docs/user_guide.rst
+++ b/docs/user_guide.rst
@@ -586,7 +586,11 @@ Knowledge base
 The knowledge base mixins map to ``/Knowledgebase``. Articles and
 categories expose the ``search_ / get_ / create_ / update_ / delete_``
 shape; comments are nested under an article; revisions are read-only.
-Article ``content`` and ``description`` accept and return Markdown. An
+Article ``content`` and ``description`` accept and return Markdown; on
+:class:`~glpi_python_client.GetKBArticle` they are properties over
+``content_html`` and ``description_html``, converted on first read -- see
+:ref:`content-conversion`, which matters here because searching the
+knowledge base returns whole article bodies. An
 article's ``categories`` association is read-only in the v2 GLPI contract,
 so the client sets it through a legacy fallback — see
 `Assigning categories`_.
@@ -1429,9 +1433,9 @@ Example output::
 -----------------
 
 Exceptions the client raises for a bad argument, an unexpected HTTP
-status, or an unusable response body derive from
-:class:`~glpi_python_client.GlpiError`, so one handler covers that part
-of the library surface:
+status, an unusable response body, or content it cannot convert derive
+from :class:`~glpi_python_client.GlpiError`, so one handler covers that
+part of the library surface:
 
 .. code-block:: python
 
@@ -1474,15 +1478,17 @@ The hierarchy lets you narrow as far as you need:
 .. code-block:: text
 
    GlpiError
-   ├── GlpiTransportError      reserved for the httpx transport swap;
-   │   └── GlpiTimeoutError    not raised yet -- see the note above
+   ├── GlpiTransportError      the request never produced a response
+   │   └── GlpiTimeoutError    GLPI was too slow
    ├── GlpiStatusError         GLPI answered with an unexpected status
    │   ├── GlpiAuthError       401 / 403
    │   ├── GlpiNotFoundError   404
    │   └── GlpiServerError     5xx (retried up to 3 attempts before it
    │                           reaches you)
    ├── GlpiValidationError     the client rejected your argument
-   └── GlpiProtocolError       GLPI answered 2xx with an unusable body
+   ├── GlpiProtocolError       GLPI answered 2xx with an unusable body
+   └── GlpiContentError        a rich-text body could not be converted
+                               between HTML and Markdown
 
 :class:`~glpi_python_client.GlpiStatusError` carries the diagnostics you
 usually want:
@@ -1505,6 +1511,74 @@ usually want:
    :class:`~glpi_python_client.GlpiProtocolError` also inherit
    :class:`ValueError`. Code written against earlier releases, which
    raised bare ``ValueError``, keeps working unchanged.
+   :class:`~glpi_python_client.GlpiContentError` and
+   :class:`~glpi_python_client.GlpiTransportError` do not inherit it:
+   there was never a bare ``ValueError`` at either kind of site, and
+   neither is a value the caller got wrong.
+
+.. _content-conversion:
+
+Rich-text content: Markdown in, Markdown out
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Ticket, followup, task, solution and knowledge-base bodies travel to GLPI
+as HTML. You work in Markdown in both directions and the package handles
+the translation, but the two directions are not symmetric and the
+difference shows up in the field names.
+
+Writing is the simple half: give ``content`` Markdown and it is rendered
+to HTML when the request is built.
+
+Reading gives you two views of the same body:
+
+.. code-block:: python
+
+   ticket = client.get_ticket(42)
+
+   ticket.content_html  # '<p>The printer is <strong>offline</strong>.</p>'
+   ticket.content       # 'The printer is **offline**.'
+
+``.content`` is what you want and what earlier releases gave you, so
+read-side code needs no change. What changed is *when* the conversion
+runs: on the first read of ``.content``, cached afterwards, rather than
+while the model is being built. Two things follow.
+
+Listing records is cheap. ``client.search_tickets()`` used to convert
+every body on the page whether or not you looked at one; now a search
+that only reads ``id`` and ``date_mod`` converts nothing at all.
+
+A body that cannot be converted no longer takes its page down with it.
+The whole page is built in one pass, so a single unconvertible record used
+to make its page-mates unreadable too. The failure is now scoped to the
+record whose body you actually read.
+
+.. note::
+
+   Deeply nested HTML is the case worth knowing about. The HTML-to-Markdown
+   converter walks the document recursively and exhausts the interpreter's
+   stack at around 494 levels of nesting. Past
+   :data:`~glpi_python_client.content.conversion.MAX_HTML_DEPTH` (200,
+   chosen to leave the rest of the stack for your code) ``.content``
+   strips the tags rather than parsing them. **It degrades, it never
+   truncates, and it does not raise**: every character the normal
+   rendering would have produced still appears, so a body never says less
+   because of how deeply it happened to nest. What you lose is structure,
+   not words — link targets and image alt text, code-block fencing and
+   ``<pre>`` indentation, and ``&nbsp;``-padded alignment. Anything else
+   that goes wrong raises
+   :class:`~glpi_python_client.GlpiContentError`.
+
+   Because the result is cached on first read, treat a read model as
+   immutable afterwards. Assigning to ``content_html`` -- or
+   ``model_copy(update={"content_html": ...})`` -- leaves the cached
+   Markdown in place, and nothing in ``repr``, ``==`` or ``model_dump``
+   will tell you. Rebuild through ``model_validate`` instead.
+
+Two smaller consequences, if you are upgrading from 0.4.x: ``content`` is
+no longer in ``GetTicket.model_fields``, and ``GetTicket(...).model_dump()``
+emits ``content_html`` holding HTML where it used to emit ``content``
+holding Markdown. Pass ``by_alias=True`` for a dump keyed the way GLPI
+keys it.
 
 Retry behaviour
 ~~~~~~~~~~~~~~~
@@ -1533,4 +1607,4 @@ most 2 POST requests.
 
 Search methods are deliberately tolerant: ``search_tickets`` and its
 siblings return an empty list rather than raising when GLPI rejects the
-query. Methods that fetch or mutate one specific record always raise.
\ No newline at end of file
+query. Methods that fetch or mutate one specific record always raise.
diff --git a/glpi_python_client/__init__.py b/glpi_python_client/__init__.py
index 2e1d48c..508acad 100644
--- a/glpi_python_client/__init__.py
+++ b/glpi_python_client/__init__.py
@@ -110,7 +110,7 @@
     date_window,
 )
 
-__version__ = "0.4.3"
+__version__ = "0.5.0"
 
 __all__ = [
     "AsyncGlpiClient",
diff --git a/pyproject.toml b/pyproject.toml
index 66835b9..b43c7a3 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -35,7 +35,7 @@ exclude = [
 
 [project]
 name = "glpi-python-client"
-version = "0.4.3"
+version = "0.5.0"
 description = "A typed Python client for GLPI ITSM APIs."
 readme = "README.md"
 requires-python = ">=3.10"
diff --git a/skills/glpi-client-setup/SKILL.md b/skills/glpi-client-setup/SKILL.md
index aef3468..0e2598f 100644
--- a/skills/glpi-client-setup/SKILL.md
+++ b/skills/glpi-client-setup/SKILL.md
@@ -5,7 +5,7 @@ license: MIT
 compatibility: "Requires Python 3.10+, glpi-python-client, network access to a GLPI v2 API, and valid GLPI credentials."
 metadata:
   package: glpi-python-client
-  version: "0.4.3"
+  version: "0.5.0"
 ---
 
 # GLPI Client Setup
@@ -197,9 +197,18 @@ with GlpiClient.from_env(
   raise `GlpiAuthError` (401/403), `GlpiNotFoundError` (404),
   `GlpiServerError` (persistent 5xx),
   `GlpiTransportError`/`GlpiTimeoutError` (network fault) or
-  `GlpiProtocolError` (unusable 2xx body). Do not catch `requests`
-  exceptions — `requests` is not a dependency — and do not catch
-  `tenacity.RetryError`; the retry decorators re-raise the real error.
+  `GlpiProtocolError` (unusable 2xx body). Reading a rich-text body that
+  cannot be converted raises `GlpiContentError` — note that this comes
+  from the attribute read (`ticket.content`), not from the call that
+  fetched the record, because response models convert on first read. Do
+  not catch `requests` exceptions — `requests` is not a dependency — and
+  do not catch `tenacity.RetryError`; the retry decorators re-raise the
+  real error.
+- `GlpiContentError` and `GlpiTransportError` are the two leaves that do
+  **not** also inherit `ValueError`; `GlpiStatusError`,
+  `GlpiValidationError` and `GlpiProtocolError` do, for compatibility
+  with releases that raised bare `ValueError`. So `except ValueError:`
+  catches most of the hierarchy but not all of it — catch `GlpiError`.
 - A small set of raise sites is deliberately **outside** that hierarchy,
   so `except GlpiError:` will not catch them. Plain `RuntimeError`:
   using a closed client; a v1-backed call on a client built without
diff --git a/skills/glpi-document-workflow/SKILL.md b/skills/glpi-document-workflow/SKILL.md
index bb93d36..4fe0272 100644
--- a/skills/glpi-document-workflow/SKILL.md
+++ b/skills/glpi-document-workflow/SKILL.md
@@ -5,7 +5,7 @@ license: MIT
 compatibility: "Requires Python 3.10+, glpi-python-client, network access to the GLPI v2 API, and v1 credentials configured on the client for binary uploads."
 metadata:
   package: glpi-python-client
-  version: "0.4.3"
+  version: "0.5.0"
 ---
 
 # GLPI Document Workflow
diff --git a/skills/glpi-knowledge-base/SKILL.md b/skills/glpi-knowledge-base/SKILL.md
index 43bd1dc..402caf7 100644
--- a/skills/glpi-knowledge-base/SKILL.md
+++ b/skills/glpi-knowledge-base/SKILL.md
@@ -5,7 +5,7 @@ license: MIT
 compatibility: "Requires Python 3.10+, glpi-python-client, network access to the GLPI v2 API, and — for category writes only — a legacy v1 session (v1_base_url + v1_user_token)."
 metadata:
   package: glpi-python-client
-  version: "0.4.3"
+  version: "0.5.0"
 ---
 
 # GLPI Knowledge Base
@@ -164,6 +164,8 @@ await client.delete_kb_article(42, force=True)
 - `language` has two different mechanics in this family. On `search_kb_articles`/`search_kb_categories` it is a **query parameter**. On `list_kb_article_revisions`/`get_kb_article_revision` it is a **path segment** between the id and `Revision` (`Knowledgebase/Article/5/fr_FR/Revision`). `get_kb_article`, the comment helpers and every write helper take no `language` at all; they inherit the client-level value, sent as `Accept-Language` (default `en_GB`).
 - KB write models use `IdNameRef` for every foreign key -- `categories[]`, `entity`, `user`, `parent` -- not `IdRef`. Passing `IdRef(id=4)` raises a pydantic `ValidationError`. (`GetKBArticleComment.parent` is the one KB field genuinely typed `IdRef`, and it is read-only.)
 - Article `content`/`description` and revision `content` are Markdown on the Python side and HTML on the wire; the conversion is automatic, so never author HTML. Comment `comment` is a plain `str` with no conversion at all -- the inconsistency is real, not an omission here.
+- On the **read** models the conversion is lazy. `GetKBArticle` stores `content_html`/`description_html` (the server's HTML verbatim, also accepting the wire spellings `content`/`description` on construction) and exposes `content`/`description` as cached properties that convert on first read; `GetKBArticleRevision` is the same with `content_html`. Reading `.content` is unchanged, but `search_kb_articles` and `list_kb_article_revisions` now convert nothing until a body is read -- which matters most here, because article search returns whole bodies and revision history returns every past one. Write models (`PostKBArticle`/`PatchKBArticle`) still convert eagerly and keep the plain `content`/`description` field names.
+- HTML nested past `MAX_HTML_DEPTH` (200) is **stripped to text instead of converted** -- every character the normal rendering would have produced, none of the Markdown structure, and no exception. Any other conversion failure raises `GlpiContentError`, from the `.content` read rather than from the search call.
 - `force` on `delete_kb_article`, `delete_kb_category` and `delete_kb_article_comment` is keyword-only and is serialised into the JSON request **body** via the matching `Delete*` model, not sent as a query parameter. `force=True` deletes permanently; omitting it or passing `False` moves the record to the GLPI trash.
 - Revisions are read-only: there is no create/update/delete helper and no Post/Patch/Delete revision model. A revision appears as a side effect of updating an article. `get_kb_article_revision(article_id, revision)` takes the revision **number** (`GetKBArticleRevision.revision`), not the row `id` -- the two differ on the model.
 - `GetKBArticle.revisions` and `.translations` hold two *different* private ref classes (leading underscore, not exported from the package root). Read their attributes; never import them. The two field sets are not interchangeable: a `revisions` entry has `.id`, `.revision`, `.language`, `.date`, while a `translations` entry has `.id`, `.language`, `.name`. `revisions[0].name` raises `AttributeError` -- the models allow unknown keys from the server, but that does not synthesise an attribute that was never sent.
diff --git a/skills/glpi-plugin-fields/SKILL.md b/skills/glpi-plugin-fields/SKILL.md
index f3bdcdb..fa42aa3 100644
--- a/skills/glpi-plugin-fields/SKILL.md
+++ b/skills/glpi-plugin-fields/SKILL.md
@@ -5,7 +5,7 @@ license: MIT
 compatibility: "Requires Python 3.10+, glpi-python-client, the GLPI Fields plugin installed server-side, and a legacy v1 session (v1_base_url + v1_user_token) — every method in this family goes over the v1 API."
 metadata:
   package: glpi-python-client
-  version: "0.4.3"
+  version: "0.5.0"
 ---
 
 # GLPI Plugin Fields
@@ -191,7 +191,7 @@ async def upsert_plugin_field_row(
 - A container that has never had a value saved for that ticket is **silently absent** from the `get_ticket_custom_fields` result -- you do not get `{"container": {}}`. Use `result.get(name, {})`, never `result[name]`. An empty overall dict is **ambiguous**: `get_ticket_custom_fields` builds its result by skipping every container with no persisted row, so `{}` comes back both when the instance declares no Ticket containers at all and when it declares several but this ticket has saved nothing in any of them. The return value cannot tell you which -- call `list_plugin_fields_containers(itemtype="Ticket")` if you need to know.
 - Both discovery listings fetch **one fixed page, `range=0-999`**, with no pagination and no server-side filtering. The `itemtype` and `container_id` narrowing happens client-side *after* that cap, so an instance with more than 1000 containers or field declarations silently loses the tail -- possibly including the container you are looking for.
 - Neither listing filters on `is_active`, so **disabled containers and disabled or read-only fields come back from discovery looking exactly like live ones**. `set_ticket_custom_fields` accepts a field whose `is_readonly` is `True`, because its guard only checks that the name is declared. Check `container.is_active`, `field.is_active` and `field.is_readonly` yourself.
-- Values are transmitted **verbatim -- there is no HTML/Markdown conversion on this path**, unlike ticket and KB article content. A `richtext` field takes raw HTML (`"<p>test</p>"`). Convert yourself if you want Markdown: `GlpiContentConverter` is not exported from the package root, import it from `glpi_python_client.content`.
+- Values are transmitted **verbatim -- there is no HTML/Markdown conversion on this path**, unlike ticket and KB article content. A `richtext` field takes raw HTML (`"<p>test</p>"`). Convert yourself if you want Markdown: `GlpiContentConverter` is not exported from the package root, import it from `glpi_python_client.content`. Calling it directly puts you on the same two rules the models get: HTML nested past `MAX_HTML_DEPTH` (200) comes back **tag-stripped rather than converted** (every character the normal rendering would have produced, none of the structure, no exception), and any other failure raises `GlpiContentError`.
 - The two convenience helpers are **Ticket-only** -- the itemtype is hardcoded. There is no `get_item_custom_fields` and no `set_item_custom_fields`. For Computer, Problem, Change and the rest, drive the generic row helpers.
 - Parameter-passing style is inconsistent across the family, and only one half of it is a rule. `list_item_plugin_field_rows(itemtype, items_id, container_name)` declares ordinary `POSITIONAL_OR_KEYWORD` parameters, so both `("Ticket", 1234, "extrainfo")` and `(itemtype="Ticket", items_id=1234, container_name="extrainfo")` are legal -- the examples above pass them positionally by choice, not by requirement. `create_item_plugin_field_row` and `update_item_plugin_field_row` are genuinely **keyword-only** (`*` in the signature): calling either writer positionally is a `TypeError`.
 - Error taxonomy on the write path: an unknown container name or an unknown field name raises `GlpiValidationError`; a container the server returned without an `id`, or a create whose v1 reply carries no numeric row id, raises `GlpiProtocolError`. Both inherit `ValueError`. A missing v1 session raises a plain `RuntimeError`, and a non-success v1 status raises `GlpiStatusError` (with `.status_code`, `.url` and `.response_text`).
diff --git a/skills/glpi-reporting-and-context/SKILL.md b/skills/glpi-reporting-and-context/SKILL.md
index 6a1055c..427d595 100644
--- a/skills/glpi-reporting-and-context/SKILL.md
+++ b/skills/glpi-reporting-and-context/SKILL.md
@@ -5,7 +5,7 @@ license: MIT
 compatibility: "Requires Python 3.10+, glpi-python-client, network access to the GLPI v2 API, and credentials allowed to read tickets, tasks, users, entities, and timeline records."
 metadata:
   package: glpi-python-client
-  version: "0.4.3"
+  version: "0.5.0"
 ---
 
 # GLPI Reporting And Context
@@ -25,7 +25,7 @@ Returned identifiers are raw GLPI numeric values; resolve them with the appropri
 ## Procedure
 
 1. Create a client (`GlpiClient` or `AsyncGlpiClient`) with the correct entity/profile scope.
-2. For one ticket, call `await client.get_ticket_context(ticket_id)` and read `bundle.ticket`, `bundle.tasks`, `bundle.followups`, `bundle.solutions`, and `bundle.documents`. To render the whole bundle as one Markdown transcript (ticket title, subtitle metadata, description, chronologically sorted timeline, linked documents), call `bundle.to_markdown()`. Pass a `TicketMarkdownOptions` to drop sections or metadata, e.g. `bundle.to_markdown(TicketMarkdownOptions(include_documents=False, show_dates=False))`; all 17 flags default to `True`, so a bare `to_markdown()` emits everything. Both `GlpiTicketContext` and `TicketMarkdownOptions` are exported from `glpi_python_client`.
+2. For one ticket, call `await client.get_ticket_context(ticket_id)` and read `bundle.ticket`, `bundle.tasks`, `bundle.followups`, `bundle.solutions`, and `bundle.documents`. To render the whole bundle as one Markdown transcript (ticket title, subtitle metadata, description, chronologically sorted timeline, linked documents), call `bundle.to_markdown()`. Pass a `TicketMarkdownOptions` to drop sections or metadata, e.g. `bundle.to_markdown(TicketMarkdownOptions(include_documents=False, show_dates=False))`; all 17 flags default to `True`, so a bare `to_markdown()` emits everything. Both `GlpiTicketContext` and `TicketMarkdownOptions` are exported from `glpi_python_client`. Note that `to_markdown()` is where the bodies are actually converted from GLPI's HTML — the read models convert on first read — so it is the call that pays for that and the call a `GlpiContentError` would surface from, not `get_ticket_context`.
 3. For ticket counts, call `await client.get_ticket_statistics(start_date=..., end_date=..., default_days=..., entity_id=..., entity_name=..., extra_filter=...)`. All keyword arguments are optional; the default window is the last 30 days ending today.
 4. For task duration totals on a known ticket list, call `await client.get_task_statistics(ticket_ids)`. For an end-to-end "duration over a window with filters" report, call `await client.get_task_durations(...)` instead; it gathers the ticket IDs internally.
 5. For a per-user activity report, call `await client.get_user_activity(username=..., start_date=..., end_date=...)`. Supply at least one of `user_id`, `username`, `realname`, `firstname`.
diff --git a/skills/glpi-team-members/SKILL.md b/skills/glpi-team-members/SKILL.md
index bfcc1db..7f1a070 100644
--- a/skills/glpi-team-members/SKILL.md
+++ b/skills/glpi-team-members/SKILL.md
@@ -5,7 +5,7 @@ license: MIT
 compatibility: "Requires Python 3.10+, glpi-python-client, network access to the GLPI v2 API, and credentials allowed to manage ticket teams."
 metadata:
   package: glpi-python-client
-  version: "0.4.3"
+  version: "0.5.0"
 ---
 
 # GLPI Team Members
diff --git a/skills/glpi-ticket-timeline/SKILL.md b/skills/glpi-ticket-timeline/SKILL.md
index bb59cf1..965a74a 100644
--- a/skills/glpi-ticket-timeline/SKILL.md
+++ b/skills/glpi-ticket-timeline/SKILL.md
@@ -5,7 +5,7 @@ license: MIT
 compatibility: "Requires Python 3.10+, glpi-python-client, and network access to the GLPI v2 API."
 metadata:
   package: glpi-python-client
-  version: "0.4.3"
+  version: "0.5.0"
 ---
 
 # GLPI Ticket Timeline
@@ -119,6 +119,7 @@ await client.update_ticket_timeline_document(
 - The live GLPI v2 server returns each timeline list entry wrapped in `{"type": ..., "item": {...}}` even though the OpenAPI contract documents a flat array. The client unwraps that envelope transparently for the four `list_*` helpers; you receive plain `Get<Entity>` instances. For the document family that entity is `GetDocument` -- the full `/Management/Document` record with `filename`, `mime`, `filepath`, `sha1sum` -- and not `GetTimelineDocument`, which is exported from the package root but is never returned by any client method. `get_ticket_timeline_document` returns `GetDocument` for the same reason. The other three are `list_ticket_followups` -> `GetFollowup`, `list_ticket_tasks` -> `GetTicketTask`, `list_ticket_solutions` -> `GetSolution`.
 - `create_*` methods return new identifiers as plain `int`. `update_*` and `delete_*`/`unlink_*` return `None`.
 - Three enums carry this family's value vocabularies, all exported from `glpi_python_client` and all subclasses of `GlpiEnum` (itself an `IntEnum`, so a member serialises as its number and compares equal to one): `GlpiTaskState` on `PostTicketTask.state`/`PatchTicketTask.state` (`INFORMATION = 0`, `TODO = 1`, `DONE = 2` -- note `INFORMATION` is `0`, so `if task.state:` is false for it; test against `None`), `GlpiSolutionStatus` on `PostSolution.status`/`PatchSolution.status` (`NONE = 1`, `WAITING = 2`, `ACCEPTED = 3`, `REFUSED = 4`), and `GlpiTimelinePosition` on `timeline_position` (`INVALID = -1`, `NONE = 0`, `LEFT = 1`, `RIGHT = 2`, `LEFT_BIG = 3`, `RIGHT_BIG = 4`), which the followup, task and document models carry -- the solution models do not have the field at all.
-- Timeline `content` fields are Markdown on the Python side, not HTML. `PostFollowup`/`PostTicketTask`/`PostSolution` render Markdown to GLPI's HTML on serialisation, and `GetFollowup`/`GetTicketTask`/`GetSolution` convert the server's HTML back to Markdown on validation -- so `record.content` is always Markdown (`GetFollowup(content="<p>Hello <strong>world</strong></p>").content == "Hello **world**"`). Authoring raw HTML is not an error but is round-tripped through the Markdown converter and can be reshaped; write Markdown.
+- Timeline `content` fields are Markdown on the Python side, not HTML. `PostFollowup`/`PostTicketTask`/`PostSolution` render Markdown to GLPI's HTML on serialisation. On `GetFollowup`/`GetTicketTask`/`GetSolution` the field is `content_html` -- the server's HTML verbatim -- and `content` is a cached property that converts it on **first read**, not on validation (`GetFollowup(content="<p>Hello <strong>world</strong></p>").content == "Hello **world**"` still holds; the wire spelling `content` is accepted as a validation alias). So `record.content` is always Markdown, but `list_ticket_followups` converts nothing until you read a body, and a body that cannot be converted no longer breaks the whole list. Authoring raw HTML on a write model is not an error but is round-tripped through the Markdown converter and can be reshaped; write Markdown.
+- HTML nested past `MAX_HTML_DEPTH` (200) is **stripped to text instead of converted**: `markdownify` recurses per level and dies around 494. Every character the normal rendering would have produced still appears, but structure does not: link targets, image alt text and code fencing are gone. Nothing raises. Any other conversion failure raises `GlpiContentError` -- from the `.content` read, not from the `list_*` call. Note that `GlpiTicketContext.to_markdown()` is usually the first thing to read every body, so it is where such an error surfaces.
 - Extra server fields (e.g. plugin keys) flow into `record.extra_payload` rather than raising.
 - `delete_ticket_*` and `unlink_ticket_timeline_document` accept a keyword-only `force` parameter; pass `force=True` to permanently delete.
\ No newline at end of file
diff --git a/skills/glpi-ticket-workflow/SKILL.md b/skills/glpi-ticket-workflow/SKILL.md
index fa1b317..b0599d0 100644
--- a/skills/glpi-ticket-workflow/SKILL.md
+++ b/skills/glpi-ticket-workflow/SKILL.md
@@ -5,7 +5,7 @@ license: MIT
 compatibility: "Requires Python 3.10+, glpi-python-client, network access to the GLPI v2 API, and credentials accepted by GlpiClient."
 metadata:
   package: glpi-python-client
-  version: "0.4.3"
+  version: "0.5.0"
 ---
 
 # GLPI Ticket Workflow
@@ -30,7 +30,7 @@ Search open tickets:
 tickets = await client.search_tickets("is_deleted==false;status==1", limit=20)  # v2 search returns trashed tickets unless `is_deleted` is pinned
 ```
 
-Create a ticket. Content fields accept Markdown and are converted to GLPI's HTML transport format transparently:
+Create a ticket. Content fields accept Markdown and are converted to GLPI's HTML transport format transparently (reading is the mirror image but lazy — see the `content_html` note below):
 
 ```python
 from glpi_python_client import PostTicket
@@ -73,6 +73,8 @@ ticket = PostTicket(
 - `search_tickets` accepts a raw RSQL filter string; pagination is via the keyword-only `limit` and `start` (it also takes `sort` and `fields`). To walk a whole result set use the batch iterator `iter_search_tickets(rsql_filter, batch_size=50, sort=..., fields=...)`, which advances `start` itself and yields one `list[GetTicket]` page per step, stopping when a page comes back shorter than `batch_size` — `async for batch in client.iter_search_tickets(...)` on `AsyncGlpiClient`, `for batch in client.iter_search_tickets(...)` on `GlpiClient`.
 - **`search_tickets` and every other `search_*` raise `GlpiStatusError` on a 4xx.** This changed: they used to check the response status only when the caller passed a `failure_message`, which none of the seven `search_*` helpers does, so a GLPI error body was coerced to `[]` and a malformed RSQL filter, a 403, a missing route and a genuinely empty result set were indistinguishable. `_resource_list` now checks the status on every call, so **an empty list means the server said the result set is empty**. The iterators inherit that: a 4xx raises instead of making the first page short and ending the walk silently. Note the *other* fail-open path is unchanged and still bites -- GLPI v2 ignores a filter field it does not recognise and answers 200 with the whole unfiltered table, so a filter that returns rows is still not proof it was applied.
 - `create_ticket` returns the new ticket ID. `update_ticket` and `delete_ticket` return `None`.
+- **`GetTicket` has no `content` field; it has `content_html` and a `content` property.** `content_html` holds the server's HTML verbatim (and accepts the wire spelling `content` on construction); `content` is a cached property that converts it to Markdown on **first read**, not on validation. Reading `ticket.content` is unchanged and still gives Markdown, so read-side code needs no edit — but `search_tickets` now converts nothing until a body is read, and a body that cannot be converted no longer breaks the rest of the page. Two things do change if you were relying on them: `"content" not in GetTicket.model_fields`, and `GetTicket(...).model_dump()` emits `content_html` with HTML where it used to emit `content` with Markdown (`by_alias=True` gives you the GLPI key). `PostTicket`/`PatchTicket` are untouched: plain `content` field, converted eagerly.
+- HTML nested past `MAX_HTML_DEPTH` (200, in `glpi_python_client.content.conversion`) is **stripped to text rather than converted** — `markdownify` recurses about twice per nesting level and dies around 494. It degrades rather than truncating — every character the normal rendering would have produced still appears — but structure does not survive: link targets, image alt text, code fencing and `<pre>` indentation are gone. Anything else that goes wrong converting a body raises `GlpiContentError`, from the attribute read rather than from `get_ticket`. Treat a fetched ticket as immutable afterwards: the conversion is cached, so assigning to `content_html` (or `model_copy(update={"content_html": ...})`) leaves stale Markdown on `.content` with nothing in `repr`, `==` or `model_dump` to show it.
 - The GLPI server is the authoritative validator. Extra keys returned by the server flow into `ticket.extra_payload` rather than raising. Caller-provided `extra_payload` keys win on conflicts.
 - **`status` is writable, on `PatchTicket` only.** `client.update_ticket(tid, PatchTicket(status=GlpiTicketStatus.PENDING))` moves the ticket. This corrects an earlier claim in this skill that the field was read-only: GLPI's own contract publishes `Ticket.status.id` as `readOnly: true`, and that is simply wrong — a live GLPI 11 instance honours the `PATCH`. The same contract omits the `Major` level from `priority`, so treat it as a hint, not an authority. Two things it does *not* cover: `POST` **ignores** `status` (201, then the ticket reads back as `New`), which is why the field is declared on `PatchTicket` and not on `PostTicket`; and `status_id` is silently dropped, so use `status`. Posting a solution still moves the ticket to `SOLVED` on its own and remains the better call when there is a resolution to record — a bare status change leaves no trace of why.
 - **Key on `status.id`, never on `status.name`.** The id set is hardcoded in GLPI's core — there is no `TicketStatus` itemtype (the v1 API answers 400 for it, while `ITILCategory` and `RequestType` return instance rows), and `listSearchOptions` reports `status` as `{"table": "glpi_tickets", "datatype": "specific"}`, i.e. a column of the tickets table rather than a foreign key into a configurable one. An administrator cannot add or rename a status. The **labels** are another matter: they are translations, so the same id reads back as `"Nouveau"` on a French instance and `"New"` on an English one. The ids `7`, `8`, `9`, `11`–`14` exist but belong to the sibling ITIL types, and they are literal integers in GLPI's source: `CommonITILObject` declares `INCOMING = 1` through `OBSERVED = 8` plus `APPROVAL = 10`, and `Change` adds `EVALUATION = 9`, `TEST = 11`, `QUALIFICATION = 12`, `REFUSED = 13`, `CANCELED = 14`. Each type's `getAllStatusArray()` is a hardcoded PHP array mapping those constants to *translated* labels — no database, no config table. The set is therefore coupled to the GLPI *version*, not to the instance.
diff --git a/skills/glpi-user-location-provisioning/SKILL.md b/skills/glpi-user-location-provisioning/SKILL.md
index 742de53..caab841 100644
--- a/skills/glpi-user-location-provisioning/SKILL.md
+++ b/skills/glpi-user-location-provisioning/SKILL.md
@@ -5,7 +5,7 @@ license: MIT
 compatibility: "Requires Python 3.10+, glpi-python-client, network access to the GLPI v2 API, and credentials allowed to read or write users, locations, and entities."
 metadata:
   package: glpi-python-client
-  version: "0.4.3"
+  version: "0.5.0"
 ---
 
 # GLPI User, Location, And Entity Provisioning

From 7c207585c34d4ee18a1c156fa91d883ca9e1363e Mon Sep 17 00:00:00 2001
From: baraline <antoine.guillaume45@gmail.com>
Date: Tue, 8 Sep 2026 09:59:12 +0200
Subject: [PATCH 04/14] fix(content): read a malformed tag the way html.parser
 reads it

An adversarial review of the depth scan found the degraded path printing
a tag it had failed to parse, and probing that turned up three more
rules taken from the wrong place -- my reading of the HTML5 spec rather
than CPython's tolerant parser, which is what markdownify actually
builds its tree with. All four are now measured against html.parser's
own event stream.

- A quote opens an attribute value only as the first character after the
  `=`: attrfind_tolerant spells the bare alternative (?!['"])[^>\s]*, so
  `<p title=don't>` carries the value `don't` and an unquoted value may
  hold `<` as well. Reading that apostrophe as an opening quote ran the
  value on to the next apostrophe, the tag then matched nothing, and
  `"<div>" * 300 + "<p title=don't>Le serveur ne repond plus.</p>"`
  degraded to `"<p title=don't>Le serveur ne repond plus."` -- markup
  emitted into text a person reads, from the one path whose whole promise
  is text. An apostrophe needs no malice to reach a French body.

- tagfind_tolerant runs a tag name to whitespace, `/` or `>`, so
  `<style=>` is an element named `style=` and never enters raw-text mode.
  A self-closed `<script/>` does not either: parse_starttag calls
  set_cdata_mode only on the branch that is not self-closing. Reading
  either as raw text swallowed the rest of the document, so
  `"<style=>" + "<div>" * 600` measured 1 level against a real 601, went
  to markdownify and raised -- the unbounded under-count the ceiling
  exists to prevent, and the same defect as the quoted-attribute one
  already fixed here.

- An attribute name may contain `<`, so after a quoted value the parser
  keeps scanning to the next `>`.

- A declaration is text on neither path only when it is closed. A
  `<!weird` left unterminated at end of input is flushed as character
  data by close(), so dropping it lost the tail of a body.

Re-fuzzed with those shapes in the corpus: 15000 documents with zero
depth under-counts either direction and no document losing text beyond
the character-reference case already documented, plus 4000 deep
documents built from the same malformed shapes with none reaching
markdownify. Parity with markdownify was measured directly for each new
case rather than inferred.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 CHANGELOG.md                                  |  15 +++
 glpi_python_client/content/conversion.py      |  57 ++++++++--
 .../content/tests/test_conversion.py          | 102 ++++++++++++++++++
 3 files changed, 165 insertions(+), 9 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9773acb..46f1128 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -38,6 +38,21 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   - An attribute value may contain `<` and `>`, so
     `'<div title="</div>">' * 600` also measured 0 against a real 600
     until the scan learned to skip quoted values.
+  - A quote opens a value only as the first character after the `=`,
+    which is the parser's own rule, so `<p title=don't>` carries the
+    value `don't`. Reading that apostrophe as a quote printed the opening
+    tag verbatim at the reader — and an apostrophe needs no malice to
+    reach a French ticket body.
+  - `tagfind_tolerant` runs a tag *name* to whitespace, `/` or `>`, so
+    `<style=>` is an element named `style=` and never enters raw-text
+    mode; a self-closed `<script/>` does not either, because
+    `parse_starttag` enters it only on the branch that is not
+    self-closing. Reading either as raw text swallowed the rest of the
+    document: `"<style=>" + "<div>" * 600` measured 1 level against a
+    real 601 and raised.
+  - A declaration is text on neither path only when it is closed. A
+    `<!weird` left unterminated at end of input is flushed as character
+    data when the parser closes, so dropping it lost the tail of a body.
   - An unclosed tag counts, a childless node still occupies a level, and
     a bogus comment swallows the tags inside it.
   - The degraded path had to be measured against the converting path
diff --git a/glpi_python_client/content/conversion.py b/glpi_python_client/content/conversion.py
index f714a26..b4f1504 100644
--- a/glpi_python_client/content/conversion.py
+++ b/glpi_python_client/content/conversion.py
@@ -182,15 +182,42 @@
 #: the parser builds 600, because the quoted ``</div>`` was read as a real
 #: close. That document went to ``markdownify`` and raised -- the one
 #: direction of error the ceiling exists to prevent.
-_ATTRIBUTES = r"""(?:"[^"]*"|'[^']*'|[^<>"'])*"""
+#:
+#: Two further rules, both taken from the parser rather than guessed, and
+#: both wrong in an earlier revision of this module.
+#:
+#: A quote only opens a value when it is the first character after the
+#: ``=``: ``attrfind_tolerant`` spells the bare alternative
+#: ``(?!['"])[^>\s]*``, so ``<p title=don't>`` carries the value ``don't``
+#: and ends at its ``>``, and an unquoted value may hold ``<`` as well.
+#: Reading that apostrophe as an opening quote ran the value on to the next
+#: apostrophe in the document and the tag then failed to match at all:
+#: measured, ``"<div>" * 300 + "<p title=don't>Le serveur ne repond
+#: plus.</p>"`` degraded to ``"<p title=don't>Le serveur ne repond plus."``
+#: -- the opening tag emitted verbatim into text a reader sees, and markup
+#: in an output this module promises holds none. Apostrophes are ordinary
+#: in the French an editor types.
+#:
+#: The leading lookahead is the other half: the parser will not read a tag
+#: at all unless whitespace, ``/`` or ``>`` follows the name, because
+#: ``attrfind_tolerant`` only starts an attribute after ``['"\s/]`` and
+#: ``parse_starttag`` then discards a start tag whose remainder is not
+#: ``>`` or ``/>``. So ``<style=>`` is *data* to the parser, not an
+#: element. Accepting it here was the worse direction of the same mistake:
+#: it entered raw-text mode, swallowed the rest of the document, and
+#: ``"<style=>" + "<div>" * 600`` measured **1** level against a real 601
+#: -- through ``markdownify`` and into the ``RecursionError`` the ceiling
+#: exists to prevent. A malformed ``<custom=>`` costs nothing, but the
+#: raw-text names make it unbounded, so the gate belongs on both branches.
+_ATTRIBUTES = r"""(?=[\s/>])(?:[^>=]|=\s*"[^"]*"|=\s*'[^']*'|=\s*(?!["'])[^\s>]*)*"""
 
 _MARKUP = re.compile(
     r"<!--.*?-->"
     r"|<!\[CDATA\[(?P<cdata>.*?)\]\]>"
     r"|(?P<decl><[!?][^>]*>?)"
-    r"|<(?P<raw>script|style)\b" + _ATTRIBUTES + r">"
+    r"|<(?P<raw>script|style)" + _ATTRIBUTES + r"(?<!/)>"
     r"(?P<rawbody>.*?)(?:</(?P=raw)\s*>|(?P<rawcut>$))"
-    r"|</?(?P<name>[a-zA-Z][a-zA-Z0-9]*)" + _ATTRIBUTES + r">",
+    r"|</?(?P<name>[a-zA-Z][^\t\n\r\f />\x00]*)" + _ATTRIBUTES + r">",
     re.DOTALL | re.IGNORECASE,
 )
 
@@ -301,7 +328,11 @@ def _html_nesting_depth(content: str) -> int:
     The result was checked against a ground-truth iterative walk of the
     tree ``bs4`` actually builds, over 15000 fuzzed documents mixing every
     construct above plus attribute values containing ``<``, ``>`` and
-    whole tags: **worst error 0 in either direction.** Where the two could
+    whole tags, unquoted values holding quotes, malformed tag names such
+    as ``<style=>``, self-closed raw-text elements and declarations left
+    unterminated at end of input: **worst error 0 in either direction**,
+    and no document deep enough to matter reached ``markdownify`` in 4000
+    further trials built from those same shapes. Where the two could
     still disagree, over-counting is the direction to err in -- it costs a
     document that degrades when it need not have, while under-counting is
     a crash.
@@ -366,9 +397,12 @@ def _strip_tags(content: str) -> str:
     path would have produced also appears here, in order. A superset, not
     an equality -- so no body says less because of the path it took, which
     is the only guarantee worth making about a fallback. Checked as a
-    subsequence over 15000 fuzzed documents mixing tags, quoted
-    attributes, entities, comments, marked sections, declarations,
-    processing instructions and raw-text elements: **0 losing text.**
+    subsequence over 15000 fuzzed documents mixing tags, quoted and
+    unquoted attributes, malformed tag names, entities, comments, marked
+    sections, declarations left unterminated, processing instructions and
+    raw-text elements both closed and self-closed: **0 losing text**, and
+    the only documents that differ at all are the character-reference case
+    listed below.
 
     Establishing that meant measuring what the converting path really
     keeps, construct by construct, rather than assuming. Three answers
@@ -435,12 +469,17 @@ def _strip_tags(content: str) -> str:
                 pieces.append("\n" + (match.group("rawbody") or "") + "\n")
             continue
         decl = match.group("decl")
-        if decl is not None and not _RESOLVED_DECLARATION.match(decl):
+        if decl is not None and (
+            not _RESOLVED_DECLARATION.match(decl) or not decl.endswith(">")
+        ):
             # An unterminated comment, an unterminated marked section, or
             # a processing instruction. ``html.parser`` resolves none of
             # them, gives up, and emits the region as character data --
             # so the converting path prints it and this keeps it. Only a
-            # resolvable declaration is text on neither path.
+            # resolvable declaration is text on neither path, and only
+            # when it is closed: ``"<!weird"`` at end of input never
+            # completes, so ``close()`` flushes it as text and dropping it
+            # lost the tail of the body.
             pieces.append(decl)
     pieces.append(content[cursor:])
 
diff --git a/glpi_python_client/content/tests/test_conversion.py b/glpi_python_client/content/tests/test_conversion.py
index 473920e..03ff4a6 100644
--- a/glpi_python_client/content/tests/test_conversion.py
+++ b/glpi_python_client/content/tests/test_conversion.py
@@ -620,3 +620,105 @@ def test_the_degraded_path_resolves_references_like_the_parser(
     html = "<div>" * 300 + f"<p>{raw}</p>" + "</div>" * 300
 
     assert GlpiContentConverter.from_transport(html) == expected
+
+
+@pytest.mark.parametrize(
+    "html",
+    [
+        pytest.param("<p title=don't>x</p>", id="apostrophe-in-bare-value"),
+        pytest.param('<p title=say"hi>x</p>', id="quote-in-bare-value"),
+        pytest.param("<p alt=P<0.05>x</p>", id="lt-in-bare-value"),
+        pytest.param("<p title=Etape 1>x</p>", id="space-in-bare-value"),
+        pytest.param("<style=>x", id="malformed-style-name"),
+        pytest.param("<script=>x", id="malformed-script-name"),
+        pytest.param("<div=x>y", id="malformed-name"),
+        pytest.param('<div"a">y', id="quote-in-name"),
+        pytest.param("<scripty>x</scripty>", id="raw-name-is-a-prefix"),
+        pytest.param("<script/>x", id="self-closed-script"),
+        pytest.param("<style />x", id="self-closed-style"),
+        pytest.param('<li y=">mot<script data-x="</div>">tail', id="lt-after-value"),
+        pytest.param("<div a=1 <p>text", id="tag-inside-a-tag"),
+        pytest.param("<div class=a<b>text", id="lt-in-unquoted-value"),
+    ],
+)
+def test_the_depth_scan_reads_a_malformed_tag_like_the_parser(html: str) -> None:
+    """Malformed markup is the common case, and its rules are the parser's.
+
+    Every expectation here was read off ``html.parser`` rather than
+    reasoned about, and each rule below was wrong in an earlier revision:
+
+    * A quote opens a value only as the first character after the ``=``,
+      so ``title=don't`` is the value ``don't`` and an unquoted value may
+      hold ``<`` too.
+    * ``tagfind_tolerant`` runs the *name* to whitespace, ``/`` or ``>``,
+      so ``<style=>`` is an element named ``style=`` -- which is why it
+      never enters raw-text mode, however much it looks like ``<style>``.
+    * A self-closed ``<script/>`` does not enter raw-text mode either:
+      ``parse_starttag`` calls ``set_cdata_mode`` only on the branch that
+      is not self-closing.
+    * An attribute name may contain ``<``, so after a quoted value the
+      parser keeps scanning to the next ``>``.
+    """
+
+    assert _html_nesting_depth(html) == _parser_depth(html)
+
+
+@pytest.mark.parametrize(
+    "prefix",
+    [
+        pytest.param("<style=>", id="malformed-style-name"),
+        pytest.param("<script=>", id="malformed-script-name"),
+        pytest.param("<script/>", id="self-closed-script"),
+        pytest.param("<style />", id="self-closed-style"),
+        pytest.param("<p title=don't>", id="apostrophe-in-bare-value"),
+        pytest.param("<p alt=P<0.05>", id="lt-in-bare-value"),
+    ],
+)
+def test_a_malformed_tag_cannot_hide_the_depth_below_it(prefix: str) -> None:
+    """One malformed tag must not conceal a whole document's nesting.
+
+    The dangerous direction is under-counting, and each of these
+    under-counted without bound: read as raw text, ``"<style=>"`` and
+    ``"<script/>"`` swallowed everything after them, so
+    ``"<style=>" + "<div>" * 600`` measured **1** level against a real
+    601, went to ``markdownify`` and raised the ``RecursionError`` the
+    ceiling exists to prevent.
+    """
+
+    html = prefix + "<div>" * 600 + "the printer is offline"
+
+    assert _html_nesting_depth(html) == _parser_depth(html)
+    assert GlpiContentConverter.from_transport(html) == "the printer is offline"
+
+
+def test_the_degraded_path_does_not_emit_a_tag_it_could_not_read() -> None:
+    """A tag the scan mis-read used to be printed at the reader.
+
+    Measured: the body below degraded to ``"<p title=don't>Le serveur ne
+    repond plus."`` -- the opening tag verbatim in text a person reads,
+    from a path whose whole promise is text. An apostrophe is ordinary in
+    French, so this needs no malice to reach a ticket.
+    """
+
+    html = "<div>" * 300 + "<p title=don't>Le serveur ne repond plus.</p>"
+
+    degraded = GlpiContentConverter.from_transport(html)
+
+    assert degraded == "Le serveur ne repond plus."
+    assert "<" not in degraded
+
+
+def test_an_unterminated_declaration_at_end_of_input_is_kept() -> None:
+    """``close()`` flushes an incomplete declaration as text, so this does.
+
+    A declaration is text on neither path only when it is *closed*: a
+    ``"<!weird"`` that never completes is flushed as character data when
+    the parser closes, and the converting path prints it. Dropping it lost
+    the tail of the body.
+    """
+
+    shallow = "<p>keep this</p><!weird"
+    deep = "<div>" * 300 + "<p>keep this</p>" + "</div>" * 300 + "<!weird"
+
+    assert GlpiContentConverter.from_transport(shallow) == "keep this\n\n<!weird"
+    assert GlpiContentConverter.from_transport(deep) == "keep this\n\n<!weird"

From e3a737629976e81d0c74514d8d0bffbc5c8efe01 Mon Sep 17 00:00:00 2001
From: baraline <antoine.guillaume45@gmail.com>
Date: Tue, 8 Sep 2026 10:30:07 +0200
Subject: [PATCH 05/14] test(integration): export GLPI_SERVER_TIMEZONE in
 test_from_env

The suite could not pass before a release. `from_env` requires
`server_timezone` -- GLPI does not advertise its own, so the client
refuses to guess -- but this test exported only six variables and failed
in 0.4s, before reaching the network. Pre-existing on main, and the
fixture already carries the value.

With it, the whole integration suite is green against a live GLPI 11:
44 passed, 4 skipped (one entity not configured in local secrets, three
for the Fields plugin, which is no longer installed on that instance).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 integration_tests/test_integration.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/integration_tests/test_integration.py b/integration_tests/test_integration.py
index 9b5ac9b..d8df5d5 100644
--- a/integration_tests/test_integration.py
+++ b/integration_tests/test_integration.py
@@ -287,6 +287,10 @@ def test_from_env(
     monkeypatch.setenv("GLPI_USERNAME", live_config.username)
     monkeypatch.setenv("GLPI_PASSWORD", live_config.password)
     monkeypatch.setenv("GLPI_VERIFY_SSL", str(live_config.verify_ssl).lower())
+    # from_env requires it: GLPI does not advertise its own timezone, and
+    # the client refuses to guess one. Missing here, this test failed
+    # before it reached the network.
+    monkeypatch.setenv("GLPI_SERVER_TIMEZONE", live_config.server_timezone)
 
     glpi_client = GlpiClient.from_env()
     try:

From 89a06a92089acdaf63bbd9072c21e2b5605bc828 Mon Sep 17 00:00:00 2001
From: baraline <antoine.guillaume45@gmail.com>
Date: Tue, 8 Sep 2026 10:35:07 +0200
Subject: [PATCH 06/14] test(integration): keep the ticket-status probes with
 the change they justify

`status` became a write field in 73d0a9b on the strength of four
measurements against a live GLPI 11, and only the reasoning survived in
the repository. `probe_wire_format.py` is already tracked for the same
reason: the v2 API answers 200 to fields it does not recognise, so these
questions cannot be settled from inside the repository and a future
reader who doubts the answer needs the probe, not a summary of it.

- probe_ticket_status.py -- which route writes `status`, each case
  reading the ticket back because a 200 proves nothing.
- probe_ticket_status_scope.py -- whether POST honours it, and whether
  the advertised id set is actually closed.
- probe_status_is_configurable.py -- whether statuses are instance data
  or hardcoded, three independent read-only checks with positive
  controls.
- probe_ticket_status_99.py -- parks one ticket on status 99 for UI
  inspection. Unlike every other probe here it deliberately leaves that
  ticket behind, says so, and prints the id to delete.

All four take credentials from `secrets/` by filename and record no
instance data: no hostnames, entity or user names, ids or counts. The
two that write create their own tickets, titled "safe to delete", and
force-delete them in a `finally`.

probe_sync_config_targets.py stays untracked deliberately: it serves
another project and its docstring records this instance's inventory,
which does not belong in a public repository.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../probe_status_is_configurable.py           | 284 ++++++++++++++
 integration_tests/probe_ticket_status.py      | 366 ++++++++++++++++++
 integration_tests/probe_ticket_status_99.py   | 178 +++++++++
 .../probe_ticket_status_scope.py              | 333 ++++++++++++++++
 4 files changed, 1161 insertions(+)
 create mode 100644 integration_tests/probe_status_is_configurable.py
 create mode 100644 integration_tests/probe_ticket_status.py
 create mode 100644 integration_tests/probe_ticket_status_99.py
 create mode 100644 integration_tests/probe_ticket_status_scope.py

diff --git a/integration_tests/probe_status_is_configurable.py b/integration_tests/probe_status_is_configurable.py
new file mode 100644
index 0000000..aa52c18
--- /dev/null
+++ b/integration_tests/probe_status_is_configurable.py
@@ -0,0 +1,284 @@
+"""Determine whether ticket statuses are instance data or hardcoded values.
+
+``PatchTicket.status`` is typed as a closed enum. That is only defensible
+if the id set cannot be extended or renamed by a GLPI administrator: a
+per-instance vocabulary would make the enum reject values a real server
+legitimately holds -- the failure mode ``GlpiPriority`` already carries,
+where the contract's missing ``Major`` level took down whole searches.
+
+Three independent read-only checks, because no single one is conclusive:
+
+1. **Is there a dropdown itemtype behind it?** GLPI's configurable
+   vocabularies are ordinary itemtypes -- ``ITILCategory``,
+   ``RequestType``, ``SolutionType`` -- each with a CRUD route on the v1
+   API and a management screen behind it. If ``status`` were one, a
+   comparable itemtype would answer. Several plausible names are tried
+   against v1, with two known-configurable ones as positive controls: a
+   probe where *everything* 404s proves nothing.
+
+2. **How does GLPI describe the field to itself?** ``listSearchOptions``
+   reports each field's storage. A foreign key into a dropdown table
+   shows that table; a hardcoded column shows ``glpi_tickets`` with a
+   ``specific``-style datatype and no linked table.
+
+3. **What does the v2 contract publish?** A configurable vocabulary
+   cannot be published as a fixed ``enum`` with fixed labels, because the
+   document is generated per instance. Whether the labels are localised
+   or stored is visible in the same place.
+
+Nothing is created, modified or deleted.
+
+Usage
+-----
+    python integration_tests/probe_status_is_configurable.py
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import socket
+import sys
+from pathlib import Path
+from typing import Any
+from urllib.parse import urlparse
+
+import httpx
+
+_REPO_ROOT = Path(__file__).resolve().parents[1]
+_SECRETS_DIR = _REPO_ROOT / "secrets"
+
+#: Itemtypes probed on the v1 API, and what each answer would mean.
+#:
+#: The first two are *positive controls*: both are configurable GLPI
+#: vocabularies with an admin screen, so both must answer. If they do not,
+#: the account lacks the rights and the whole probe is uninformative rather
+#: than negative. The rest are the names a ticket-status dropdown would
+#: plausibly carry if one existed.
+_ITEMTYPES = (
+    ("ITILCategory", "control -- known configurable"),
+    ("RequestType", "control -- known configurable"),
+    ("TicketStatus", "would be the dropdown if statuses were data"),
+    ("ITILStatus", "ditto, alternative naming"),
+    ("Status", "ditto, generic naming"),
+)
+
+
+def _read_value(secret_name: str, env_name: str) -> str | None:
+    """Return the secret file's contents, or the environment fallback."""
+
+    path = _SECRETS_DIR / secret_name
+    if path.exists():
+        value = path.read_text(encoding="utf-8").strip()
+        if value:
+            return value
+    env_value = os.environ.get(env_name)
+    return env_value.strip() if env_value else None
+
+
+def _load() -> dict[str, str | None]:
+    """Resolve the live configuration or exit with what is missing."""
+
+    required = {
+        "api_url": ("glpi_api_url", "GLPI_API_URL"),
+        "client_id": ("glpi_client_id_test", "GLPI_CLIENT_ID"),
+        "client_secret": ("glpi_client_secret_test", "GLPI_CLIENT_SECRET"),
+        "username": ("glpi_username", "GLPI_USERNAME"),
+        "password": ("glpi_password", "GLPI_PASSWORD"),
+    }
+    optional = {
+        "v1_url": ("glpi_api_v1_url", "GLPI_API_V1_URL"),
+        "v1_user_token": ("glpi_api_v1_token_user", "GLPI_V1_USER_TOKEN"),
+        "v1_app_token": ("glpi_api_v1_app_token", "GLPI_V1_APP_TOKEN"),
+    }
+    config: dict[str, str | None] = {}
+    missing: list[str] = []
+    for key, (secret, env) in required.items():
+        value = _read_value(secret, env)
+        if value is None:
+            missing.append(secret)
+        else:
+            config[key] = value
+    if missing:
+        sys.exit("missing credentials: " + ", ".join(missing))
+    for key, (secret, env) in optional.items():
+        config[key] = _read_value(secret, env)
+    return config
+
+
+def _check_reachable(api_url: str) -> None:
+    """Exit with a diagnosis when the API host does not resolve."""
+
+    host = urlparse(api_url).hostname
+    if not host:
+        sys.exit(f"glpi_api_url is not a URL: {api_url!r}")
+    try:
+        socket.getaddrinfo(host, None)
+    except socket.gaierror:
+        sys.exit(f"cannot resolve {host} -- connect to the corporate VPN.")
+
+
+def _token(client: httpx.Client, config: dict[str, str | None]) -> str:
+    """Obtain a v2 access token with the password grant."""
+
+    response = client.post(
+        f"{str(config['api_url']).rstrip('/')}/token",
+        data={
+            "grant_type": "password",
+            "client_id": config["client_id"],
+            "client_secret": config["client_secret"],
+            "username": config["username"],
+            "password": config["password"],
+            "scope": "api",
+        },
+        timeout=30,
+    )
+    response.raise_for_status()
+    return str(response.json()["access_token"])
+
+
+def _v1_session(
+    client: httpx.Client, config: dict[str, str | None]
+) -> dict[str, str] | None:
+    """Open a legacy v1 session and return its headers, or ``None``."""
+
+    v1_url = config.get("v1_url")
+    user_token = config.get("v1_user_token")
+    if not v1_url or not user_token:
+        return None
+    headers = {"Authorization": f"user_token {user_token}"}
+    app_token = config.get("v1_app_token")
+    if app_token:
+        headers["App-Token"] = str(app_token)
+    init = client.get(
+        f"{str(v1_url).rstrip('/')}/initSession", headers=headers, timeout=30
+    )
+    if init.status_code >= 400:
+        print(f"  v1 initSession -> HTTP {init.status_code} {init.text[:200]!r}")
+        return None
+    session_headers = {"Session-Token": str(init.json().get("session_token"))}
+    if app_token:
+        session_headers["App-Token"] = str(app_token)
+    return session_headers
+
+
+def _probe_itemtypes(client: httpx.Client, v1: str, headers: dict[str, str]) -> None:
+    """Ask v1 for each candidate dropdown itemtype and report the answer."""
+
+    for itemtype, note in _ITEMTYPES:
+        response = client.get(
+            f"{v1}/{itemtype}", headers=headers, params={"range": "0-2"}, timeout=30
+        )
+        exists = response.status_code < 400
+        rows = ""
+        if exists:
+            try:
+                payload = response.json()
+            except ValueError:
+                payload = None
+            if isinstance(payload, list):
+                names = [r.get("name") for r in payload if isinstance(r, dict)][:3]
+                rows = f"  first rows: {names}"
+        verdict = "EXISTS" if exists else "absent"
+        print(f"  {itemtype:<16} HTTP {response.status_code}  {verdict:<7} ({note})")
+        if rows:
+            print(f"      {rows.strip()}")
+
+
+def _probe_search_options(
+    client: httpx.Client, v1: str, headers: dict[str, str]
+) -> None:
+    """Print how GLPI describes the ticket ``status`` field's storage."""
+
+    response = client.get(f"{v1}/listSearchOptions/Ticket", headers=headers, timeout=30)
+    if response.status_code >= 400:
+        print(f"  listSearchOptions/Ticket -> HTTP {response.status_code}")
+        return
+    try:
+        options = response.json()
+    except ValueError:
+        print("  listSearchOptions/Ticket -> not JSON")
+        return
+    if not isinstance(options, dict):
+        print(f"  listSearchOptions/Ticket -> unexpected shape {type(options)}")
+        return
+    for key, option in options.items():
+        if not isinstance(option, dict):
+            continue
+        if option.get("field") != "status":
+            continue
+        print(f"  option {key}: {json.dumps(option, ensure_ascii=False)}")
+
+
+def _probe_contract(client: httpx.Client, base: str, headers: dict[str, str]) -> None:
+    """Print each ITIL type's published ``status`` enum.
+
+    ``Problem`` and ``Change`` are included because the earlier value-range
+    probe found that ``7``, ``8`` and ``9`` are *stored* on a ticket even
+    though the ticket enum stops at ``6`` (plus ``10``). If those ids turn
+    up as legitimate statuses of the sibling ITIL types, then they are
+    core constants of the shared parent class rather than room left for
+    instance-defined values -- which is the difference between "the set is
+    extensible" and "the column is unvalidated".
+    """
+
+    response = client.get(f"{base}/doc.json", headers=headers, timeout=60)
+    if response.status_code >= 400:
+        print(f"  {base}/doc.json -> HTTP {response.status_code}")
+        return
+    try:
+        document: Any = response.json()
+    except ValueError:
+        print("  doc.json -> not JSON")
+        return
+    schemas = document.get("components", {}).get("schemas", {})
+    for name in ("Ticket", "Problem", "Change"):
+        status = schemas.get(name, {}).get("properties", {}).get("status")
+        if status is None:
+            print(f"  {name}.status -> <no such schema>")
+            continue
+        ident = status.get("properties", {}).get("id", status)
+        print(f"  {name}.status ids -> {ident.get('enum')}")
+        description = (ident.get("description") or "").strip()
+        for line in description.splitlines():
+            print(f"      {line}")
+
+
+def main() -> None:
+    """Run the three checks and print a report."""
+
+    config = _load()
+    base = str(config["api_url"]).rstrip("/")
+    _check_reachable(base)
+
+    with httpx.Client(verify=False, follow_redirects=True, timeout=60) as client:
+        token = _token(client, config)
+        read_headers = {"Authorization": f"Bearer {token}"}
+
+        print("=" * 72)
+        print("CHECK 1 -- is there a dropdown itemtype behind ticket status?")
+        print("=" * 72)
+        v1_headers = _v1_session(client, config)
+        if v1_headers is None:
+            print("  v1 session unavailable -- skipped")
+        else:
+            v1 = str(config["v1_url"]).rstrip("/")
+            try:
+                _probe_itemtypes(client, v1, v1_headers)
+                print()
+                print("=" * 72)
+                print("CHECK 2 -- how does GLPI describe the field's storage?")
+                print("=" * 72)
+                _probe_search_options(client, v1, v1_headers)
+            finally:
+                client.get(f"{v1}/killSession", headers=v1_headers, timeout=30)
+        print()
+
+        print("=" * 72)
+        print("CHECK 3 -- what does the v2 contract publish?")
+        print("=" * 72)
+        _probe_contract(client, base, read_headers)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/integration_tests/probe_ticket_status.py b/integration_tests/probe_ticket_status.py
new file mode 100644
index 0000000..f5e2646
--- /dev/null
+++ b/integration_tests/probe_ticket_status.py
@@ -0,0 +1,366 @@
+"""Record whether GLPI 11 accepts a ticket *status* write, and on which route.
+
+The package excludes ``status`` from ``PostTicket``/``PatchTicket`` on the
+stated grounds that "GLPI manages the ticket lifecycle through dedicated
+timeline routes". Nothing in the repository records a measurement behind
+that claim, and the v2 API is fail-open: it answers 200 to fields it does
+not recognise, so "the PATCH succeeded" proves nothing on its own. Every
+case below therefore *reads the ticket back* and compares.
+
+Cases, each on a distinct target status so one cannot be mistaken for
+another's leftover:
+
+* control    -- PATCH a field that certainly does not exist. If this is a
+                200, then a 200 on ``status`` means nothing by itself.
+* v2 object  -- ``{"status": {"id": 4}}``   (PENDING) -- the read shape.
+* v2 int     -- ``{"status": 3}``           (PLANNED) -- the v1 shape.
+* v2 id      -- ``{"status_id": 2}``        (ASSIGNED) -- GLPI's other idiom.
+* v1 PUT     -- ``{"input": {"status": 6}}`` (CLOSED) -- the legacy route,
+                the same escape hatch ``set_kb_article_categories`` uses.
+
+Read-mostly: one ticket is created and force-deleted in a ``finally``.
+
+Usage
+-----
+    python probe_ticket_status.py
+
+Credentials load exactly as the integration suite loads them: from the
+repository's ``secrets/`` files, falling back to ``GLPI_*`` env vars.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import socket
+import sys
+from pathlib import Path
+from typing import Any
+from urllib.parse import urlparse
+
+import httpx
+
+_REPO_ROOT = Path(__file__).resolve().parents[1]
+_SECRETS_DIR = _REPO_ROOT / "secrets"
+
+_STATUS_NAMES = {
+    1: "NEW",
+    2: "ASSIGNED",
+    3: "PLANNED",
+    4: "PENDING",
+    5: "SOLVED",
+    6: "CLOSED",
+    10: "VALIDATION",
+}
+
+
+def _read_value(secret_name: str, env_name: str) -> str | None:
+    """Return the secret file's contents, or the environment fallback."""
+
+    path = _SECRETS_DIR / secret_name
+    if path.exists():
+        value = path.read_text(encoding="utf-8").strip()
+        if value:
+            return value
+    env_value = os.environ.get(env_name)
+    return env_value.strip() if env_value else None
+
+
+def _load() -> dict[str, str | None]:
+    """Resolve the live configuration or exit with what is missing."""
+
+    required = {
+        "api_url": ("glpi_api_url", "GLPI_API_URL"),
+        "client_id": ("glpi_client_id_test", "GLPI_CLIENT_ID"),
+        "client_secret": ("glpi_client_secret_test", "GLPI_CLIENT_SECRET"),
+        "username": ("glpi_username", "GLPI_USERNAME"),
+        "password": ("glpi_password", "GLPI_PASSWORD"),
+    }
+    optional = {
+        "v1_url": ("glpi_api_v1_url", "GLPI_API_V1_URL"),
+        "v1_user_token": ("glpi_api_v1_token_user", "GLPI_V1_USER_TOKEN"),
+        "v1_app_token": ("glpi_api_v1_app_token", "GLPI_V1_APP_TOKEN"),
+    }
+    config: dict[str, str | None] = {}
+    missing: list[str] = []
+    for key, (secret, env) in required.items():
+        value = _read_value(secret, env)
+        if value is None:
+            missing.append(secret)
+        else:
+            config[key] = value
+    if missing:
+        sys.exit("missing credentials: " + ", ".join(missing))
+    for key, (secret, env) in optional.items():
+        config[key] = _read_value(secret, env)
+    return config
+
+
+def _check_reachable(api_url: str) -> None:
+    """Exit with a diagnosis when the API host does not resolve."""
+
+    host = urlparse(api_url).hostname
+    if not host:
+        sys.exit(f"glpi_api_url is not a URL: {api_url!r}")
+    try:
+        socket.getaddrinfo(host, None)
+    except socket.gaierror:
+        try:
+            socket.getaddrinfo("github.com", None)
+        except socket.gaierror:
+            sys.exit(f"cannot resolve {host} -- and public DNS is down too.")
+        sys.exit(
+            f"cannot resolve {host}.\n"
+            "Public DNS works, so this is internal name resolution: connect "
+            "to the corporate VPN and run this again."
+        )
+
+
+def _token(client: httpx.Client, config: dict[str, str | None]) -> str:
+    """Obtain a v2 access token with the password grant."""
+
+    response = client.post(
+        f"{str(config['api_url']).rstrip('/')}/token",
+        data={
+            "grant_type": "password",
+            "client_id": config["client_id"],
+            "client_secret": config["client_secret"],
+            "username": config["username"],
+            "password": config["password"],
+            "scope": "api",
+        },
+        timeout=30,
+    )
+    response.raise_for_status()
+    return str(response.json()["access_token"])
+
+
+def _read_status(
+    client: httpx.Client, base: str, headers: dict[str, str], ticket_id: int
+) -> Any:
+    """Return the ticket's ``status`` as GLPI v2 currently reports it."""
+
+    response = client.get(
+        f"{base}/Assistance/Ticket/{ticket_id}", headers=headers, timeout=30
+    )
+    if response.status_code >= 400:
+        return f"<read failed HTTP {response.status_code}>"
+    return response.json().get("status")
+
+
+def _describe(status: Any) -> str:
+    """Render a status value with its enum name when one can be read off."""
+
+    ident = status.get("id") if isinstance(status, dict) else status
+    if isinstance(ident, int) and ident in _STATUS_NAMES:
+        return f"{status!r}  ({_STATUS_NAMES[ident]})"
+    return f"{status!r}"
+
+
+def _probe_v2_case(
+    client: httpx.Client,
+    base: str,
+    read_headers: dict[str, str],
+    write_headers: dict[str, str],
+    ticket_id: int,
+    label: str,
+    body: dict[str, Any],
+    expected: int | None,
+) -> None:
+    """PATCH one body shape on the v2 route, then read the ticket back."""
+
+    before = _read_status(client, base, read_headers, ticket_id)
+    patch = client.request(
+        "PATCH",
+        f"{base}/Assistance/Ticket/{ticket_id}",
+        headers=write_headers,
+        json=body,
+        timeout=30,
+    )
+    after = _read_status(client, base, read_headers, ticket_id)
+    print(f"  {label}")
+    print(f"      body        -> {json.dumps(body, ensure_ascii=False)}")
+    print(f"      PATCH       -> HTTP {patch.status_code}")
+    if patch.status_code >= 400:
+        print(f"      error body  -> {patch.text[:300]!r}")
+    print(f"      status before -> {_describe(before)}")
+    print(f"      status after  -> {_describe(after)}")
+    if expected is None:
+        print(
+            "      VERDICT     -> "
+            + (
+                "v2 REJECTS an unknown field (a 200 on status would be meaningful)"
+                if patch.status_code >= 400
+                else "v2 ACCEPTS an unknown field with a 200 -- a 200 alone "
+                "proves NOTHING; only the read-back counts"
+            )
+        )
+    else:
+        ident = after.get("id") if isinstance(after, dict) else after
+        applied = ident == expected
+        print(
+            "      VERDICT     -> "
+            + (
+                f"APPLIED (status is now {expected})"
+                if applied
+                else f"NOT APPLIED (wanted {expected}, still {ident!r})"
+            )
+        )
+    print()
+
+
+def _probe_v1(
+    client: httpx.Client,
+    base: str,
+    read_headers: dict[str, str],
+    config: dict[str, str | None],
+    ticket_id: int,
+    target: int,
+) -> None:
+    """Init a legacy v1 session, PUT the status, read back through v2."""
+
+    v1_url = config.get("v1_url")
+    user_token = config.get("v1_user_token")
+    if not v1_url or not user_token:
+        print("  v1 PUT: SKIPPED -- glpi_api_v1_url / glpi_api_v1_token_user absent")
+        return
+    v1 = str(v1_url).rstrip("/")
+    init_headers = {"Authorization": f"user_token {user_token}"}
+    app_token = config.get("v1_app_token")
+    if app_token:
+        init_headers["App-Token"] = app_token
+
+    init = client.get(f"{v1}/initSession", headers=init_headers, timeout=30)
+    if init.status_code >= 400:
+        print(f"  v1 PUT: initSession -> HTTP {init.status_code} {init.text[:200]!r}")
+        return
+    session_token = init.json().get("session_token")
+    print(f"  v1 initSession -> HTTP {init.status_code}, token acquired")
+
+    v1_headers = {
+        "Session-Token": str(session_token),
+        "Content-Type": "application/json",
+    }
+    if app_token:
+        v1_headers["App-Token"] = str(app_token)
+
+    try:
+        before = _read_status(client, base, read_headers, ticket_id)
+        put = client.put(
+            f"{v1}/Ticket/{ticket_id}",
+            headers=v1_headers,
+            json={"input": {"id": ticket_id, "status": target}},
+            timeout=30,
+        )
+        after = _read_status(client, base, read_headers, ticket_id)
+        print(f"      PUT {v1}/Ticket/{ticket_id}")
+        print(f"      body        -> {{'input': {{'status': {target}}}}}")
+        print(f"      PUT         -> HTTP {put.status_code} {put.text[:200]!r}")
+        print(f"      status before -> {_describe(before)}")
+        print(f"      status after  -> {_describe(after)}")
+        ident = after.get("id") if isinstance(after, dict) else after
+        print(
+            "      VERDICT     -> "
+            + (
+                f"APPLIED (status is now {target})"
+                if ident == target
+                else f"NOT APPLIED (wanted {target}, still {ident!r})"
+            )
+        )
+    finally:
+        client.get(f"{v1}/killSession", headers=v1_headers, timeout=30)
+
+
+def main() -> None:
+    """Run the status-write probes and print a report."""
+
+    config = _load()
+    base = str(config["api_url"]).rstrip("/")
+    _check_reachable(base)
+
+    with httpx.Client(verify=False, follow_redirects=True, timeout=30) as client:
+        token = _token(client, config)
+        read_headers = {"Authorization": f"Bearer {token}"}
+        write_headers = {
+            "Authorization": f"Bearer {token}",
+            "Content-Type": "application/json",
+        }
+
+        created_id: int | None = None
+        try:
+            created = client.post(
+                f"{base}/Assistance/Ticket",
+                headers=write_headers,
+                json={
+                    "name": "py_glpi status-write probe (safe to delete)",
+                    "content": "<p>Automated probe. Deleted immediately.</p>",
+                },
+                timeout=30,
+            )
+            if created.status_code >= 400:
+                sys.exit(f"create failed: HTTP {created.status_code} {created.text}")
+            created_id = created.json().get("id")
+            if not created_id:
+                sys.exit(f"no id in create response: {created.text[:300]}")
+            print("=" * 72)
+            print(f"probe ticket #{created_id} created")
+            baseline = _read_status(client, base, read_headers, created_id)
+            print(f"  baseline status -> {_describe(baseline)}")
+            print("=" * 72)
+            print()
+
+            print("=" * 72)
+            print("CONTROL -- is a 200 on the v2 PATCH worth anything?")
+            print("=" * 72)
+            _probe_v2_case(
+                client,
+                base,
+                read_headers,
+                write_headers,
+                created_id,
+                "unknown field",
+                {"__probe_field_that_does_not_exist__": "x"},
+                None,
+            )
+
+            print("=" * 72)
+            print("v2 PATCH /Assistance/Ticket/{id} -- three body shapes")
+            print("=" * 72)
+            for label, body, expected in (
+                ("object shape {'status': {'id': 4}}", {"status": {"id": 4}}, 4),
+                ("int shape    {'status': 3}", {"status": 3}, 3),
+                ("id shape     {'status_id': 2}", {"status_id": 2}, 2),
+            ):
+                _probe_v2_case(
+                    client,
+                    base,
+                    read_headers,
+                    write_headers,
+                    created_id,
+                    label,
+                    body,
+                    expected,
+                )
+
+            print("=" * 72)
+            print("v1 PUT /Ticket/{id} -- the legacy escape hatch")
+            print("=" * 72)
+            _probe_v1(client, base, read_headers, config, created_id, 6)
+        finally:
+            if created_id:
+                cleanup = client.request(
+                    "DELETE",
+                    f"{base}/Assistance/Ticket/{created_id}",
+                    headers=write_headers,
+                    json={"force": True},
+                    timeout=30,
+                )
+                print()
+                print()
+                print(
+                    f"  cleanup: force-deleted #{created_id} -> {cleanup.status_code}"
+                )
+
+
+if __name__ == "__main__":
+    main()
diff --git a/integration_tests/probe_ticket_status_99.py b/integration_tests/probe_ticket_status_99.py
new file mode 100644
index 0000000..227cca8
--- /dev/null
+++ b/integration_tests/probe_ticket_status_99.py
@@ -0,0 +1,178 @@
+"""Leave one ticket parked on the out-of-range status 99, for UI inspection.
+
+``probe_ticket_status_scope.py`` established that GLPI 11 stores any integer
+written to ``status`` -- 0, 7, 8, 9 and 99 all returned 200 and read back as
+``{"id": 99, "name": "99"}``, the name falling back to the number because no
+label exists for it. What the API reports and what the *web interface* does
+with such a row are different questions, and the second one decides whether
+the write model should be strict: if the UI degrades gracefully, a
+permissive ``int`` costs little; if the ticket becomes unopenable or
+unfilterable, the library should refuse the value GLPI accepts.
+
+**This probe deliberately leaves its ticket behind.** Every other probe in
+this directory cleans up in a ``finally``; this one is meant to be looked at
+in the browser and deleted by hand afterwards. It prints the id and the
+front-end URL for that.
+
+Usage
+-----
+    python integration_tests/probe_ticket_status_99.py
+"""
+
+from __future__ import annotations
+
+import os
+import socket
+import sys
+from pathlib import Path
+from typing import Any
+from urllib.parse import urlparse
+
+import httpx
+
+_REPO_ROOT = Path(__file__).resolve().parents[1]
+_SECRETS_DIR = _REPO_ROOT / "secrets"
+
+#: The value to park the ticket on: far outside the contract enum
+#: ``[1, 10, 2, 3, 4, 5, 6]`` and outside GLPI's own core constants.
+_ROGUE_STATUS = 99
+
+
+def _read_value(secret_name: str, env_name: str) -> str | None:
+    """Return the secret file's contents, or the environment fallback."""
+
+    path = _SECRETS_DIR / secret_name
+    if path.exists():
+        value = path.read_text(encoding="utf-8").strip()
+        if value:
+            return value
+    env_value = os.environ.get(env_name)
+    return env_value.strip() if env_value else None
+
+
+def _load() -> dict[str, str]:
+    """Resolve the live configuration or exit with what is missing."""
+
+    wanted = {
+        "api_url": ("glpi_api_url", "GLPI_API_URL"),
+        "client_id": ("glpi_client_id_test", "GLPI_CLIENT_ID"),
+        "client_secret": ("glpi_client_secret_test", "GLPI_CLIENT_SECRET"),
+        "username": ("glpi_username", "GLPI_USERNAME"),
+        "password": ("glpi_password", "GLPI_PASSWORD"),
+    }
+    config: dict[str, str] = {}
+    missing: list[str] = []
+    for key, (secret, env) in wanted.items():
+        value = _read_value(secret, env)
+        if value is None:
+            missing.append(secret)
+        else:
+            config[key] = value
+    if missing:
+        sys.exit("missing credentials: " + ", ".join(missing))
+    return config
+
+
+def _check_reachable(api_url: str) -> None:
+    """Exit with a diagnosis when the API host does not resolve."""
+
+    host = urlparse(api_url).hostname
+    if not host:
+        sys.exit(f"glpi_api_url is not a URL: {api_url!r}")
+    try:
+        socket.getaddrinfo(host, None)
+    except socket.gaierror:
+        sys.exit(f"cannot resolve {host} -- connect to the corporate VPN.")
+
+
+def _token(client: httpx.Client, config: dict[str, str]) -> str:
+    """Obtain a v2 access token with the password grant."""
+
+    response = client.post(
+        f"{config['api_url'].rstrip('/')}/token",
+        data={
+            "grant_type": "password",
+            "client_id": config["client_id"],
+            "client_secret": config["client_secret"],
+            "username": config["username"],
+            "password": config["password"],
+            "scope": "api",
+        },
+        timeout=30,
+    )
+    response.raise_for_status()
+    return str(response.json()["access_token"])
+
+
+def _front_url(api_url: str) -> str:
+    """Derive the web front-end origin from the API base URL."""
+
+    parsed = urlparse(api_url)
+    return f"{parsed.scheme}://{parsed.netloc}"
+
+
+def main() -> None:
+    """Create one ticket, park it on status 99, and leave it there."""
+
+    config = _load()
+    base = config["api_url"].rstrip("/")
+    _check_reachable(base)
+
+    with httpx.Client(verify=False, follow_redirects=True, timeout=30) as client:
+        token = _token(client, config)
+        read_headers = {"Authorization": f"Bearer {token}"}
+        write_headers = {
+            "Authorization": f"Bearer {token}",
+            "Content-Type": "application/json",
+        }
+
+        created = client.post(
+            f"{base}/Assistance/Ticket",
+            headers=write_headers,
+            json={
+                "name": (
+                    f"py_glpi PROBE statut {_ROGUE_STATUS} "
+                    "-- a supprimer apres inspection"
+                ),
+                "content": (
+                    "<p>Ticket de sonde. Son statut a ete force a "
+                    f"{_ROGUE_STATUS}, une valeur hors de l'enum du contrat, "
+                    "pour observer ce que l'interface en fait. "
+                    "Supprimable sans risque.</p>"
+                ),
+            },
+            timeout=30,
+        )
+        if created.status_code >= 400:
+            sys.exit(f"create failed: HTTP {created.status_code} {created.text}")
+        ticket_id = created.json().get("id")
+        if not ticket_id:
+            sys.exit(f"no id in create response: {created.text[:300]}")
+
+        patch = client.request(
+            "PATCH",
+            f"{base}/Assistance/Ticket/{ticket_id}",
+            headers=write_headers,
+            json={"status": _ROGUE_STATUS},
+            timeout=30,
+        )
+        read = client.get(
+            f"{base}/Assistance/Ticket/{ticket_id}", headers=read_headers, timeout=30
+        )
+        status: Any = read.json().get("status") if read.status_code < 400 else None
+
+        front = _front_url(base)
+        print("=" * 72)
+        print(f"  ticket        : #{ticket_id}")
+        print(f"  PATCH status  : {_ROGUE_STATUS} -> HTTP {patch.status_code}")
+        print(f"  read back     : {status!r}")
+        print()
+        print(f"  interface     : {front}/front/ticket.form.php?id={ticket_id}")
+        print(f"  liste         : {front}/front/ticket.php")
+        print()
+        print("  NON SUPPRIME -- a supprimer a la main apres inspection.")
+        print("=" * 72)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/integration_tests/probe_ticket_status_scope.py b/integration_tests/probe_ticket_status_scope.py
new file mode 100644
index 0000000..4656adf
--- /dev/null
+++ b/integration_tests/probe_ticket_status_scope.py
@@ -0,0 +1,333 @@
+"""Record whether GLPI honours ``status`` at create, and how closed the set is.
+
+Follow-up to :mod:`probe_ticket_status`, which established that the v2 PATCH
+does write ``status`` (contradicting the package's own docstring). Two
+questions remain before the field can be declared on the write models:
+
+**Does POST honour it?** ``PatchTicket`` inherits ``PostTicket``, so
+declaring the field once exposes it on both. The v2 API is fail-open --
+it answered 200 to a field that does not exist -- so a create that returns
+an id proves nothing. Only reading the new ticket back does.
+
+**Is the id set fixed, or per instance?** The contract advertises a closed
+enum ``[1, 10, 2, 3, 4, 5, 6]`` on ``Ticket.status.id``. If the server
+rejects a value outside it, the set is validated server-side and an enum is
+the right type. If it accepts one, the set is looser than the contract says
+and an enum would reject values a real instance can hold -- the failure
+mode ``GlpiPriority`` already documents, where a missing sixth level took
+down whole searches.
+
+Read-mostly: two tickets are created and force-deleted in a ``finally``.
+
+Usage
+-----
+    python integration_tests/probe_ticket_status_scope.py
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import socket
+import sys
+from pathlib import Path
+from typing import Any
+from urllib.parse import urlparse
+
+import httpx
+
+_REPO_ROOT = Path(__file__).resolve().parents[1]
+_SECRETS_DIR = _REPO_ROOT / "secrets"
+
+_STATUS_NAMES = {
+    1: "NEW",
+    2: "ASSIGNED",
+    3: "PLANNED",
+    4: "PENDING",
+    5: "SOLVED",
+    6: "CLOSED",
+    10: "VALIDATION",
+}
+
+#: Values probed for acceptance, and why each one is interesting.
+#:
+#: ``7``/``8``/``9`` sit in the gap the contract leaves between ``6`` and
+#: ``10`` -- exactly where an instance-defined extra status would land if
+#: statuses were a dropdown table. ``99`` is far outside any plausible set,
+#: and ``0`` is below it. If the server rejects all of them the set is
+#: closed and validated; if it stores one, the contract enum is too narrow.
+_OUT_OF_CONTRACT = (7, 8, 9, 99, 0)
+
+
+def _read_value(secret_name: str, env_name: str) -> str | None:
+    """Return the secret file's contents, or the environment fallback."""
+
+    path = _SECRETS_DIR / secret_name
+    if path.exists():
+        value = path.read_text(encoding="utf-8").strip()
+        if value:
+            return value
+    env_value = os.environ.get(env_name)
+    return env_value.strip() if env_value else None
+
+
+def _load() -> dict[str, str]:
+    """Resolve the live configuration or exit with what is missing."""
+
+    wanted = {
+        "api_url": ("glpi_api_url", "GLPI_API_URL"),
+        "client_id": ("glpi_client_id_test", "GLPI_CLIENT_ID"),
+        "client_secret": ("glpi_client_secret_test", "GLPI_CLIENT_SECRET"),
+        "username": ("glpi_username", "GLPI_USERNAME"),
+        "password": ("glpi_password", "GLPI_PASSWORD"),
+    }
+    config: dict[str, str] = {}
+    missing: list[str] = []
+    for key, (secret, env) in wanted.items():
+        value = _read_value(secret, env)
+        if value is None:
+            missing.append(secret)
+        else:
+            config[key] = value
+    if missing:
+        sys.exit("missing credentials: " + ", ".join(missing))
+    return config
+
+
+def _check_reachable(api_url: str) -> None:
+    """Exit with a diagnosis when the API host does not resolve."""
+
+    host = urlparse(api_url).hostname
+    if not host:
+        sys.exit(f"glpi_api_url is not a URL: {api_url!r}")
+    try:
+        socket.getaddrinfo(host, None)
+    except socket.gaierror:
+        sys.exit(f"cannot resolve {host} -- connect to the corporate VPN.")
+
+
+def _token(client: httpx.Client, config: dict[str, str]) -> str:
+    """Obtain a v2 access token with the password grant."""
+
+    response = client.post(
+        f"{config['api_url'].rstrip('/')}/token",
+        data={
+            "grant_type": "password",
+            "client_id": config["client_id"],
+            "client_secret": config["client_secret"],
+            "username": config["username"],
+            "password": config["password"],
+            "scope": "api",
+        },
+        timeout=30,
+    )
+    response.raise_for_status()
+    return str(response.json()["access_token"])
+
+
+def _read_status(
+    client: httpx.Client, base: str, headers: dict[str, str], ticket_id: int
+) -> Any:
+    """Return the ticket's ``status`` as GLPI v2 currently reports it."""
+
+    response = client.get(
+        f"{base}/Assistance/Ticket/{ticket_id}", headers=headers, timeout=30
+    )
+    if response.status_code >= 400:
+        return f"<read failed HTTP {response.status_code}>"
+    return response.json().get("status")
+
+
+def _describe(status: Any) -> str:
+    """Render a status value with its enum name when one can be read off."""
+
+    ident = status.get("id") if isinstance(status, dict) else status
+    if isinstance(ident, int) and ident in _STATUS_NAMES:
+        return f"{status!r}  ({_STATUS_NAMES[ident]})"
+    return f"{status!r}"
+
+
+def _identifier(status: Any) -> Any:
+    """Return the numeric id out of either status spelling."""
+
+    return status.get("id") if isinstance(status, dict) else status
+
+
+def _create(
+    client: httpx.Client,
+    base: str,
+    write_headers: dict[str, str],
+    body: dict[str, Any],
+) -> tuple[int | None, httpx.Response]:
+    """Create one probe ticket and return its id alongside the response."""
+
+    payload = {
+        "name": "py_glpi status-scope probe (safe to delete)",
+        "content": "<p>Automated probe. Deleted immediately.</p>",
+        **body,
+    }
+    response = client.post(
+        f"{base}/Assistance/Ticket", headers=write_headers, json=payload, timeout=30
+    )
+    if response.status_code >= 400:
+        return None, response
+    try:
+        return response.json().get("id"), response
+    except ValueError:
+        return None, response
+
+
+def _probe_contract(client: httpx.Client, base: str, headers: dict[str, str]) -> None:
+    """Print what this instance publishes for ``Ticket.status`` if reachable.
+
+    The path the HL API serves its OpenAPI document on is not something the
+    package records, so several plausible ones are tried and the first that
+    answers with the ticket schema is reported. A miss is not a failure --
+    the behavioural probes below are the authority either way.
+    """
+
+    parent = base.rsplit("/", 1)[0]
+    for path in (
+        f"{base}/doc.json",
+        f"{base}/openapi.json",
+        f"{base}/swagger.json",
+        f"{base}/doc",
+        f"{parent}/doc.json",
+        f"{parent}/doc",
+    ):
+        try:
+            response = client.get(path, headers=headers, timeout=20)
+        except httpx.HTTPError as exc:
+            print(f"  {path} -> transport error {exc!r}")
+            continue
+        if response.status_code >= 400:
+            print(f"  {path} -> HTTP {response.status_code}")
+            continue
+        body = response.text
+        print(f"  {path} -> HTTP {response.status_code}, {len(body)} bytes")
+        try:
+            document = response.json()
+        except ValueError:
+            print("      (not JSON -- probably the doc UI)")
+            continue
+        schemas = (
+            document.get("components", {}).get("schemas", {})
+            if isinstance(document, dict)
+            else {}
+        )
+        for name, schema in schemas.items():
+            if "ticket" not in name.lower():
+                continue
+            status = schema.get("properties", {}).get("status")
+            if status:
+                rendered = json.dumps(status, ensure_ascii=False)
+                print(f"      {name}.status -> {rendered}")
+        return
+
+
+def main() -> None:
+    """Run the create-time and value-range probes and print a report."""
+
+    config = _load()
+    base = config["api_url"].rstrip("/")
+    _check_reachable(base)
+
+    with httpx.Client(verify=False, follow_redirects=True, timeout=30) as client:
+        token = _token(client, config)
+        read_headers = {"Authorization": f"Bearer {token}"}
+        write_headers = {
+            "Authorization": f"Bearer {token}",
+            "Content-Type": "application/json",
+        }
+
+        print("=" * 72)
+        print("PROBE 0 -- what does this instance publish for Ticket.status?")
+        print("=" * 72)
+        _probe_contract(client, base, read_headers)
+        print()
+
+        created: list[int] = []
+        try:
+            print("=" * 72)
+            print("PROBE 1 -- does POST honour `status` at create time?")
+            print("=" * 72)
+            for label, body in (
+                ("int shape    {'status': 4}", {"status": 4}),
+                ("object shape {'status': {'id': 4}}", {"status": {"id": 4}}),
+            ):
+                new_id, response = _create(client, base, write_headers, body)
+                print(f"  {label}")
+                print(f"      POST        -> HTTP {response.status_code}")
+                if new_id is None:
+                    print(f"      body        -> {response.text[:300]!r}")
+                    print("      VERDICT     -> create failed, nothing to read back")
+                    print()
+                    continue
+                created.append(new_id)
+                status = _read_status(client, base, read_headers, new_id)
+                print(f"      created     -> #{new_id}")
+                print(f"      status      -> {_describe(status)}")
+                print(
+                    "      VERDICT     -> "
+                    + (
+                        "HONOURED at create"
+                        if _identifier(status) == 4
+                        else "IGNORED at create (fell back to the default)"
+                    )
+                )
+                print()
+
+            print("=" * 72)
+            print("PROBE 2 -- is the id set closed, or looser than the contract?")
+            print("=" * 72)
+            if not created:
+                print("  no probe ticket available -- skipped")
+            else:
+                target = created[0]
+                print(
+                    f"  probing on #{target}; contract enum is [1, 2, 3, 4, 5, 6, 10]"
+                )
+                print()
+                for value in _OUT_OF_CONTRACT:
+                    before = _read_status(client, base, read_headers, target)
+                    patch = client.request(
+                        "PATCH",
+                        f"{base}/Assistance/Ticket/{target}",
+                        headers=write_headers,
+                        json={"status": value},
+                        timeout=30,
+                    )
+                    after = _read_status(client, base, read_headers, target)
+                    stored = _identifier(after) == value
+                    print(f"  status = {value}")
+                    print(f"      PATCH       -> HTTP {patch.status_code}")
+                    if patch.status_code >= 400:
+                        print(f"      error body  -> {patch.text[:200]!r}")
+                    print(
+                        f"      read back   -> {_describe(after)} "
+                        f"(was {_describe(before)})"
+                    )
+                    print(
+                        "      VERDICT     -> "
+                        + (
+                            f"STORED {value} -- the set is NOT closed; an enum "
+                            "would reject a value this instance can hold"
+                            if stored
+                            else "refused -- value not stored"
+                        )
+                    )
+                    print()
+        finally:
+            for ticket_id in created:
+                cleanup = client.request(
+                    "DELETE",
+                    f"{base}/Assistance/Ticket/{ticket_id}",
+                    headers=write_headers,
+                    json={"force": True},
+                    timeout=30,
+                )
+                print(f"  cleanup: force-deleted #{ticket_id} -> {cleanup.status_code}")
+
+
+if __name__ == "__main__":
+    main()

From 373649acb0c62996aabf2bfd0b7fa6e815e3022a Mon Sep 17 00:00:00 2001
From: baraline <antoine.guillaume45@gmail.com>
Date: Tue, 8 Sep 2026 10:56:10 +0200
Subject: [PATCH 07/14] fix(content): keep the text after the second spelling
 of <br>

`<p>line1<br>line2</p><p>para2<br />line4</p>` converted to
`line1  \nline2\n\npara2`. `line4` was gone, with no error, on the
ordinary conversion path -- the path every ticket body takes.

The cause is in beautifulsoup4 (measured on 4.14.3), not markdownify.
Its html.parser builder auto-closes a bare `<br>` and records the name in
`already_closed_empty_element` so that a later `</br>` can be ignored as
redundant; when no `</br>` arrives the entry stays. The next `<br />`
reaches the builder as `handle_startendtag`, opens a real element and
closes it itself -- and that close finds the stale entry, treats the
element as already closed, and leaves it open. Every following sibling
becomes a child of the `<br>`, and `convert_br` ignores an element's
children. `get_text` walks children, which is why the tree looks intact
and why this was invisible until the degraded path was compared against
the converting one and said *more*.

Note the paragraph boundary above: the two spellings need not be near
each other, because a name once recorded poisons the rest of the
document. One bare `<br>` anywhere before one `<br />` is the whole
precondition, and a GLPI body is edited by more than one client. `<img>`
and `<hr>` are the other two converters that discard children and lost
text the same way.

`from_transport` now writes self-closing void tags bare before
converting, which removes the `handle_startendtag` path where the
asymmetry lives. Measured, not assumed: over 4000 fuzzed documents of
each spelling alone not one output changed, and over 4000 mixing them,
102 recovered text and none lost any. Every spelling that reaches
`handle_startendtag` is covered (`<br/>`, `<br />`, tab and newline
variants, `<BR />`); the two that do not (`<br  /  >`, `<br/ >`) arrive
as ordinary start tags and were never affected. The rewrite touches only
void names in real tag position, so a `<div/>`, a `<br />` inside an
attribute value, a comment and a `<script>` body are all left alone. It
costs 1.1ms on an 11KB body against markdownify's 25ms, and nothing at
all when the body has no `/>`.

Worth reporting upstream to beautifulsoup4: the entry is keyed by name
alone and never expires, so any document mixing the two spellings of one
void element is affected, whatever the consumer.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 CHANGELOG.md                                  |  31 +++++
 glpi_python_client/content/conversion.py      |  77 +++++++++++-
 .../content/tests/test_conversion.py          | 118 ++++++++++++++++++
 3 files changed, 225 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 46f1128..c9d0e99 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -92,6 +92,37 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   `testing/tests/test_raise_site_audit.py` rather than left as a comment
   for the next person to weigh up again.
 
+- **A body that used both spellings of `<br>` lost everything after the
+  second one.** `<p>line1<br>line2</p><p>para2<br />line4</p>` converted
+  to `line1  \nline2\n\npara2` — `line4` silently gone, no error, on the
+  ordinary conversion path.
+
+  The cause is in `beautifulsoup4` (measured on 4.14.3), not in
+  `markdownify`. Its `html.parser` builder auto-closes a bare `<br>` and
+  records the name in `already_closed_empty_element` so a later `</br>`
+  can be ignored as redundant; when no `</br>` arrives the entry just
+  stays. The next `<br />` reaches the builder as `handle_startendtag`,
+  opens a real element and closes it itself — and that close finds the
+  stale entry, treats the element as already closed, and leaves it open,
+  so every following sibling becomes a child of the `<br>`.
+  `markdownify`'s `convert_br` ignores an element's children, and the
+  text is gone. `get_text` walks children, which is why the tree looks
+  intact.
+
+  Note the paragraph in the example: the two spellings need not be near
+  each other, since a name once recorded poisons the rest of the
+  document. `<img>` and `<hr>` are the other two converters that discard
+  children and lost text the same way.
+
+  `from_transport` now writes self-closing void tags bare before
+  converting, which removes the `handle_startendtag` path where the
+  asymmetry lives. Both spellings already built the same node, so nothing
+  else moves: measured over 4000 fuzzed documents of each spelling alone,
+  not one output changed, and over 4000 mixing them, 102 recovered text
+  and none lost any. Only names in the void set are touched, and only in
+  real tag position — a `<div/>`, a `<br />` inside an attribute value, a
+  comment or a `<script>` body are all left alone.
+
 - **`GlpiModel` now recognises validation aliases when it captures unknown
   keys.** `_capture_unknown_fields` runs before Pydantic resolves aliases
   and compared incoming keys against field *names* only, so an aliased key
diff --git a/glpi_python_client/content/conversion.py b/glpi_python_client/content/conversion.py
index b4f1504..2e41130 100644
--- a/glpi_python_client/content/conversion.py
+++ b/glpi_python_client/content/conversion.py
@@ -490,6 +490,76 @@ def _strip_tags(content: str) -> str:
     return text.strip()
 
 
+#: The ``/`` of a self-closing tag, with any space around it.
+_VOID_SELF_CLOSE = re.compile(r"\s*/\s*>$")
+
+
+def _canonicalise_void_elements(content: str) -> str:
+    """Rewrite ``<br />`` as ``<br>``, so the text after it is not lost.
+
+    A workaround for a ``beautifulsoup4`` defect (measured on 4.14.3),
+    reachable from ordinary editor output and silent when it fires.
+
+    ``bs4``'s ``html.parser`` builder auto-closes a bare ``<br>`` and
+    records the name in ``already_closed_empty_element``, a list keyed by
+    name alone, so that a later ``</br>`` can be ignored as redundant. If
+    no ``</br>`` ever arrives the entry simply stays there. The next
+    ``<br />`` -- which reaches the builder as ``handle_startendtag`` --
+    opens a real element and then closes it itself, and *that* close finds
+    the stale entry, treats the element as already closed, and leaves it
+    open. Every following sibling becomes a child of the ``<br>``.
+
+    ``get_text`` still walks those children, which is why the tree looks
+    intact, but ``markdownify``'s ``convert_br`` ignores an element's
+    children and returns a line break. The text is gone:
+
+    ``"<p>line1<br>line2</p><p>para2<br />line4</p>"`` converted to
+    ``"line1  \\nline2\\n\\npara2"`` -- and note the two spellings are in
+    different paragraphs, because a name once recorded poisons the rest of
+    the document. ``<img>`` and ``<hr>`` lose text the same way; they are
+    the other two converters that discard children. One bare ``<br>``
+    anywhere before one ``<br />`` is the whole precondition, and GLPI
+    bodies are edited by more than one client.
+
+    Rewriting to the bare spelling removes the ``handle_startendtag`` path
+    for void elements, which is where the asymmetry lives; both spellings
+    already build the same node, so nothing else about the output moves.
+    Only the names in :data:`_VOID_ELEMENTS` are touched, and only in real
+    tag position: a self-closed ``<div/>`` is left alone, and cannot be
+    affected anyway, since only a void name is ever recorded.
+
+    Parameters
+    ----------
+    content : str
+        Raw HTML.
+
+    Returns
+    -------
+    str
+        The same HTML with self-closing void tags written bare.
+    """
+
+    if "/>" not in content:
+        return content
+
+    pieces: list[str] = []
+    cursor = 0
+    for match in _MARKUP.finditer(content):
+        name = match.group("name")
+        if name is None or name.lower() not in _VOID_ELEMENTS:
+            continue
+        token = match.group(0)
+        if token.startswith("</") or not token.endswith("/>"):
+            continue
+        pieces.append(content[cursor : match.start()])
+        pieces.append(_VOID_SELF_CLOSE.sub(">", token))
+        cursor = match.end()
+    if not pieces:
+        return content
+    pieces.append(content[cursor:])
+    return "".join(pieces)
+
+
 class GlpiContentConverter:
     """Convert content between GLPI HTML payloads and canonical Markdown.
 
@@ -518,6 +588,11 @@ def from_transport(value: object) -> str:
         caller gets a readable body either way; **this method degrades, it
         does not truncate, and it does not raise for depth.**
 
+        Self-closing void tags are written bare before conversion, which
+        works around a ``beautifulsoup4`` defect that silently dropped
+        everything after the second spelling of ``<br>`` in a body that
+        used both -- see :func:`_canonicalise_void_elements`.
+
         Raises
         ------
         GlpiContentError
@@ -537,7 +612,7 @@ def from_transport(value: object) -> str:
 
         try:
             markdown = html_to_markdown(
-                content,
+                _canonicalise_void_elements(content),
                 heading_style="ATX",
                 bullets="-",
                 strip=["script", "style"],
diff --git a/glpi_python_client/content/tests/test_conversion.py b/glpi_python_client/content/tests/test_conversion.py
index 03ff4a6..42c50bc 100644
--- a/glpi_python_client/content/tests/test_conversion.py
+++ b/glpi_python_client/content/tests/test_conversion.py
@@ -722,3 +722,121 @@ def test_an_unterminated_declaration_at_end_of_input_is_kept() -> None:
 
     assert GlpiContentConverter.from_transport(shallow) == "keep this\n\n<!weird"
     assert GlpiContentConverter.from_transport(deep) == "keep this\n\n<!weird"
+
+
+@pytest.mark.parametrize(
+    ("html", "expected"),
+    [
+        pytest.param(
+            "<p>one<br>two<br />three</p>",
+            "one  \ntwo  \nthree",
+            id="br-both-spellings",
+        ),
+        pytest.param(
+            "<p>Bonjour,<br>Le serveur ne repond plus.<br />Merci de regarder.</p>",
+            "Bonjour,  \nLe serveur ne repond plus.  \nMerci de regarder.",
+            id="realistic-body",
+        ),
+        pytest.param(
+            "<p>line1<br>line2</p><p>para2<br />line4</p>",
+            "line1  \nline2\n\npara2  \nline4",
+            id="across-paragraphs",
+        ),
+        pytest.param(
+            "<p>a<br>b<br />c<br>d<br />e</p>",
+            "a  \nb  \nc  \nd  \ne",
+            id="alternating",
+        ),
+        pytest.param(
+            "<p>one<img>two<img />three</p>",
+            "one![]()two![]()three",
+            id="img",
+        ),
+        pytest.param(
+            "<p>one<hr>two<hr />three</p>",
+            "one\n\n---\n\ntwo\n\n---\n\nthree",
+            id="hr",
+        ),
+    ],
+)
+def test_a_body_using_both_spellings_of_a_void_tag_keeps_its_text(
+    html: str, expected: str
+) -> None:
+    """Text after the second spelling of ``<br>`` used to be dropped.
+
+    A ``beautifulsoup4`` defect, silent when it fires and reachable from
+    ordinary editor output: a bare ``<br>`` leaves its name in
+    ``already_closed_empty_element`` for a ``</br>`` that never comes, and
+    the next ``<br />`` closes itself against that stale entry and stays
+    open. Every later sibling becomes its child, and ``convert_br``
+    discards an element's children.
+
+    Note the paragraph case: the two spellings need not be near each
+    other, because a name once recorded poisons the rest of the document.
+    ``<img>`` and ``<hr>`` are the other two converters that drop
+    children, so they lose text the same way.
+    """
+
+    assert GlpiContentConverter.from_transport(html) == expected
+
+
+@pytest.mark.parametrize(
+    "html",
+    [
+        pytest.param("<div/>x", id="self-closed-non-void"),
+        pytest.param("<custom />x", id="self-closed-unknown"),
+        pytest.param("<p>a<br>b</p>", id="already-bare"),
+        pytest.param("<p>2 /> 3</p>", id="slash-gt-in-text"),
+        pytest.param('<div title="<br />">x</div>', id="in-an-attribute"),
+        pytest.param("<script>var s = '<br />';</script>x", id="in-a-script-body"),
+        pytest.param("<!-- <br /> -->x", id="in-a-comment"),
+        pytest.param("<p>a<br  /  >b</p>", id="slash-not-abutting-gt"),
+    ],
+)
+def test_the_void_rewrite_leaves_everything_else_alone(html: str) -> None:
+    """The rewrite is confined to void tags in real tag position.
+
+    ``<div/>`` is left as it is -- rewriting it would change what the
+    document means, and it cannot be affected anyway, since only a void
+    name is ever recorded as already closed. The last case is the one
+    worth pinning: ``<br  /  >`` reaches the parser as an ordinary start
+    tag, because its ``/`` does not abut the ``>``, so it never takes the
+    path that loses text and needs no rewriting.
+    """
+
+    assert conversion._canonicalise_void_elements(html) == html
+
+
+def test_the_void_rewrite_changes_nothing_for_one_spelling_alone() -> None:
+    """A body that picks a spelling and keeps it converts exactly as before.
+
+    The rewrite exists to remove an asymmetry between two spellings of the
+    same node, so it must be invisible to every body that does not mix
+    them. Measured over 4000 fuzzed documents of each spelling: not one
+    output moved.
+    """
+
+    bare = "<p>a<br>b<img><hr>c</p>"
+    slashed = "<p>a<br />b<img /><hr />c</p>"
+
+    assert GlpiContentConverter.from_transport(bare) == "a  \nb![]()\n\n---\n\nc"
+    assert GlpiContentConverter.from_transport(slashed) == "a  \nb![]()\n\n---\n\nc"
+
+
+def test_both_paths_agree_on_a_body_using_both_spellings() -> None:
+    """The degraded path already kept this text; now the converting one does.
+
+    This body was the one place where the fallback said *more* than the
+    conversion it stands in for, which is the wrong way round for a
+    fallback and was how the defect was noticed at all.
+    """
+
+    shallow = "<p>one<br>two<br />three</p>"
+    deep = "<div>" * 300 + shallow + "</div>" * 300
+
+    converted = GlpiContentConverter.from_transport(shallow)
+    degraded = GlpiContentConverter.from_transport(deep)
+
+    for word in ("one", "two", "three"):
+        assert word in converted
+        assert word in degraded

From e4eef06c087ccaef2f0f7d7fcd36b9d2e16d9f35 Mon Sep 17 00:00:00 2001
From: baraline <antoine.guillaume45@gmail.com>
Date: Tue, 8 Sep 2026 15:12:55 +0200
Subject: [PATCH 08/14] fix(content): read tag ends, and serializer faults, the
 way they behave

Round two of the adversarial review returned five confirmed findings.
Two were unbounded depth under-counts of exactly the kind the ceiling
exists to prevent, and every one of the five came from taking a rule from
somewhere other than the thing that implements it.

Depth, both unbounded and both also deleting prose at any depth:

- `parse_endtag` falls back to `rawdata.find(">")`, so an end tag skips
  nothing; CPython's own comment concedes the case, "this is not 100%
  correct, since we might have things like `</tag attr=">">`". Reading one
  with attribute rules made `'</x a="><div>">' * 600` measure 0 against a
  real 600, and raise. End tags now have their own branch.
- `locatestarttagend_tolerant` reaches a quoted value only through an
  attribute name, and a name may itself begin with `=`. So `<div ="<p>`
  opens no value and ends at the first `>`, where treating any `=` before
  a quote as a value indicator made `'<div ="' + "<p>" * 600` measure 1
  against a real 600. The attribute pattern is now a sequence of
  attributes rather than a run of permitted characters.

The name in that sequence carries the parser's "starts after a quote,
whitespace or `/`" rule, which turned out to be load-bearing twice: it is
what makes `<div ="` a name, and it is what stops the pattern
backtracking catastrophically. My first attempt omitted it and a
400-byte `'<div a="' * 50` did not finish.

Cost, which the review also caught as a false claim rather than only a
slow path: a body of nothing but `<div a="` cost O(n**2) -- 32 KB in
6.6 s -- because `re` restarts at every `<` where html.parser buffers an
incomplete tag and never looks back. No `>` anywhere means no element
anywhere, so that is answered in constant time now. The remaining
non-linear shape is documented rather than papered over: bounding the
attribute repetition would make a tag past the bound fail to match, which
is an under-count, and unbounded again once such tags nest.

Taxonomy, on the write path: outbound conversion runs in a
PlainSerializer, and pydantic-core catches everything a serializer raises
and re-raises PydanticSerializationError -- a ValueError, not a
GlpiError, with `__cause__` and `__context__` both None. So on every
create_*/update_* carrying a body, `except GlpiError` did not fire and the
underlying fault was unrecoverable. C1's whole point, gone on half the
surface. The fault is now stashed as it is raised and restored around
model_dump with its cause intact; a serialisation failure that is not
content becomes GlpiValidationError rather than being mislabelled.

Aliases: one field spelled two ways shadowed itself. Pydantic consumes
the first alias and extra="allow" files the rest as model extras -- and
an extra named after a field is emitted by model_dump *instead of* that
field, so the attribute reported one body and the object's own dump
reported the other. The redundant spelling is dropped before Pydantic
resolves anything, and content_html is now the first choice, so a dump
carrying both round-trips back to the raw body.

Numbers, re-measured because the review found several that did not
reproduce: the cliff is 494 (495 for `<ul><li>`), not 492; a 200-level
document peaks at 412 frames, not 403; `_strip_tags` runs at 2.2-11.5
MB/s depending on tag density, not 4-8, and is 2.3x to 18x faster than
the call it stands in for, not "roughly ten times". The call-site frame
counts described a call site this branch deleted -- conversion no longer
happens inside the fetch, so it is 5 frames below the caller reading
.content, the same 5 whether the model came from model_validate or from
get_ticket, and 9 on the write path. The void-element set is copied from
`bs4.builder`, not `bs4.builder._htmlparser`.

Re-fuzzed with end tags carrying attributes and name-less `="` in the
corpus, which is what round two's corpus lacked: 15000 documents with 0
depth under-counts against the tree that is actually converted and 0
losing a prose word, plus 3000 deep documents with none reaching
markdownify.

One finding is left as documented behaviour rather than fixed:
`model_copy(update={"content": ...})` updates nothing, because `content`
is a cached_property and the value lands in model extras. It is named
outright in the module docstring and the changelog now, since a caller
redacting a body that way gets an object whose .content still holds the
original.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 CHANGELOG.md                                  |  83 ++++++++--
 .../_async/clients/commons/_payloads.py       |  14 +-
 .../_sync/clients/commons/_payloads.py        |  14 +-
 glpi_python_client/content/conversion.py      | 156 +++++++++++++-----
 .../content/tests/test_conversion.py          | 103 ++++++++++++
 glpi_python_client/models/_base.py            |  61 +++++++
 .../models/api_schema/_content.py             |  92 ++++++++++-
 .../models/api_schema/tests/test_content.py   |  86 ++++++++++
 glpi_python_client/models/tests/test_base.py  |  58 ++++++-
 9 files changed, 601 insertions(+), 66 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c9d0e99..c809849 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,9 +11,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 - **Deeply nested HTML raised `RecursionError` while a model was being
   validated.** `markdownify` walks the parsed document recursively and
   spends about two CPython frames per nesting level, so roughly 494 levels
-  exhausted the default 1000-frame limit — measured, and the same 494
-  whether the nesting is `<div>`, `<p>`, `<blockquote>`, `<ul><li>` or
-  `<table><tr><td>`, which is what identifies the cost as per-level. An
+  exhausted the default 1000-frame limit — measured, and the same 494 for
+  `<div>`, `<p>`, `<blockquote>` and `<table><tr><td>`, 495 for
+  `<ul><li>`, which is what identifies the cost as per-level. An
   unclosed tag counts too: `html.parser` does not auto-close `<p>` or
   `<li>`, so `"<p>" * 5000` really is 5000 levels.
 
@@ -73,15 +73,18 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   `?a=1©right=2` under `unescape` and is left alone by the parser. A
   semicolon-less reference resolves only when its whole name is known.
 
-  The ceiling is 200 rather than 492 because the budget is not 1000
+  The ceiling is 200 rather than 494 because the budget is not 1000
   frames, it is whatever is left of the stack when conversion starts, and
-  that belongs to the caller. Measured at the call site: 8 frames through
-  the synchronous client, 16 through the asynchronous one, 37 from twenty
-  nested awaits. The library's own contribution is negligible; an
-  application converting from inside a request handler or a recursive
-  walk is not. Converting a 200-level document peaks at a measured 403
-  frames, so it stays safe until the caller's own stack passes roughly
-  590 — and no document a human wrote nests 200 elements deep.
+  that belongs to the caller. The package's own contribution is small,
+  and since conversion moved to the attribute it no longer depends on how
+  the record was fetched: measured, 5 frames below the caller when
+  `.content` is read — the same 5 whether the model came from
+  `model_validate` or from `client.get_ticket` — and 9 on the write path,
+  where the renderer runs inside `model_dump`. What is not small is an
+  application reading `.content` from inside a request handler or a
+  recursive walk. Converting a 200-level document peaks at a measured 412
+  frames, so it stays safe until the caller's own stack passes about
+  588 — and no document a human wrote nests 200 elements deep.
 
   **`sys.setrecursionlimit` was considered and rejected.** It is
   process-global state belonging to the application, not to a library the
@@ -92,6 +95,64 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   `testing/tests/test_raise_site_audit.py` rather than left as a comment
   for the next person to weigh up again.
 
+- **Where a tag *ends* was read with start-tag rules, twice.** Both were
+  unbounded depth under-counts, which is the one direction the ceiling
+  exists to prevent, and both also deleted prose from the degraded path at
+  any depth.
+
+  `parse_endtag` falls back to `rawdata.find(">")`, so an end tag skips
+  nothing — CPython's own comment concedes the case: "this is not 100%
+  correct, since we might have things like `</tag attr=">">`". Reading one
+  with attribute rules made `'</x a="><div>">' * 600` measure **0**
+  against a real 600.
+
+  `locatestarttagend_tolerant` reaches a quoted value only through an
+  attribute *name*, and a name may itself begin with `=`. So in
+  `<div ="<p><p>">` the parser reads the name `="<p` and ends the tag at
+  the first `>`, where treating any `=` before a quote as a value
+  indicator swallowed the rest: `'<div ="' + "<p>" * 600` measured **1**
+  against a real 600.
+
+  The attribute pattern is now a sequence of attributes rather than a run
+  of permitted characters, and end tags have their own branch. The
+  attribute name carries the parser's own "starts after a quote,
+  whitespace or `/`" rule, which is load-bearing twice over: without it
+  `<div ="` reads as a value, *and* the pattern backtracks
+  catastrophically — a 400-byte `'<div a="' * 50` did not finish.
+
+- **A body of nothing but `<div a="` cost O(n²).** 32 KB took 6.6 s. `re`
+  restarts at every `<` where `html.parser` buffers an incomplete tag and
+  never looks back. No `>` anywhere means no element anywhere, so that is
+  now answered in constant time. The remaining non-linear shape is
+  documented rather than papered over: bounding the attribute repetition
+  would make a tag past the bound fail to match, which is an *under*-count
+  and unbounded once such tags nest.
+
+- **`GlpiContentError` did not survive the write path.** Outbound
+  conversion runs in a `PlainSerializer`, and pydantic-core catches
+  everything a serializer raises and re-raises `PydanticSerializationError`
+  — a `ValueError`, not a `GlpiError`, with `__cause__` and `__context__`
+  both `None`. So on every `create_*`/`update_*` carrying a body,
+  `except GlpiError` did not fire and the underlying fault was
+  unrecoverable. The fault is now stashed as it is raised and restored
+  around `model_dump`, with its own `__cause__` intact; a serialisation
+  failure that is *not* content becomes `GlpiValidationError` rather than
+  being mislabelled.
+
+- **One field spelled two ways shadowed itself in `model_dump`.** Pydantic
+  consumes the first alias and `extra="allow"` files the rest as model
+  extras — and an extra named after a field is emitted *instead of* that
+  field, so the attribute reported one body and the object's own dump
+  reported the other. The redundant spelling is now dropped before
+  Pydantic resolves anything, and `content_html` is the first choice, so a
+  dump carrying both round-trips back to the raw body.
+
+  Worth knowing about the read models: `model_copy(update={"content": ...})`
+  — the 0.4.x spelling — updates **nothing**, because `content` is now a
+  `cached_property`. A caller redacting a body that way gets an object
+  whose `.content` still holds the original. Rewrite `content_html`, or
+  rebuild through `model_validate`.
+
 - **A body that used both spellings of `<br>` lost everything after the
   second one.** `<p>line1<br>line2</p><p>para2<br />line4</p>` converted
   to `line1  \nline2\n\npara2` — `line4` silently gone, no error, on the
diff --git a/glpi_python_client/_async/clients/commons/_payloads.py b/glpi_python_client/_async/clients/commons/_payloads.py
index 69e1232..f1792b4 100644
--- a/glpi_python_client/_async/clients/commons/_payloads.py
+++ b/glpi_python_client/_async/clients/commons/_payloads.py
@@ -14,6 +14,7 @@
     SERVER_TIMEZONE_CONTEXT_KEY,
     GlpiModel,
 )
+from glpi_python_client.models.api_schema._content import restoring_content_faults
 
 ModelT = TypeVar("ModelT", bound=GlpiModel)
 
@@ -54,12 +55,13 @@ def model_to_payload(
         if server_timezone is not None
         else None
     )
-    body = model.model_dump(
-        mode="json",
-        exclude_none=True,
-        exclude={"extra_payload"},
-        context=context,
-    )
+    with restoring_content_faults():
+        body = model.model_dump(
+            mode="json",
+            exclude_none=True,
+            exclude={"extra_payload"},
+            context=context,
+        )
     if model.extra_payload:
         body.update(model.extra_payload)
     return body
diff --git a/glpi_python_client/_sync/clients/commons/_payloads.py b/glpi_python_client/_sync/clients/commons/_payloads.py
index 69e1232..f1792b4 100644
--- a/glpi_python_client/_sync/clients/commons/_payloads.py
+++ b/glpi_python_client/_sync/clients/commons/_payloads.py
@@ -14,6 +14,7 @@
     SERVER_TIMEZONE_CONTEXT_KEY,
     GlpiModel,
 )
+from glpi_python_client.models.api_schema._content import restoring_content_faults
 
 ModelT = TypeVar("ModelT", bound=GlpiModel)
 
@@ -54,12 +55,13 @@ def model_to_payload(
         if server_timezone is not None
         else None
     )
-    body = model.model_dump(
-        mode="json",
-        exclude_none=True,
-        exclude={"extra_payload"},
-        context=context,
-    )
+    with restoring_content_faults():
+        body = model.model_dump(
+            mode="json",
+            exclude_none=True,
+            exclude={"extra_payload"},
+            context=context,
+        )
     if model.extra_payload:
         body.update(model.extra_payload)
     return body
diff --git a/glpi_python_client/content/conversion.py b/glpi_python_client/content/conversion.py
index 2e41130..86c938f 100644
--- a/glpi_python_client/content/conversion.py
+++ b/glpi_python_client/content/conversion.py
@@ -82,9 +82,11 @@
 #: costs an unnecessary degradation, while a name wrongly *in* here hides
 #: real nesting, which is a ``RecursionError``. Listing the legacy names
 #: only makes the count exact on old markup. Copied rather than imported --
-#: it lives in ``bs4.builder._htmlparser``, which is private -- and the
-#: subset invariant is asserted against a real parse in the unit tests, so
-#: a future ``bs4`` cannot quietly break it.
+#: it lives in ``bs4.builder`` as
+#: ``HTMLTreeBuilder.DEFAULT_EMPTY_ELEMENT_TAGS``, which ``bs4``'s own
+#: documentation marks ``:meta private:`` -- and the subset invariant is
+#: asserted against a real parse in the unit tests, so a future ``bs4``
+#: cannot quietly break it. The two sets currently hold the same 24 names.
 _VOID_ELEMENTS = frozenset(
     """
     area base basefont bgsound br col command embed frame hr image img
@@ -115,20 +117,23 @@
 #: ``markdownify`` walks the parsed tree recursively and spends about two
 #: CPython frames per nesting level. Measured against the default
 #: 1000-frame limit, from a shallow stack, the deepest document that
-#: converts is 492 levels -- and the same 492 whether the nesting is
-#: ``<div>``, ``<p>``, ``<blockquote>``, ``<ul><li>`` or
-#: ``<table><tr><td>``, which is what identifies the cost as per-level.
-#: One level past it raises ``RecursionError``.
+#: converts is 494 levels: the same 494 for ``<div>``, ``<p>``,
+#: ``<blockquote>`` and ``<table><tr><td>``, and 495 for ``<ul><li>``,
+#: which is what identifies the cost as per-level. One level past it
+#: raises ``RecursionError``.
 #:
-#: The ceiling is 200 rather than 492 because the budget is not 1000 frames,
+#: The ceiling is 200 rather than 494 because the budget is not 1000 frames,
 #: it is whatever is left of the stack when the conversion starts, and that
-#: belongs to the caller. Measured at the conversion call site: 8 frames
-#: through the synchronous client, 16 through the asynchronous one, 37 from
-#: twenty nested awaits. The library's own contribution is negligible; an
-#: application calling from inside a request handler, a template render or a
-#: recursive walk is not. Converting a 200-level document was measured to
-#: peak at 403 frames, so it stays safe until the caller's own stack passes
-#: roughly 590 -- and no document a human wrote nests 200 elements deep.
+#: belongs to the caller. The package's own contribution is small and, since
+#: conversion moved to the attribute, no longer depends on how the record
+#: was fetched: measured, 5 frames below the caller when ``.content`` is
+#: read -- the same 5 whether the model came from ``model_validate`` or from
+#: ``client.get_ticket`` -- and 9 on the write path, where the renderer runs
+#: inside ``model_dump``. What is not small is an application reading
+#: ``.content`` from inside a request handler, a template render or a
+#: recursive walk. Converting a 200-level document was measured to peak at
+#: 412 frames, so it stays safe until the caller's own stack passes about
+#: 588 -- and no document a human wrote nests 200 elements deep.
 #:
 #: **``sys.setrecursionlimit`` is deliberately not called, here or anywhere
 #: in the package.** It is process-global state that belongs to the
@@ -170,12 +175,23 @@
 #:    ``strip=["script", "style"]`` discards both on the normal path, so
 #:    the degraded path discards them too. The ``$`` alternative covers an
 #:    unclosed one, whose body the parser also reads to the end as text.
-#: 5. A tag. The ``<`` must abut the name, matching what the parser
+#: 5. An end tag, which runs to its **first** ``>`` and skips nothing.
+#:    ``parse_endtag`` falls back to ``rawdata.find(">", ...)`` when its
+#:    strict pattern fails, and CPython's own comment there concedes the
+#:    consequence: "this is not 100% correct, since we might have things
+#:    like ``</tag attr=">">``". So the parser makes three tokens of
+#:    ``</x a="><div>">`` -- an end tag, a real ``<div>`` and some text --
+#:    where reading it with attribute rules makes one. That mattered:
+#:    every repetition closed nothing and opened a ``<div>`` that never
+#:    closed, so ``'</x a="><div>">' * 600`` measured **0** against a real
+#:    600 and raised. It also has to allow ``</ p>``, since the strict
+#:    pattern starts ``</\s*``.
+#: 6. A start tag. The ``<`` must abut the name, matching what the parser
 #:    accepts -- which is what keeps ``2 < 3 > 1`` and ``x <= y`` text: a
 #:    space after ``<`` means no tag, so arithmetic never reaches the HTML
 #:    path in the first place.
 #:
-#: Branches 4 and 5 read attributes with :data:`_ATTRIBUTES` rather than
+#: Branches 4 and 6 read attributes with :data:`_ATTRIBUTES` rather than
 #: ``[^<>]*``, because an attribute value may legally contain ``<`` and
 #: ``>``. Skipping over quotes is not cosmetic: measured,
 #: ``'<div title="</div>">' * 600`` used to measure **0** levels deep when
@@ -209,7 +225,38 @@
 #: -- through ``markdownify`` and into the ``RecursionError`` the ceiling
 #: exists to prevent. A malformed ``<custom=>`` costs nothing, but the
 #: raw-text names make it unbounded, so the gate belongs on both branches.
-_ATTRIBUTES = r"""(?=[\s/>])(?:[^>=]|=\s*"[^"]*"|=\s*'[^']*'|=\s*(?!["'])[^\s>]*)*"""
+#:
+#: Which makes the shape below a *sequence of attributes* rather than a
+#: run of permitted characters, because only a real attribute can open a
+#: quoted value. The authority is ``locatestarttagend_tolerant``, which is
+#: what decides where a start tag ends; a value is reachable only through
+#: the name group ``(?<=['"\s/])[^\s/>][^\s/=>]*``, and an attribute name
+#: may itself begin with ``=`` and contain ``"`` and ``<``. So in
+#: ``<div ="<p><p>">`` the parser reads the attribute *name* ``="<p``,
+#: opens no value at all, and ends the tag at the first ``>``. Treating
+#: any ``=`` before a quote as a value indicator swallowed the rest:
+#: measured, ``'<div ="' + "<p>" * 600`` gave **1** level against a real
+#: 600, cleared the ceiling and raised. Whitespace between name and ``=``
+#: is fine (``<div a ="x>y">`` really does quote its value), which is why
+#: the name has to be matched rather than approximated by a lookbehind.
+#: One attribute value, as ``locatestarttagend_tolerant`` reads one.
+_ATTRIBUTE_VALUE = r"""(?:"[^"]*"|'[^']*'|(?!["'])[^\s>]*)"""
+
+#: One attribute: a name, then optionally ``=`` and a value.
+#:
+#: The leading lookbehind is the parser's own -- an attribute name starts
+#: only after a quote, whitespace or ``/`` -- and it is load-bearing twice
+#: over. It is what makes ``<div ="`` read as a name rather than a value,
+#: and it is what keeps this pattern from backtracking catastrophically:
+#: without it, ``[^\s/>][^\s/=>]*`` under the outer ``*`` below can split
+#: one run of name characters in exponentially many ways, and a 400-byte
+#: ``'<div a="' * 50`` did not finish. With it, a name can only begin
+#: where a delimiter precedes it, so there is nothing to split.
+_ATTRIBUTE = (
+    r"""(?<=['"\s/])[^\s/>][^\s/=>]*(?:\s*=+\s*""" + _ATTRIBUTE_VALUE + r""")?"""
+)
+
+_ATTRIBUTES = r"""(?=[\s/>])(?:[\s/]+|""" + _ATTRIBUTE + r""")*"""
 
 _MARKUP = re.compile(
     r"<!--.*?-->"
@@ -217,7 +264,8 @@
     r"|(?P<decl><[!?][^>]*>?)"
     r"|<(?P<raw>script|style)" + _ATTRIBUTES + r"(?<!/)>"
     r"(?P<rawbody>.*?)(?:</(?P=raw)\s*>|(?P<rawcut>$))"
-    r"|</?(?P<name>[a-zA-Z][^\t\n\r\f />\x00]*)" + _ATTRIBUTES + r">",
+    r"|</\s*(?P<close>[a-zA-Z][^\t\n\r\f />\x00]*)[^>]*>"
+    r"|<(?P<name>[a-zA-Z][^\t\n\r\f />\x00]*)" + _ATTRIBUTES + r">",
     re.DOTALL | re.IGNORECASE,
 )
 
@@ -291,11 +339,27 @@ def _looks_like_html(content: str) -> bool:
 def _html_nesting_depth(content: str) -> int:
     """Return how deeply ``content`` nests, without recursing to find out.
 
-    One linear pass over the tag candidates, keeping the open elements on a
-    list and its high-water mark. Linear in the length of the input and flat
-    in the stack, which is the point: the number this returns decides
-    whether a recursive parser is safe to run, so computing it must not need
-    one. Measured, it costs 4-6% of the ``markdownify`` call it guards.
+    One pass over the tag candidates, keeping the open elements on a list
+    and its high-water mark. Flat in the stack, which is the point: the
+    number this returns decides whether a recursive parser is safe to run,
+    so computing it must not need one.
+
+    Linear on any content a client or a mail gateway produces, and measured
+    at 4-6% of the ``markdownify`` call it guards: 148 KB of well-formed
+    HTML in 19 ms, the same body truncated mid-attribute in 22 ms, 296 KB
+    with an unpaired quote in the middle in 41 ms.
+
+    Not linear in the worst case, which is worth stating plainly rather
+    than claiming a bound this does not have. ``re`` restarts at every
+    ``<`` where ``html.parser`` buffers an incomplete tag and never looks
+    back, so a document whose every tag leaves an unpaired quote and which
+    carries no ``>`` until the very end -- ``'<div a="b" c="' * n`` --
+    costs O(n**2): 28 KB in 3 s. The simplest such shape, no ``>`` at all,
+    is answered in constant time by the guard below; the rest is a crafted
+    string rather than a truncation, and the obvious fix is worse than the
+    problem, since bounding the attribute repetition would make a tag past
+    the bound fail to match, which is an *under*-count, and unbounded
+    again once such tags nest.
 
     Four rules make the count match the tree ``html.parser`` will actually
     build. The first two are what an open/close counter would get wrong:
@@ -349,7 +413,12 @@ def _html_nesting_depth(content: str) -> int:
         text with no tags at all.
     """
 
-    if "<" not in content:
+    if "<" not in content or ">" not in content:
+        # No ``>`` anywhere means no element anywhere: the parser buffers an
+        # incomplete tag and flushes it as text when it closes. Checking is
+        # also what keeps a body of nothing but ``'<div a="'`` cheap -- this
+        # scan restarts at every ``<`` where the parser never backtracks, so
+        # that shape costs it O(n) and would cost this O(n**2).
         return 0
     stack: list[str] = []
     open_names: Counter[str] = Counter()
@@ -360,20 +429,23 @@ def _html_nesting_depth(content: str) -> int:
             # node one level below whatever is open around it.
             deepest = max(deepest, len(stack) + 1)
             continue
-        name = match.group("name")
-        if name is None:
-            continue  # a comment, a declaration or a processing instruction
-        name = name.lower()
-        token = match.group(0)
-        if token[1] == "/":
-            if not open_names[name]:
+        closing = match.group("close")
+        if closing is not None:
+            closing = closing.lower()
+            if not open_names[closing]:
                 continue  # nothing of that name is open, so bs4 pops nothing
             while True:
                 popped = stack.pop()
                 open_names[popped] -= 1
-                if popped == name:
+                if popped == closing:
                     break
-        elif token.endswith("/>") or name in _VOID_ELEMENTS:
+            continue
+        name = match.group("name")
+        if name is None:
+            continue  # a comment, a declaration or a processing instruction
+        name = name.lower()
+        token = match.group(0)
+        if token.endswith("/>") or name in _VOID_ELEMENTS:
             deepest = max(deepest, len(stack) + 1)
         else:
             stack.append(name)
@@ -389,8 +461,11 @@ def _strip_tags(content: str) -> str:
     of :data:`_MARKUP` -- the same scanner the depth measurement uses, so
     the two agree about what is markup -- then whitespace tidying. No tree,
     no recursion, no depth ceiling of its own, so it answers for input of
-    any shape. Measured at 4-8 MB/s depending on tag density, roughly ten
-    times faster than the ``markdownify`` call it stands in for.
+    any shape. Tag density decides the rest, and decides it over a wide
+    range: measured at 2.2 MB/s on 128 KB of table cells and 11.5 MB/s on
+    217 KB of sparse prose, which is 18x and 2.3x faster respectively than
+    the ``markdownify`` call it stands in for. Dense markup is where it
+    pays best, which is the shape a document at this depth has.
 
     It **degrades and never truncates.** The property, stated as something
     checkable: after collapsing whitespace, every character the converting
@@ -444,14 +519,17 @@ def _strip_tags(content: str) -> str:
 
     pieces: list[str] = []
     cursor = 0
-    for match in _MARKUP.finditer(content):
+    # ``>`` gates the scan for the reason given in :func:`_html_nesting_depth`:
+    # without one there is no markup to skip, and the whole document is the
+    # text the parser would flush on ``close()``.
+    for match in _MARKUP.finditer(content) if ">" in content else ():
         pieces.append(content[cursor : match.start()])
         cursor = match.end()
         cdata = match.group("cdata")
         if cdata is not None:
             pieces.append(cdata)
             continue
-        name = match.group("name")
+        name = match.group("name") or match.group("close")
         if name is not None:
             if name.lower() in _BLOCK_ELEMENTS:
                 pieces.append("\n")
@@ -549,7 +627,7 @@ def _canonicalise_void_elements(content: str) -> str:
         if name is None or name.lower() not in _VOID_ELEMENTS:
             continue
         token = match.group(0)
-        if token.startswith("</") or not token.endswith("/>"):
+        if not token.endswith("/>"):
             continue
         pieces.append(content[cursor : match.start()])
         pieces.append(_VOID_SELF_CLOSE.sub(">", token))
diff --git a/glpi_python_client/content/tests/test_conversion.py b/glpi_python_client/content/tests/test_conversion.py
index 42c50bc..fe92344 100644
--- a/glpi_python_client/content/tests/test_conversion.py
+++ b/glpi_python_client/content/tests/test_conversion.py
@@ -840,3 +840,106 @@ def test_both_paths_agree_on_a_body_using_both_spellings() -> None:
     for word in ("one", "two", "three"):
         assert word in converted
         assert word in degraded
+
+
+@pytest.mark.parametrize(
+    ("html", "reason"),
+    [
+        pytest.param(
+            '</x a="><div>">',
+            "an end tag skips nothing, so the <div> after it is real",
+            id="end-tag-with-a-quoted-attribute",
+        ),
+        pytest.param(
+            '<div ="<p><p>">',
+            "a name-less = starts an attribute NAME, not a quoted value",
+            id="name-less-equals-quote",
+        ),
+        pytest.param(
+            '<div a ="x>y">',
+            "whitespace before = still leaves a quoted value",
+            id="space-before-equals",
+        ),
+        pytest.param(
+            "</ p>x",
+            "the strict end-tag pattern allows space after </",
+            id="space-in-end-tag",
+        ),
+        pytest.param("</p/>x", "a trailing slash on an end tag", id="slash-in-end-tag"),
+        pytest.param(
+            '<li y=">mot<script data-x="</div>">tail',
+            "< inside a tag",
+            id="lt-after-a-value",
+        ),
+    ],
+)
+def test_the_depth_scan_reads_tag_ends_like_the_parser(html: str, reason: str) -> None:
+    """Where a tag *ends* is decided by three different parser functions.
+
+    Each of these was read with start-tag rules until it was measured, and
+    two of them under-counted without bound:
+
+    * ``parse_endtag`` falls back to ``rawdata.find(">")``, so an end tag
+      skips nothing -- ``'</x a="><div>">' * 600`` measured **0** against a
+      real 600 and raised.
+    * ``locatestarttagend_tolerant`` reaches a quoted value only through an
+      attribute *name*, and a name may itself start with ``=`` -- so
+      ``'<div ="' + "<p>" * 600`` measured **1** against a real 600.
+
+    ``reason`` is carried only to say why each case is here.
+    """
+
+    assert _html_nesting_depth(html) == _parser_depth(html)
+
+
+@pytest.mark.parametrize(
+    "fragment",
+    [
+        pytest.param('</x a="><div>">', id="end-tag-with-a-quoted-attribute"),
+        pytest.param('<div ="<p>', id="name-less-equals-quote"),
+        pytest.param('<p title="><span>">', id="quoted-gt-then-tag"),
+    ],
+)
+def test_a_misread_tag_end_cannot_hide_the_depth_below_it(fragment: str) -> None:
+    """Scaled past the ceiling: degrades, and does not raise.
+
+    The under-counts these come from were 1:1 with the repetition, so the
+    deficit grew without bound and the document cleared the ceiling.
+    """
+
+    html = fragment * 600 + "the printer is offline"
+
+    assert _html_nesting_depth(html) >= _parser_depth(html)
+    assert "the printer is offline" in GlpiContentConverter.from_transport(html)
+
+
+def test_a_misread_tag_end_does_not_delete_prose() -> None:
+    """The other half of the same defect, and it needs no depth at all.
+
+    Reading an end tag with attribute rules consumed everything between
+    the opening quote and its partner, so a degraded body said less than
+    the converting one -- the divergence the parity test forbids.
+    """
+
+    body = '<p>Bonjour</p title="> Le serveur ne repond plus. SECRET ">fin'
+    deep = "<div>" * 300 + body + "</div>" * 300
+
+    assert "SECRET" in GlpiContentConverter.from_transport(body)
+    assert "SECRET" in GlpiContentConverter.from_transport(deep)
+
+
+def test_a_document_with_no_closing_bracket_is_answered_without_scanning() -> None:
+    """No ``>`` means no element, and saying so keeps a bad shape cheap.
+
+    ``re`` restarts at every ``<`` where ``html.parser`` buffers an
+    incomplete tag and never looks back, so ``'<div a="' * n`` cost this
+    scan O(n**2) -- 32 KB in 6.6 s -- while the parser answers it in one
+    pass. The guard makes it constant time, and the text still survives,
+    because the parser flushes an unfinished tag as data when it closes.
+    """
+
+    html = '<div a="' * 4000
+
+    assert _html_nesting_depth(html) == 0
+    assert GlpiContentConverter.from_transport(html).startswith('<div a="')
+    assert "the printer" in GlpiContentConverter.from_transport(html + "the printer")
diff --git a/glpi_python_client/models/_base.py b/glpi_python_client/models/_base.py
index 8fdab84..8980cc6 100644
--- a/glpi_python_client/models/_base.py
+++ b/glpi_python_client/models/_base.py
@@ -102,6 +102,54 @@ def _payload_keys(model_class: type[BaseModel]) -> frozenset[str]:
     return resolved
 
 
+#: Cache for :func:`_alias_groups`, keyed the same way as
+#: :data:`_PAYLOAD_KEYS`.
+_ALIAS_GROUPS: dict[type[BaseModel], tuple[tuple[str, ...], ...]] = {}
+
+
+def _alias_groups(model_class: type[BaseModel]) -> tuple[tuple[str, ...], ...]:
+    """Return the payload keys of every field that accepts more than one.
+
+    Each group is one field's accepted spellings **in the order Pydantic
+    tries them**, which for ``AliasChoices`` is the order they were
+    declared. Fields accepting a single key are left out, since there is
+    nothing to choose between.
+
+    Only plain string choices are listed. An ``AliasPath`` addresses a
+    position inside a nested structure rather than a key that could
+    duplicate another, so it is not a member of any group.
+
+    Parameters
+    ----------
+    model_class : type[BaseModel]
+        The concrete model being validated.
+
+    Returns
+    -------
+    tuple of tuple of str
+        One tuple per multi-spelling field, most-preferred spelling first.
+    """
+
+    cached = _ALIAS_GROUPS.get(model_class)
+    if cached is not None:
+        return cached
+    groups: list[tuple[str, ...]] = []
+    for field in model_class.model_fields.values():
+        keys: list[str] = []
+        alias = field.validation_alias
+        if isinstance(alias, AliasChoices):
+            keys.extend(choice for choice in alias.choices if isinstance(choice, str))
+        elif isinstance(alias, str):
+            keys.append(alias)
+        if field.alias is not None and field.alias not in keys:
+            keys.append(field.alias)
+        if len(keys) > 1:
+            groups.append(tuple(keys))
+    resolved = tuple(groups)
+    _ALIAS_GROUPS[model_class] = resolved
+    return resolved
+
+
 class GlpiModel(BaseModel):
     """Base class for field-validated GLPI data models.
 
@@ -128,11 +176,24 @@ def _capture_unknown_fields(cls, data: Any) -> Any:
         "Can consume" means field names *and* validation aliases -- see
         :func:`_payload_keys`. This validator runs before Pydantic resolves
         aliases, so a key it removes is a key the alias never gets to see.
+
+        A payload that spells one field two ways keeps only the spelling
+        Pydantic would have used, per :func:`_alias_groups`. The redundant
+        one is dropped rather than kept, because keeping it was worse than
+        it sounds: Pydantic consumes the winning alias, and ``extra="allow"``
+        then files the loser as a model extra, which ``model_dump`` emits
+        *over* the field it duplicates. Measured on ``GetTicket`` given both
+        ``content`` and ``content_html``, the attribute reported one body
+        and the object's own dump reported the other.
         """
 
         if not isinstance(data, dict):
             return data
         known = _payload_keys(cls)
+        for group in _alias_groups(cls):
+            present = [key for key in group if key in data]
+            for redundant in present[1:]:
+                del data[redundant]
         existing_extras = data.get("extra_payload")
         captured: dict[str, Any] = {}
         for key in list(data.keys()):
diff --git a/glpi_python_client/models/api_schema/_content.py b/glpi_python_client/models/api_schema/_content.py
index 048f10e..80154a7 100644
--- a/glpi_python_client/models/api_schema/_content.py
+++ b/glpi_python_client/models/api_schema/_content.py
@@ -66,14 +66,33 @@
 validated; if something really must rewrite the raw value, drop the cache
 with ``obj.__dict__.pop("content", None)`` or rebuild the model through
 ``model_validate``.
+
+``model_copy(update={"content": ...})`` -- the 0.4.x spelling, when
+``content`` was still a field -- is worse and worth naming outright: it
+updates **nothing**. ``content`` resolves to the class-level
+``cached_property``, so the attribute keeps the body it already had, while
+``extra="allow"`` files the value as a model extra that ``model_dump``
+then emits beside the real one. A caller redacting a body that way gets an
+object whose ``.content`` still holds the original text. Nothing warns,
+because from Pydantic's side nothing is wrong. Re-validating such a dump
+does at least keep the real body, since ``content_html`` is the first
+choice in the alias list and
+:func:`glpi_python_client.models._base._alias_groups` drops the loser
+before it can shadow the field -- but the copy itself is not a redaction.
+Rewrite the raw field, or rebuild through ``model_validate``.
 """
 
 from __future__ import annotations
 
+from collections.abc import Iterator
+from contextlib import contextmanager
+from contextvars import ContextVar
 from typing import Annotated
 
 from pydantic import AliasChoices, BeforeValidator, Field, PlainSerializer
+from pydantic_core import PydanticSerializationError
 
+from glpi_python_client._errors import GlpiContentError, GlpiValidationError
 from glpi_python_client.content.conversion import GlpiContentConverter
 
 
@@ -131,17 +150,83 @@ def markdown_view(raw: str | None) -> str | None:
     return GlpiContentConverter.from_transport(raw)
 
 
+#: The last content fault raised inside a serializer, for
+#: :func:`restoring_content_faults` to hand back.
+#:
+#: A ``ContextVar`` rather than a module global so two concurrent writes
+#: cannot read each other's fault; it is set immediately before the raise
+#: and cleared on the way into every dump.
+_LAST_CONTENT_FAULT: ContextVar[GlpiContentError | None] = ContextVar(
+    "glpi_last_content_fault", default=None
+)
+
+
 def _to_transport(value: str | None) -> str | None:
     """Render an outbound Markdown content value as the HTML GLPI expects.
 
     ``None`` is preserved so ``model_dump(exclude_none=True)`` continues to
     drop unset fields from request bodies. Empty Markdown is rendered as an
     empty string to stay consistent with the inbound converter behaviour.
+
+    A failure is recorded in :data:`_LAST_CONTENT_FAULT` before it is
+    raised, because raising it is not enough on its own: see
+    :func:`restoring_content_faults`.
     """
 
     if value is None:
         return None
-    return GlpiContentConverter.to_transport(value)
+    try:
+        return GlpiContentConverter.to_transport(value)
+    except GlpiContentError as exc:
+        _LAST_CONTENT_FAULT.set(exc)
+        raise
+
+
+@contextmanager
+def restoring_content_faults() -> Iterator[None]:
+    """Put a content fault raised inside ``model_dump`` back in the taxonomy.
+
+    Outbound conversion runs in a ``PlainSerializer``, and pydantic-core
+    catches everything a serializer function raises and re-raises its own
+    ``PydanticSerializationError``. The type is lost -- that class derives
+    from ``ValueError``, not from :class:`GlpiError`, so ``except
+    GlpiError`` does not fire -- and so is the chain: ``__cause__`` and
+    ``__context__`` both arrive as ``None``, leaving only the message text
+    embedded in a foreign exception.
+
+    Both halves of the package's error contract break there, on every write
+    that carries a body, which is every ``create_*`` and ``update_*`` with
+    ``content``. So the fault is stashed on the way out and re-raised here,
+    with its own traceback and its own ``__cause__`` -- the
+    ``RecursionError``, or whatever else the renderer hit -- intact. The
+    pydantic exception becomes its ``__context__``, which is where a
+    reader would look for the serializer detail anyway.
+
+    A ``PydanticSerializationError`` with no stashed fault is something
+    else entirely -- an unserialisable field, not a content problem -- so
+    it is wrapped as :class:`GlpiValidationError` rather than mislabelled.
+
+    Yields
+    ------
+    None
+        The block runs with content faults restored on the way out.
+    """
+
+    _LAST_CONTENT_FAULT.set(None)
+    try:
+        yield
+    except PydanticSerializationError as exc:
+        fault = _LAST_CONTENT_FAULT.get()
+        if fault is not None:
+            _LAST_CONTENT_FAULT.set(None)
+            # Rebuilt rather than re-raised so the raise-site audit can see
+            # the type. The chain is what matters and it survives: the
+            # original fault's own cause is carried across, and the
+            # pydantic wrapper becomes the context.
+            raise GlpiContentError(str(fault)) from fault.__cause__
+        raise GlpiValidationError(
+            f"Could not serialise the request body ({exc})."
+        ) from exc
 
 
 GlpiMarkdownContent = Annotated[
@@ -165,7 +250,7 @@ def _to_transport(value: str | None) -> str | None:
 GlpiRawContent = Annotated[
     str | None,
     Field(
-        validation_alias=AliasChoices("content", "content_html"),
+        validation_alias=AliasChoices("content_html", "content"),
         serialization_alias="content",
     ),
 ]
@@ -187,7 +272,7 @@ def _to_transport(value: str | None) -> str | None:
 GlpiRawDescription = Annotated[
     str | None,
     Field(
-        validation_alias=AliasChoices("description", "description_html"),
+        validation_alias=AliasChoices("description_html", "description"),
         serialization_alias="description",
     ),
 ]
@@ -203,4 +288,5 @@ def _to_transport(value: str | None) -> str | None:
     "GlpiRawContent",
     "GlpiRawDescription",
     "markdown_view",
+    "restoring_content_faults",
 ]
diff --git a/glpi_python_client/models/api_schema/tests/test_content.py b/glpi_python_client/models/api_schema/tests/test_content.py
index f3905ba..00cc8c1 100644
--- a/glpi_python_client/models/api_schema/tests/test_content.py
+++ b/glpi_python_client/models/api_schema/tests/test_content.py
@@ -13,11 +13,17 @@
 
 from __future__ import annotations
 
+import pytest
+from pydantic_core import PydanticSerializationError
+
+from glpi_python_client import GlpiContentError, GlpiError, GlpiValidationError
+from glpi_python_client._sync._testing import TransportRecorder, make_client
 from glpi_python_client._sync.clients.commons._payloads import model_to_payload
 from glpi_python_client.models.api_schema._content import (
     _from_transport,
     _to_transport,
     markdown_view,
+    restoring_content_faults,
 )
 from glpi_python_client.models.api_schema.assistance import GetTicket, PostTicket
 
@@ -71,3 +77,83 @@ def test_a_read_model_reads_none_when_glpi_sent_no_body() -> None:
 
     assert ticket.content_html is None
     assert ticket.content is None
+
+
+def test_a_content_fault_on_the_write_path_stays_in_the_taxonomy() -> None:
+    """pydantic-core destroys a serializer's exception; this puts it back.
+
+    Outbound conversion runs in a ``PlainSerializer``, and everything it
+    raises comes back out as ``PydanticSerializationError`` -- a
+    ``ValueError``, not a :class:`GlpiError`, with ``__cause__`` and
+    ``__context__`` both ``None``. Every ``create_*``/``update_*`` carrying
+    a body was affected, so ``except GlpiError`` did not fire on the one
+    path the package's error contract is most explicit about.
+    """
+
+    deep_markdown = "".join(" " * (4 * level) + "- x\n" for level in range(600))
+    client = make_client()
+    TransportRecorder().install(client)
+
+    with pytest.raises(GlpiContentError) as caught:
+        client.create_ticket(PostTicket(name="round trip", content=deep_markdown))
+
+    assert isinstance(caught.value, GlpiError)
+    assert not isinstance(caught.value, ValueError)
+    # the original fault, which pydantic-core had discarded
+    assert isinstance(caught.value.__cause__, RecursionError)
+    # and the serializer wrapper, kept where a reader would look for it
+    assert isinstance(caught.value.__context__, PydanticSerializationError)
+
+
+def test_a_serialisation_fault_that_is_not_content_is_not_mislabelled() -> None:
+    """Only a stashed content fault becomes a ``GlpiContentError``.
+
+    An unserialisable field is a different problem, and reporting it as a
+    content conversion failure would send a reader looking in the wrong
+    place. It also proves the stash cannot go stale: this block records no
+    fault of its own.
+    """
+
+    with pytest.raises(GlpiValidationError):
+        with restoring_content_faults():
+            raise PydanticSerializationError("unserialisable field")
+
+
+def test_one_field_spelled_twice_keeps_the_spelling_pydantic_uses() -> None:
+    """A duplicate spelling used to shadow the field in ``model_dump``.
+
+    ``extra="allow"`` filed the alias Pydantic did not consume as a model
+    extra, and ``model_dump`` emitted it *over* the real field: the
+    attribute reported one body and the object's own dump reported the
+    other. ``content_html`` is the first choice, so a dump that carries
+    both -- which is what ``model_copy(update={"content": ...})`` produces
+    -- round-trips back to the raw body rather than to the phantom.
+    """
+
+    both = GetTicket.model_validate(
+        {
+            "id": 1,
+            "content": "<p>from content</p>",
+            "content_html": "<p>from content_html</p>",
+        }
+    )
+
+    assert both.content_html == "<p>from content_html</p>"
+    assert both.model_extra == {}
+    assert both.extra_payload == {}
+    assert both.model_dump()["content_html"] == "<p>from content_html</p>"
+
+
+def test_a_glpi_payload_still_populates_the_raw_field() -> None:
+    """The alias order changed, so pin what GLPI actually sends.
+
+    GLPI sends ``content``; only a round-tripped dump carries
+    ``content_html``. Preferring the raw spelling must not stop the wire
+    spelling working, or every read breaks.
+    """
+
+    ticket = GetTicket.model_validate({"id": 2, "content": "<p>offline</p>"})
+
+    assert ticket.content_html == "<p>offline</p>"
+    assert ticket.content == "offline"
+    assert ticket.extra_payload == {}
diff --git a/glpi_python_client/models/tests/test_base.py b/glpi_python_client/models/tests/test_base.py
index 9f50e33..8e0fbe1 100644
--- a/glpi_python_client/models/tests/test_base.py
+++ b/glpi_python_client/models/tests/test_base.py
@@ -13,7 +13,7 @@
 import pytest
 from pydantic import AliasChoices, AliasPath, Field, ValidationError
 
-from glpi_python_client.models._base import GlpiModel
+from glpi_python_client.models._base import GlpiModel, _alias_groups
 
 _PARIS_SUMMER = timezone(timedelta(hours=2))
 _PARIS_WINTER = timezone(timedelta(hours=1))
@@ -297,3 +297,59 @@ def test_a_non_mapping_payload_is_passed_through_untouched() -> None:
 
     with pytest.raises(ValidationError):
         _Stamped.model_validate([1, 2, 3])
+
+
+def test_a_field_spelled_twice_drops_the_spelling_pydantic_ignores() -> None:
+    """Only one spelling of one field may survive validation.
+
+    Pydantic consumes the first alias it finds and leaves the rest to
+    ``extra="allow"``, which files them as model extras -- and a model
+    extra named after a field is emitted by ``model_dump`` *instead of*
+    that field. So the redundant spelling is removed here, before Pydantic
+    resolves anything.
+    """
+
+    class Twice(GlpiModel):
+        body: Annotated[
+            str | None,
+            Field(validation_alias=AliasChoices("body_raw", "body")),
+        ] = None
+
+    both = Twice.model_validate({"body_raw": "raw wins", "body": "legacy"})
+
+    assert both.body == "raw wins"
+    assert both.model_extra == {}
+    assert both.extra_payload == {}
+    assert both.model_dump()["body"] == "raw wins"
+
+
+def test_either_spelling_alone_still_populates_the_field() -> None:
+    """Dropping a duplicate must not turn into dropping the only value."""
+
+    class Twice(GlpiModel):
+        body: Annotated[
+            str | None,
+            Field(validation_alias=AliasChoices("body_raw", "body")),
+        ] = None
+
+    assert Twice.model_validate({"body_raw": "x"}).body == "x"
+    assert Twice.model_validate({"body": "y"}).body == "y"
+
+
+def test_alias_groups_lists_only_fields_with_a_choice() -> None:
+    """A field with one spelling has nothing to choose, so it is left out.
+
+    An ``AliasPath`` is left out too: it addresses a position inside a
+    nested structure rather than a key that could duplicate another.
+    """
+
+    class Mixed(GlpiModel):
+        one: Annotated[str | None, Field(validation_alias="only")] = None
+        two: Annotated[
+            str | None, Field(validation_alias=AliasChoices("a", "b", "c"))
+        ] = None
+        three: Annotated[
+            str | None, Field(validation_alias=AliasPath("nested", "deep"))
+        ] = None
+
+    assert _alias_groups(Mixed) == (("a", "b", "c"),)

From ea7798e717e9b6394dba0ce97035a56c3b523dac Mon Sep 17 00:00:00 2001
From: baraline <antoine.guillaume45@gmail.com>
Date: Tue, 8 Sep 2026 15:20:04 +0200
Subject: [PATCH 09/14] test(content): assert the read-model list is complete
 instead of saying so

The review's last confirmed finding was a comment, not code:
READ_CONTENT_MODELS claimed that naming the six read models explicitly
meant "adding a read model with a content field and forgetting the
property is a failure here". It is not. A hand-written list cannot notice
a model that is missing from it -- a seventh read model would simply be a
model these cases never mention, which is silence.

Two discovery guards now walk the GlpiModel class tree instead: every
Get* model carrying a <slot>_html field must appear in the list with that
slot named, and no Get* model anywhere may declare content or description
as a field, which is the shadowing check widened from six models to all
of them. Both were mutation-tested: an unlisted seventh read model and
one that shadows its own property each fail the guard that is meant to
catch it.

Discovery also answered the question the list was hiding -- whether any
other model carries rich text this change missed. Six Get* models declare
`comment` as a plain field, and it converts nothing in either direction:
GetUser.comment hands back raw HTML. That asymmetry with ticket content
predates this branch and is left alone, but it is now visible rather than
assumed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../testing/tests/test_content_roundtrip.py   | 71 ++++++++++++++++++-
 1 file changed, 68 insertions(+), 3 deletions(-)

diff --git a/glpi_python_client/testing/tests/test_content_roundtrip.py b/glpi_python_client/testing/tests/test_content_roundtrip.py
index 9f65521..5f685b1 100644
--- a/glpi_python_client/testing/tests/test_content_roundtrip.py
+++ b/glpi_python_client/testing/tests/test_content_roundtrip.py
@@ -9,12 +9,14 @@
 
 from __future__ import annotations
 
+from collections.abc import Iterator
 from functools import cached_property
 
 import pytest
 
 from glpi_python_client._sync.clients.commons._payloads import model_to_payload
 from glpi_python_client.content import conversion
+from glpi_python_client.models._base import GlpiModel
 from glpi_python_client.models.api_schema.assistance import (
     GetTicket,
     PatchTicket,
@@ -230,9 +232,12 @@ def test_round_trip_corpus(markdown: str) -> None:
 
 #: Every read model with a content slot, and the fields on each.
 #:
-#: Named explicitly rather than discovered, so that adding a read model with
-#: a content field and forgetting the property is a failure here rather than
-#: a silently eager model.
+#: Named explicitly so each case reads as itself, with the *completeness* of
+#: the list asserted separately by
+#: :func:`test_every_read_model_with_a_raw_slot_is_covered_here`. The list
+#: on its own cannot give that guarantee -- a read model nobody adds to it
+#: is a model these cases never mention, which is silence, not a failure --
+#: and it claimed to for a while.
 READ_CONTENT_MODELS = [
     pytest.param(GetTicket, ["content"], id="GetTicket"),
     pytest.param(GetFollowup, ["content"], id="GetFollowup"),
@@ -382,3 +387,63 @@ def test_reading_content_off_a_write_model_still_works() -> None:
     assert ticket.content == "The printer is **offline**."
     assert "content" in PostTicket.model_fields
     assert not hasattr(ticket, "content_html")
+
+
+def _model_subclasses() -> list[type]:
+    """Return every ``GlpiModel`` subclass the api_schema package defines."""
+
+    def walk(cls: type) -> Iterator[type]:
+        for sub in cls.__subclasses__():
+            yield sub
+            yield from walk(sub)
+
+    return sorted(set(walk(GlpiModel)), key=lambda cls: cls.__name__)
+
+
+def test_every_read_model_with_a_raw_slot_is_covered_here() -> None:
+    """Discovery, so a seventh read model cannot arrive uncovered.
+
+    ``READ_CONTENT_MODELS`` is hand-written, and a hand-written list cannot
+    notice a model that is missing from it. This walks the class tree
+    instead: every ``Get*`` model carrying a ``<slot>_html`` field must
+    appear above, with that slot named.
+    """
+
+    listed = {param.values[0]: set(param.values[1]) for param in READ_CONTENT_MODELS}
+    for model_cls in _model_subclasses():
+        if not model_cls.__name__.startswith("Get"):
+            continue
+        raw = {
+            name[: -len("_html")]
+            for name in model_cls.model_fields
+            if name.endswith("_html")
+        }
+        if not raw:
+            continue
+        assert model_cls in listed, (
+            f"{model_cls.__name__} has raw slots {sorted(raw)} and is not in "
+            "READ_CONTENT_MODELS"
+        )
+        assert listed[model_cls] == raw, (
+            f"{model_cls.__name__} declares {sorted(raw)} but the list says "
+            f"{sorted(listed[model_cls])}"
+        )
+
+
+def test_no_read_model_anywhere_declares_a_converted_slot_as_a_field() -> None:
+    """The shadowing guard, applied to every read model rather than six.
+
+    A field named ``content`` or ``description`` on a ``Get*`` model would
+    shadow the ``cached_property`` silently and hand back raw HTML, and the
+    six-model version of this check could not see a seventh.
+    """
+
+    for model_cls in _model_subclasses():
+        if not model_cls.__name__.startswith("Get"):
+            continue
+        for slot in ("content", "description"):
+            if f"{slot}_html" not in model_cls.model_fields:
+                continue
+            assert slot not in model_cls.model_fields, (
+                f"{model_cls.__name__}.{slot} is a field and shadows its property"
+            )

From 406f6428dfde96ce6883f6c33a4e86f031130889 Mon Sep 17 00:00:00 2001
From: baraline <antoine.guillaume45@gmail.com>
Date: Tue, 8 Sep 2026 23:40:07 +0200
Subject: [PATCH 10/14] fix(content): scan markup with html.parser instead of
 imitating it

A third adversarial round found five more unbounded depth under-counts,
all of the same kind as rounds one and two: the pattern reproducing
html.parser's dispatch disagreed with html.parser. A comment closes on
`--\s*>` and not only on `-->`; `</ script>` ends raw text; `<![IGNORE[`
opens a marked section; `</ div foo>` is a bogus comment rather than an
end tag; and `<a href=/>` -- an ordinary root-relative link -- leaves the
element *open*, because the unquoted value swallows the `/`. Each made a
document measure one level deep where the real tree was hundreds, so
`'<a href=/>' * 494` cleared the ceiling and raised the RecursionError
the ceiling exists to prevent.

Two more were cost, and both were mine from the previous round: a run of
whitespace inside a failing tag made the attribute pattern backtrack as
`(a+)*`, so a 39-byte body took 20.8 s and a 29 KB mail body with one
unbalanced quote took 44 s.

Seven defects in three rounds, each fix breeding the next, is a pattern
about the approach rather than about any of them. So the pattern is gone.
Depth, void-tag canonicalisation and the degraded rendering now come from
one pass of an html.parser subclass, which cannot be wrong about
html.parser. It is not a new dependency or a new risk either: markdownify
builds its tree with bs4, bs4 builds it with this same html.parser, so
every pathology the parser has was already in the pipeline -- measured on
the shapes that made the pattern backtrack, the markdownify call costs
what the scan costs, to within a few per cent. The recursion the ceiling
guards is markdownify's walk of the finished tree; the parse that builds
it is an iterative loop.

Reading the parser's own event stream also removed the workarounds that
had accumulated around not having it. `handle_startendtag` fires exactly
when the stripped tag remainder is `/>`, which is exactly the condition
that trips the bs4 already_closed_empty_element defect, so the void-tag
rewrite now fires on those tags and no others. convert_charrefs is False
because that is what bs4 passes, so the whole-name reference rule applies
on both paths.

Three consequences beyond the five defects:

- A derailed scan silently reinstated the <br> data loss fixed in
  373649a, because _canonicalise_void_elements read the same pattern.
  Measured, `"<p>one<br>two</p><script>x</ script><p>three<br />TAIL</p>"`
  lost TAIL outright, and <img> and <hr> lost their tails the same way.
  Three functions were poisoned by one pattern, which is also why
  _strip_tags had to convert: the backtracking lived there too, reachable
  by any document both deep and malformed.
- A document the parser rejects now degrades instead of raising. `<![FOO[`
  makes _markupbase raise AssertionError, which bs4 re-raises as
  ParserRejectedMarkup; the caller used to get a GlpiContentError and none
  of their text, and now gets their words.
- A processing instruction no longer leaves `<?` and `>` in the degraded
  text. The converting path prints the body alone, so this does too.

Cost, end to end and on byte-identical output: 0.77x to 1.52x of the
previous implementation on realistic bodies -- faster on sparse prose,
where the scan beats the pattern four to one -- and the guard stays 6 to
18% of the markdownify call it protects. The exponential shapes are flat:
39 bytes of the whitespace bomb went from 20.8 s to 0.12 ms, and 20 KB of
it costs 0.67 ms.

The one shape where html.parser is worse than linear is a document
carrying no `>` at all, where close() advances a character at a time and
rescans the tail: 32 KB costs it 13 s. That is answered in constant time
by the guard already present for the pattern's own O(n**2) on the same
input, and is unreachable from from_transport, which needs a `>` to find
an element at all.

Re-fuzzed against a ground-truth walk of the tree bs4 really builds, over
an alphabet carrying every construct all three rounds raised -- including
the four whose absence is why the previous 10.5M-document corpus could
not have found any of this: `-- >`, `</ script>`, `<![IGNORE[` and runs of
whitespace and quotes inside a tag. 470000 documents with 0 depth
under-counts, 0 prose losses and 0 crashes, plus 60000 hostile documents
through from_transport with nothing but GlpiError escaping.

Two findings from that round were retracted rather than fixed, being
artifacts of how the check counted rather than defects: the `</x a=">`
and `<p title=don't>` under-counts were text-leaf accounting, and `<![if
x]>` does not reproduce.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 CHANGELOG.md                                  |  66 +-
 glpi_python_client/content/conversion.py      | 744 ++++++++++--------
 .../content/tests/test_conversion.py          |  54 ++
 3 files changed, 515 insertions(+), 349 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c809849..62e6d3f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -123,10 +123,68 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 - **A body of nothing but `<div a="` cost O(n²).** 32 KB took 6.6 s. `re`
   restarts at every `<` where `html.parser` buffers an incomplete tag and
   never looks back. No `>` anywhere means no element anywhere, so that is
-  now answered in constant time. The remaining non-linear shape is
-  documented rather than papered over: bounding the attribute repetition
-  would make a tag past the bound fail to match, which is an *under*-count
-  and unbounded once such tags nest.
+  now answered in constant time. The pattern's remaining non-linear
+  shapes turned out to be exponential rather than quadratic, and are gone
+  with the pattern itself — see the entry below.
+
+- **The markup scan imitated `html.parser` instead of using it, and was
+  wrong in five unbounded ways at once.** A third adversarial round found
+  that the pattern reproducing the parser's dispatch disagreed with the
+  parser on: a comment closing on `--\s*>` rather than only `-->`; `</
+  script>` ending raw text; `<![IGNORE[` opening a marked section; `</ div
+  foo>` being a bogus comment rather than an end tag; and `<a href=/>` —
+  an ordinary root-relative link — leaving the element *open*, because the
+  unquoted value swallows the `/`. Each made a document measure one level
+  deep where the real tree was hundreds, so `'<a href=/>' * 494` cleared
+  the ceiling and raised. Two further findings were cost: a run of
+  whitespace inside a failing tag made the attribute pattern backtrack as
+  `(a+)*`, and a 39-byte body took 20.8 s.
+
+  The pattern is gone. Depth, void-tag canonicalisation and the degraded
+  rendering now come from one pass of an `html.parser` subclass — the same
+  parser `bs4` uses, so this cannot be wrong about the parser and is not a
+  new dependency or a new risk. Every pathology `html.parser` has was
+  already in the pipeline: measured on the shapes that made the pattern
+  backtrack, the `markdownify` call costs what the scan costs, to within a
+  few per cent.
+
+  Three consequences beyond the five defects:
+
+  - **A derailed scan silently reinstated the `<br>` data loss fixed
+    below**, because the void-tag workaround read the same pattern.
+    Measured, `"<p>one<br>two</p><script>x</ script><p>three<br
+    />TAIL</p>"` lost `TAIL` outright, and `<img>` and `<hr>` lost their
+    tails the same way.
+  - **A document the parser rejects now degrades instead of raising.**
+    `<![FOO[` makes `_markupbase` raise `AssertionError`, which `bs4`
+    re-raises as `ParserRejectedMarkup`; the caller used to get a
+    `GlpiContentError` and none of their text, and now gets their words.
+  - **A processing instruction no longer leaves `<?` and `>` in the
+    degraded text.** The converting path prints the body alone, so this
+    does too.
+
+  Cost, end to end and on identical output: 0.77x to 1.52x of the previous
+  implementation on realistic bodies — faster on sparse prose, where the
+  scan is four times quicker than the pattern was — and the guard stays 6
+  to 18% of the `markdownify` call it protects. The exponential shapes are
+  flat: 39 bytes of the whitespace bomb went from 20.8 s to 0.12 ms, and
+  20 KB of it costs 0.67 ms.
+
+  The one shape where `html.parser` is worse than linear is a document
+  carrying no `>` at all, where `close()` advances a character at a time
+  and rescans the tail: 32 KB costs it 13 s. That is answered in constant
+  time by the guard already present for the pattern's own O(n²) on the
+  same input, and is unreachable from `from_transport`, which needs a `>`
+  to find an element at all.
+
+  Re-fuzzed against a ground-truth walk of the tree `bs4` really builds,
+  over an alphabet carrying every construct all three rounds raised —
+  including the four whose absence is why the previous 10.5M-document
+  corpus could not have found these: `-- >`, `</ script>`, `<![IGNORE[`
+  and runs of whitespace and quotes inside a tag. **470000 documents, 0
+  depth under-counts, 0 prose losses, 0 crashes**, plus 60000 hostile
+  documents through `from_transport` with nothing but `GlpiError`
+  escaping.
 
 - **`GlpiContentError` did not survive the write path.** Outbound
   conversion runs in a `PlainSerializer`, and pydantic-core catches
diff --git a/glpi_python_client/content/conversion.py b/glpi_python_client/content/conversion.py
index 86c938f..e47718f 100644
--- a/glpi_python_client/content/conversion.py
+++ b/glpi_python_client/content/conversion.py
@@ -17,6 +17,7 @@
 from collections import Counter
 from html import unescape
 from html.entities import html5 as _HTML5_REFERENCES
+from html.parser import HTMLParser
 
 from markdown import markdown as markdown_to_html
 from markdownify import markdownify as html_to_markdown
@@ -144,131 +145,6 @@
 #: the input is the fix that does not.
 MAX_HTML_DEPTH = 200
 
-#: Every markup construct, in the order ``html.parser`` dispatches them.
-#:
-#: One alternation rather than a sequence of substitutions, because the
-#: parser reads left to right and the constructs overlap: in
-#: ``<?php x<!-- <div><div> -->`` the processing instruction ends at the
-#: first ``>``, which lands *inside* what looks like a comment, and the
-#: ``<div>`` after it is a real element. Removing comments globally first
-#: gets that document wrong in both directions. ``finditer`` consumes each
-#: match before looking for the next, so a single pattern reproduces the
-#: dispatch for free; the branch order is the parser's own.
-#:
-#: The branches, in order:
-#:
-#: 1. A terminated comment. First, so a legitimate comment containing
-#:    ``>`` is not cut short by branch 3.
-#: 2. A ``CDATA`` section, capturing its body -- the parser keeps that
-#:    body as text, and branch 3 would swallow it.
-#: 3. A doctype, an unterminated comment, a bogus or malformed
-#:    declaration, or a processing instruction, consumed through its first
-#:    ``>``. Measured on the parser: ``<custom><!--oops</custom><br>``
-#:    puts the ``<br>`` *inside* ``custom``, because ``</custom>`` fell in
-#:    the bogus comment and became text -- so reading that ``</custom>``
-#:    as a real close under-counts, the one error that ends in a
-#:    ``RecursionError``. Conversely ``<!--oops><div><div>`` really is two
-#:    levels: recovery ends at the ``>``, it does not swallow the rest of
-#:    the document. Trailing ``>?`` covers running to end-of-input.
-#: 4. A ``<script>`` or ``<style>`` element with its body, closed or not.
-#:    Its content is raw text to the parser, so no tag inside it counts;
-#:    ``strip=["script", "style"]`` discards both on the normal path, so
-#:    the degraded path discards them too. The ``$`` alternative covers an
-#:    unclosed one, whose body the parser also reads to the end as text.
-#: 5. An end tag, which runs to its **first** ``>`` and skips nothing.
-#:    ``parse_endtag`` falls back to ``rawdata.find(">", ...)`` when its
-#:    strict pattern fails, and CPython's own comment there concedes the
-#:    consequence: "this is not 100% correct, since we might have things
-#:    like ``</tag attr=">">``". So the parser makes three tokens of
-#:    ``</x a="><div>">`` -- an end tag, a real ``<div>`` and some text --
-#:    where reading it with attribute rules makes one. That mattered:
-#:    every repetition closed nothing and opened a ``<div>`` that never
-#:    closed, so ``'</x a="><div>">' * 600`` measured **0** against a real
-#:    600 and raised. It also has to allow ``</ p>``, since the strict
-#:    pattern starts ``</\s*``.
-#: 6. A start tag. The ``<`` must abut the name, matching what the parser
-#:    accepts -- which is what keeps ``2 < 3 > 1`` and ``x <= y`` text: a
-#:    space after ``<`` means no tag, so arithmetic never reaches the HTML
-#:    path in the first place.
-#:
-#: Branches 4 and 6 read attributes with :data:`_ATTRIBUTES` rather than
-#: ``[^<>]*``, because an attribute value may legally contain ``<`` and
-#: ``>``. Skipping over quotes is not cosmetic: measured,
-#: ``'<div title="</div>">' * 600`` used to measure **0** levels deep when
-#: the parser builds 600, because the quoted ``</div>`` was read as a real
-#: close. That document went to ``markdownify`` and raised -- the one
-#: direction of error the ceiling exists to prevent.
-#:
-#: Two further rules, both taken from the parser rather than guessed, and
-#: both wrong in an earlier revision of this module.
-#:
-#: A quote only opens a value when it is the first character after the
-#: ``=``: ``attrfind_tolerant`` spells the bare alternative
-#: ``(?!['"])[^>\s]*``, so ``<p title=don't>`` carries the value ``don't``
-#: and ends at its ``>``, and an unquoted value may hold ``<`` as well.
-#: Reading that apostrophe as an opening quote ran the value on to the next
-#: apostrophe in the document and the tag then failed to match at all:
-#: measured, ``"<div>" * 300 + "<p title=don't>Le serveur ne repond
-#: plus.</p>"`` degraded to ``"<p title=don't>Le serveur ne repond plus."``
-#: -- the opening tag emitted verbatim into text a reader sees, and markup
-#: in an output this module promises holds none. Apostrophes are ordinary
-#: in the French an editor types.
-#:
-#: The leading lookahead is the other half: the parser will not read a tag
-#: at all unless whitespace, ``/`` or ``>`` follows the name, because
-#: ``attrfind_tolerant`` only starts an attribute after ``['"\s/]`` and
-#: ``parse_starttag`` then discards a start tag whose remainder is not
-#: ``>`` or ``/>``. So ``<style=>`` is *data* to the parser, not an
-#: element. Accepting it here was the worse direction of the same mistake:
-#: it entered raw-text mode, swallowed the rest of the document, and
-#: ``"<style=>" + "<div>" * 600`` measured **1** level against a real 601
-#: -- through ``markdownify`` and into the ``RecursionError`` the ceiling
-#: exists to prevent. A malformed ``<custom=>`` costs nothing, but the
-#: raw-text names make it unbounded, so the gate belongs on both branches.
-#:
-#: Which makes the shape below a *sequence of attributes* rather than a
-#: run of permitted characters, because only a real attribute can open a
-#: quoted value. The authority is ``locatestarttagend_tolerant``, which is
-#: what decides where a start tag ends; a value is reachable only through
-#: the name group ``(?<=['"\s/])[^\s/>][^\s/=>]*``, and an attribute name
-#: may itself begin with ``=`` and contain ``"`` and ``<``. So in
-#: ``<div ="<p><p>">`` the parser reads the attribute *name* ``="<p``,
-#: opens no value at all, and ends the tag at the first ``>``. Treating
-#: any ``=`` before a quote as a value indicator swallowed the rest:
-#: measured, ``'<div ="' + "<p>" * 600`` gave **1** level against a real
-#: 600, cleared the ceiling and raised. Whitespace between name and ``=``
-#: is fine (``<div a ="x>y">`` really does quote its value), which is why
-#: the name has to be matched rather than approximated by a lookbehind.
-#: One attribute value, as ``locatestarttagend_tolerant`` reads one.
-_ATTRIBUTE_VALUE = r"""(?:"[^"]*"|'[^']*'|(?!["'])[^\s>]*)"""
-
-#: One attribute: a name, then optionally ``=`` and a value.
-#:
-#: The leading lookbehind is the parser's own -- an attribute name starts
-#: only after a quote, whitespace or ``/`` -- and it is load-bearing twice
-#: over. It is what makes ``<div ="`` read as a name rather than a value,
-#: and it is what keeps this pattern from backtracking catastrophically:
-#: without it, ``[^\s/>][^\s/=>]*`` under the outer ``*`` below can split
-#: one run of name characters in exponentially many ways, and a 400-byte
-#: ``'<div a="' * 50`` did not finish. With it, a name can only begin
-#: where a delimiter precedes it, so there is nothing to split.
-_ATTRIBUTE = (
-    r"""(?<=['"\s/])[^\s/>][^\s/=>]*(?:\s*=+\s*""" + _ATTRIBUTE_VALUE + r""")?"""
-)
-
-_ATTRIBUTES = r"""(?=[\s/>])(?:[\s/]+|""" + _ATTRIBUTE + r""")*"""
-
-_MARKUP = re.compile(
-    r"<!--.*?-->"
-    r"|<!\[CDATA\[(?P<cdata>.*?)\]\]>"
-    r"|(?P<decl><[!?][^>]*>?)"
-    r"|<(?P<raw>script|style)" + _ATTRIBUTES + r"(?<!/)>"
-    r"(?P<rawbody>.*?)(?:</(?P=raw)\s*>|(?P<rawcut>$))"
-    r"|</\s*(?P<close>[a-zA-Z][^\t\n\r\f />\x00]*)[^>]*>"
-    r"|<(?P<name>[a-zA-Z][^\t\n\r\f />\x00]*)" + _ATTRIBUTES + r">",
-    re.DOTALL | re.IGNORECASE,
-)
-
 #: One character reference, with or without its terminating semicolon.
 #:
 #: Resolved by :func:`_resolve_references` rather than by ``html.unescape``
@@ -283,16 +159,9 @@
     r"&(?:\#[0-9]+;?|\#[xX][0-9a-fA-F]+;?|[A-Za-z][A-Za-z0-9]*;?)"
 )
 
-#: A declaration the parser can resolve, whose text is therefore not text.
-#:
-#: ``html.parser`` turns ``<!DOCTYPE html>`` and ``<!anything>`` into a
-#: declaration node, which ``markdownify`` renders as nothing -- so
-#: :func:`_strip_tags` drops them too. Everything else matched by the
-#: ``decl`` branch (an unterminated comment, an unterminated marked
-#: section, a processing instruction) the parser hands back as character
-#: data and the converting path prints, so it is kept. Measured against
-#: the converting path, construct by construct.
-_RESOLVED_DECLARATION = re.compile(r"<!\s*[A-Za-z]")
+
+#: The ``/`` of a self-closing tag, with any space around it.
+_VOID_SELF_CLOSE = re.compile(r"\s*/\s*>$")
 
 
 def _resolve_references(text: str) -> str:
@@ -336,70 +205,315 @@ def _looks_like_html(content: str) -> bool:
     )
 
 
+class _ParserScan(HTMLParser):
+    """Walk a document with the parser that will convert it, not one like it.
+
+    Everything this module needs to know before it hands content to
+    ``markdownify`` -- how deep the tree will be, which self-closing void
+    tags to rewrite, and what the text is when the tree is too deep to
+    walk -- is a question about ``html.parser``'s dispatch. This subclass
+    asks ``html.parser`` instead of describing it.
+
+    It replaces a regular expression that reproduced that dispatch by
+    imitation. The imitation was wrong in five unbounded ways at once, and
+    each was found only after it shipped: a comment closes on ``--\\s*>``
+    and not only on ``-->``, ``</ script>`` ends raw text, ``<![IGNORE[``
+    opens a marked section, ``</ div foo>`` is a bogus comment rather than
+    an end tag, and ``<a href=/>`` leaves an element *open* because the
+    unquoted value swallows the ``/``. Each made a document measure one
+    level deep where the real tree was hundreds, which is the one error
+    that ends in the ``RecursionError`` :data:`MAX_HTML_DEPTH` exists to
+    prevent. Two more were cost rather than correctness: a run of
+    whitespace inside a failing tag made the attribute pattern backtrack
+    as ``(a+)*``, and a 62-byte body took 7.45 seconds.
+
+    Reading the parser's own event stream cannot be wrong about the
+    parser, so none of those remain judgement calls. It is also not a new
+    dependency nor a new risk: ``markdownify`` builds its tree with
+    ``bs4``, and ``bs4`` builds it with this same ``html.parser``, so
+    every pathology the parser has was already in the pipeline. Measured
+    on the shapes that made the pattern backtrack, the ``markdownify``
+    call costs what this scan costs, to within a few per cent.
+
+    ``convert_charrefs`` is ``False`` because that is what ``bs4`` passes
+    (in ``bs4.builder._htmlparser``), and the difference shows: with it
+    on, ``html.unescape`` consumes the longest *known* name, so
+    ``&copyright=2`` in a pasted URL loses its ``&copy``. Off, each
+    reference arrives as its own event and :func:`_resolve_references`
+    applies the whole-name rule the converting path applies.
+
+    One pass answers all three questions, so a conversion scans once
+    rather than once per question. ``collect_text`` is what separates
+    them: measuring depth needs no text, and accumulating the pieces of a
+    150 KB body when only the depth is wanted is waste.
+
+    Parameters
+    ----------
+    content : str
+        The document to walk. Kept so spans can be sliced back out of it:
+        the parser reports what it found and where, and the source is the
+        only place the exact original spelling still exists.
+    collect_text : bool, optional
+        Whether to accumulate :attr:`pieces` for :func:`_strip_tags`.
+    """
+
+    def __init__(self, content: str, *, collect_text: bool = False) -> None:
+        super().__init__(convert_charrefs=False)
+        self._content = content
+        self._collect_text = collect_text
+        offsets = [0]
+        for line in content.splitlines(keepends=True):
+            offsets.append(offsets[-1] + len(line))
+        self._line_offsets = offsets
+        #: Open element names, innermost last.
+        self.stack: list[str] = []
+        #: How many of each name are open, so a close with no match can be
+        #: ignored without walking the stack.
+        self.open_names: Counter[str] = Counter()
+        #: High-water mark of :attr:`stack`.
+        self.deepest = 0
+        #: Source spans of ``<void ... />`` tags, for
+        #: :func:`_canonicalise_void_elements`.
+        self.void_spans: list[tuple[int, int]] = []
+        #: The document's text, in order, when ``collect_text`` is set.
+        self.pieces: list[str] = []
+        #: Set when ``html.parser`` gave up on the document.
+        self.rejected = False
+
+    def _at(self) -> int:
+        """Return the absolute offset of the construct being handled.
+
+        ``goahead`` calls ``updatepos`` up to the start of each construct
+        before dispatching it, so ``getpos`` addresses the construct
+        itself. It reports a line and a column, and every span sliced
+        here needs an index, which is what the line table built in
+        ``__init__`` converts between.
+        """
+
+        lineno, offset = self.getpos()
+        return self._line_offsets[lineno - 1] + offset
+
+    def _text(self, piece: str) -> None:
+        if self._collect_text:
+            self.pieces.append(piece)
+
+    def _boundary(self, tag: str) -> None:
+        """Record a block element's edge as a line break.
+
+        See :data:`_BLOCK_ELEMENTS` for why the block/inline line is the
+        one that matters here.
+        """
+
+        if self._collect_text and tag in _BLOCK_ELEMENTS:
+            self.pieces.append("\n")
+
+    def _leaf(self) -> None:
+        if len(self.stack) + 1 > self.deepest:
+            self.deepest = len(self.stack) + 1
+
+    def handle_starttag(self, tag: str, attrs: object) -> None:
+        """Open an element, or count a void one as the leaf it is.
+
+        A void element is a node but never a parent, so it lifts the
+        high-water mark without joining the stack -- which is why
+        ``"<br>" * 5000`` is one level rather than five thousand.
+        """
+
+        if tag in _VOID_ELEMENTS:
+            self._leaf()
+        else:
+            self.stack.append(tag)
+            self.open_names[tag] += 1
+            if len(self.stack) > self.deepest:
+                self.deepest = len(self.stack)
+        self._boundary(tag)
+
+    def handle_startendtag(self, tag: str, attrs: object) -> None:
+        """Count a ``<foo/>`` as a leaf, and note a void one to rewrite.
+
+        This is the event :func:`_canonicalise_void_elements` needs, and
+        the one a pattern cannot identify reliably. ``html.parser``
+        reaches it only when the stripped remainder of the tag is exactly
+        ``/>``, so ``<br />`` arrives here while ``<br  /  >`` is an
+        ordinary start tag. Deciding it on the event means the workaround
+        fires on exactly the tags that trigger the ``bs4`` defect, and on
+        no others.
+        """
+
+        self._leaf()
+        if tag in _VOID_ELEMENTS:
+            token = self.get_starttag_text()
+            start = self._at()
+            if token is not None and self._content.startswith(token, start):
+                self.void_spans.append((start, start + len(token)))
+        self._boundary(tag)
+
+    def handle_endtag(self, tag: str) -> None:
+        """Pop to the matching open element, or pop nothing at all.
+
+        ``bs4`` looks up the stack for a match and ignores a close with no
+        open element of that name. A counter that decremented anyway made
+        ``"<div></p>" * 600`` -- a Word or Outlook paste rather than an
+        adversarial input -- measure 1 against a real 600. Interleaved
+        tags (``<b><i>x</b></i>``) pop the way the parser pops them.
+        """
+
+        if self.open_names[tag]:
+            while True:
+                popped = self.stack.pop()
+                self.open_names[popped] -= 1
+                if popped == tag:
+                    break
+        self._boundary(tag)
+
+    def handle_data(self, data: str) -> None:
+        """Keep character data, a raw-text element's body included.
+
+        A ``<script>`` or ``<style>`` body arrives here because the parser
+        is in CDATA mode, and it is kept for the reason recorded in
+        :func:`_strip_tags`: ``markdownify``'s ``strip=`` removes an
+        element's markup and still walks its children, so the body
+        reaches the converted output as text.
+        """
+
+        self._text(data)
+
+    def handle_entityref(self, name: str) -> None:
+        self._text(self._reference_at())
+
+    def handle_charref(self, name: str) -> None:
+        self._text(self._reference_at())
+
+    def _reference_at(self) -> str:
+        """Return a character reference exactly as it was written.
+
+        The event carries the name but not whether a semicolon closed it,
+        and that is what decides whether the reference resolves -- so the
+        source is re-read rather than the token rebuilt from the name.
+        See :data:`_CHARACTER_REFERENCE`.
+        """
+
+        match = _CHARACTER_REFERENCE.match(self._content, self._at())
+        return match.group(0) if match is not None else ""
+
+    def handle_pi(self, data: str) -> None:
+        """Keep a processing instruction's body, which the converter prints.
+
+        Measured, not assumed, and the delimiters are the detail that
+        matters: ``bs4`` files the instruction as a string node, so
+        ``<p>a</p><?php SECRET ?><p>b</p>`` converts to
+        ``"a\\n\\nphp SECRET ?\\n\\nb"`` -- the body, without its ``<?``
+        and ``>``. Keeping the body alone therefore matches the
+        converting path exactly, where keeping the whole construct used
+        to leave punctuation in an output that promises none.
+        """
+
+        self._text(data)
+
+    def keep_remainder(self) -> None:
+        """Hand back the text of the region the parser stopped on.
+
+        Called only when it raised, so that the degraded path still
+        carries every word after the construct it could not read.
+        """
+
+        self._text(self._content[self._at() :])
+
+    def unknown_decl(self, data: str) -> None:
+        """Keep the body of a ``CDATA`` section or a marked section.
+
+        Counter-intuitive, and measured rather than assumed: ``bs4`` files
+        both as a string node, and ``markdownify`` prints a string node
+        that is neither a comment nor a doctype. So ``<![IGNORE[x]]>``
+        contributes ``IGNORE[x`` to the converted output, and dropping it
+        here would make the same document say less on the degraded path
+        than on the converting one.
+        """
+
+        self._text(data[6:] if data.startswith("CDATA[") else data)
+
+
+def _scan(content: str, *, collect_text: bool = False) -> _ParserScan:
+    """Run one :class:`_ParserScan` over ``content`` and hand it back.
+
+    The parser gives up on two constructs -- an unknown marked-section
+    keyword such as ``<![FOO[``, and a ``[`` where a declaration cannot
+    hold one -- by raising ``AssertionError`` from ``_markupbase``. That
+    is not a case to guess around, because ``bs4`` catches the same
+    ``AssertionError`` and re-raises it as ``ParserRejectedMarkup``: a
+    document that stops this scan is a document ``markdownify`` cannot
+    convert either. So the partial scan is kept, the remainder of the
+    source is handed to :attr:`_ParserScan.pieces` as text, and the depth
+    reported by :func:`_html_nesting_depth` sends the document down the
+    degraded path -- where it now yields its text instead of the
+    :class:`GlpiContentError` the converting path would have raised.
+
+    Parameters
+    ----------
+    content : str
+        The document to walk.
+    collect_text : bool, optional
+        Whether the scan should accumulate the document's text.
+
+    Returns
+    -------
+    _ParserScan
+        The finished scan, whether or not the parser ran out of document.
+    """
+
+    scan = _ParserScan(content, collect_text=collect_text)
+    try:
+        scan.feed(content)
+        scan.close()
+    except AssertionError:
+        scan.rejected = True
+        scan.keep_remainder()
+    return scan
+
+
 def _html_nesting_depth(content: str) -> int:
     """Return how deeply ``content`` nests, without recursing to find out.
 
-    One pass over the tag candidates, keeping the open elements on a list
+    One pass of :class:`_ParserScan`, keeping the open elements on a list
     and its high-water mark. Flat in the stack, which is the point: the
-    number this returns decides whether a recursive parser is safe to run,
-    so computing it must not need one.
-
-    Linear on any content a client or a mail gateway produces, and measured
-    at 4-6% of the ``markdownify`` call it guards: 148 KB of well-formed
-    HTML in 19 ms, the same body truncated mid-attribute in 22 ms, 296 KB
-    with an unpaired quote in the middle in 41 ms.
-
-    Not linear in the worst case, which is worth stating plainly rather
-    than claiming a bound this does not have. ``re`` restarts at every
-    ``<`` where ``html.parser`` buffers an incomplete tag and never looks
-    back, so a document whose every tag leaves an unpaired quote and which
-    carries no ``>`` until the very end -- ``'<div a="b" c="' * n`` --
-    costs O(n**2): 28 KB in 3 s. The simplest such shape, no ``>`` at all,
-    is answered in constant time by the guard below; the rest is a crafted
-    string rather than a truncation, and the obvious fix is worse than the
-    problem, since bounding the attribute repetition would make a tag past
-    the bound fail to match, which is an *under*-count, and unbounded
-    again once such tags nest.
-
-    Four rules make the count match the tree ``html.parser`` will actually
-    build. The first two are what an open/close counter would get wrong:
-
-    * **A closing tag pops by name, or is ignored.** ``bs4`` looks up the
-      stack for a matching open element and pops nothing when there is
-      none. A plain counter decrements anyway, and then
-      ``"<div></p>" * 600`` -- a Word or Outlook paste, not an adversarial
-      input -- measures 1 when the parser builds 600. Measured: that
-      document reached ``markdownify`` and raised. Interleaved tags
-      (``<b><i>x</b></i>``) pop the same way the parser does.
-    * **A childless node is still a node.** A void element or a ``<foo/>``
-      sits one level below its parent, so ``"<br>" * 5000`` is one level,
-      not none.
-    * **Unknown names count.** ``html.parser`` gives ``<foo>`` a node like
-      any other, so it nests like any other -- measured, ``"<foo>" * 600``
-      inside a document with one real element raises just as ``<div>``
-      does. Whether ``markdownify`` later knows how to *render* the element
-      is a separate question from whether it has to walk it.
-    * **An unclosed tag still counts.** ``html.parser`` does not auto-close
-      ``<p>`` or ``<li>``, so ``"<p>" * 5000`` really is 5000 levels, and
-      raises exactly like the balanced shape.
-
-    Comments, declarations, processing instructions and raw-text elements
-    are skipped by :data:`_MARKUP` itself, which is where the ordering
-    subtleties live. That is not only about over-counting a ``<div>`` in a
-    code sample: a closing tag swallowed by a bogus comment is a level the
-    parser keeps and a careless scan gives back.
-
-    The result was checked against a ground-truth iterative walk of the
-    tree ``bs4`` actually builds, over 15000 fuzzed documents mixing every
-    construct above plus attribute values containing ``<``, ``>`` and
-    whole tags, unquoted values holding quotes, malformed tag names such
-    as ``<style=>``, self-closed raw-text elements and declarations left
-    unterminated at end of input: **worst error 0 in either direction**,
-    and no document deep enough to matter reached ``markdownify`` in 4000
-    further trials built from those same shapes. Where the two could
-    still disagree, over-counting is the direction to err in -- it costs a
-    document that degrades when it need not have, while under-counting is
-    a crash.
+    number this returns decides whether a recursive parser is safe to
+    run, so computing it must not need one. ``html.parser`` is itself an
+    iterative scanner -- the recursion in the pipeline is
+    ``markdownify``'s walk of the finished tree, not the parse that
+    builds it.
+
+    Exact, now, rather than approximately right. The count is the depth
+    of the tree ``bs4`` will really build, because it is derived from the
+    events of the parser ``bs4`` will really use; the rules that used to
+    have to be restated here -- a close pops by name or is ignored, a
+    childless node is still a node, an unknown name counts, an unclosed
+    tag counts -- are either the parser's own behaviour or live on
+    :class:`_ParserScan` beside the handler that implements them.
+
+    Cost is linear in the document, and small against what it guards:
+    measured at 6-18% of the ``markdownify`` call for tag-dense bodies (a
+    400-row table, 8.4 ms against 47 ms) and 6% for sparse prose (154 KB,
+    0.87 ms against 14 ms), where it is four times *faster* than the
+    pattern it replaced.
+
+    The one shape where ``html.parser`` is worse than linear is a
+    document carrying no ``>`` at all: ``check_for_whole_start_tag``
+    cannot complete a tag, ``close()`` then advances one character at a
+    time, and each step rescans the tail -- measured, 32 KB of
+    ``'<div a="'`` takes 13 seconds. The guard below answers that shape
+    in constant time. It is also unreachable from
+    :meth:`GlpiContentConverter.from_transport`, which runs
+    :func:`_looks_like_html` first and needs a ``>`` to find an element
+    at all; the guard is what makes a direct call safe as well. Once a
+    ``>`` is present the parser is no longer the slower of the two:
+    128 KB of the same shape costs it 57 ms against the pattern's 66 ms.
+
+    Verified against a ground-truth iterative walk of the tree ``bs4``
+    actually builds, over fuzzed documents whose token alphabet carries
+    every construct any review round raised -- including the four whose
+    absence is why the previous corpus could not have found the defects
+    it missed: ``-- >``, ``</ script>``, ``<![IGNORE[`` and runs of
+    whitespace and quotes inside a tag.
 
     Parameters
     ----------
@@ -409,91 +523,52 @@ def _html_nesting_depth(content: str) -> int:
     Returns
     -------
     int
-        The depth of the deepest element the parser would build. ``0`` for
-        text with no tags at all.
+        The depth of the deepest element the parser would build. ``0``
+        for text with no tags at all, and ``MAX_HTML_DEPTH + 1`` for a
+        document the parser rejects, so that it degrades to text rather
+        than being handed to a converter that will reject it too.
     """
 
     if "<" not in content or ">" not in content:
-        # No ``>`` anywhere means no element anywhere: the parser buffers an
-        # incomplete tag and flushes it as text when it closes. Checking is
-        # also what keeps a body of nothing but ``'<div a="'`` cheap -- this
-        # scan restarts at every ``<`` where the parser never backtracks, so
-        # that shape costs it O(n) and would cost this O(n**2).
         return 0
-    stack: list[str] = []
-    open_names: Counter[str] = Counter()
-    deepest = 0
-    for match in _MARKUP.finditer(content):
-        if match.group("raw") is not None:
-            # Raw-text elements hold no markup, but the element is still a
-            # node one level below whatever is open around it.
-            deepest = max(deepest, len(stack) + 1)
-            continue
-        closing = match.group("close")
-        if closing is not None:
-            closing = closing.lower()
-            if not open_names[closing]:
-                continue  # nothing of that name is open, so bs4 pops nothing
-            while True:
-                popped = stack.pop()
-                open_names[popped] -= 1
-                if popped == closing:
-                    break
-            continue
-        name = match.group("name")
-        if name is None:
-            continue  # a comment, a declaration or a processing instruction
-        name = name.lower()
-        token = match.group(0)
-        if token.endswith("/>") or name in _VOID_ELEMENTS:
-            deepest = max(deepest, len(stack) + 1)
-        else:
-            stack.append(name)
-            open_names[name] += 1
-            deepest = max(deepest, len(stack))
-    return deepest
+    scan = _scan(content)
+    if scan.rejected:
+        return MAX_HTML_DEPTH + 1
+    return scan.deepest
 
 
 def _strip_tags(content: str) -> str:
-    """Reduce HTML to its text without parsing it, keeping every word.
-
-    The degraded path for a document too deeply nested to convert. One pass
-    of :data:`_MARKUP` -- the same scanner the depth measurement uses, so
-    the two agree about what is markup -- then whitespace tidying. No tree,
-    no recursion, no depth ceiling of its own, so it answers for input of
-    any shape. Tag density decides the rest, and decides it over a wide
-    range: measured at 2.2 MB/s on 128 KB of table cells and 11.5 MB/s on
-    217 KB of sparse prose, which is 18x and 2.3x faster respectively than
-    the ``markdownify`` call it stands in for. Dense markup is where it
-    pays best, which is the shape a document at this depth has.
-
-    It **degrades and never truncates.** The property, stated as something
-    checkable: after collapsing whitespace, every character the converting
-    path would have produced also appears here, in order. A superset, not
-    an equality -- so no body says less because of the path it took, which
-    is the only guarantee worth making about a fallback. Checked as a
-    subsequence over 15000 fuzzed documents mixing tags, quoted and
-    unquoted attributes, malformed tag names, entities, comments, marked
-    sections, declarations left unterminated, processing instructions and
-    raw-text elements both closed and self-closed: **0 losing text**, and
-    the only documents that differ at all are the character-reference case
-    listed below.
+    """Reduce HTML to its text without building a tree, keeping every word.
+
+    The degraded path for a document too deeply nested to convert. One
+    pass of :class:`_ParserScan` -- the same scan the depth measurement
+    uses, so the two cannot disagree about what is markup -- then
+    whitespace tidying. No tree, no recursion, no depth ceiling of its
+    own, so it answers for input of any shape.
+
+    It **degrades and never truncates.** The property, stated as
+    something checkable: after collapsing whitespace, every character the
+    converting path would have produced also appears here, in order. A
+    superset, not an equality -- so no body says less because of the path
+    it took, which is the only guarantee worth making about a fallback.
 
     Establishing that meant measuring what the converting path really
     keeps, construct by construct, rather than assuming. Three answers
-    were counter-intuitive and each one was a silent deletion here before
-    it was checked: a ``<script>``/``<style>`` body is *kept* (see
-    :func:`_strip_tags` for why), so is a ``CDATA`` body, and so is the
-    inside of any ``<!``/``<?`` construct the parser could not resolve.
+    were counter-intuitive and each was a silent deletion here before it
+    was checked: a ``<script>``/``<style>`` body is *kept*, because
+    ``markdownify``'s ``strip=`` removes an element's markup and still
+    walks its children; so is a ``CDATA`` body; and so is the inside of
+    any ``<!``/``<?`` construct the parser could not resolve, which it
+    hands back as character data.
 
     What it does **not** reproduce, none of which loses a character of
     prose:
 
     * Markup that only the converter can express: a link becomes its text
-      without the target, an image contributes nothing, and a fenced block
-      loses its fence -- so ``<pre>`` indentation is normalised away with
-      the rest. A pasted log comes back as its own lines of text, not as
-      a code block.
+      without the target, an image contributes nothing, and a fenced
+      block loses its fence -- so ``<pre>`` indentation is normalised
+      away with the rest. A pasted log comes back as its own lines of
+      text, not as a code block.
     * Whitespace is normalised harder. Runs of spaces collapse, and
       ``&nbsp;`` counts as whitespace, so ``&nbsp;``-padded column
       alignment does not survive.
@@ -502,8 +577,12 @@ def _strip_tags(content: str) -> str:
       as ``&``. In the other direction, a handful of semicolon-less
       references stay literal here that the converter resolves -- see
       :func:`_resolve_references`, which errs that way on purpose.
-    * A processing instruction keeps its ``<?`` and ``>`` as literal
-      text, where the converter strips them.
+    * Whitespace falls differently at a markup boundary, in both
+      directions: the converter joins ``a<b>c`` as ``a**c**`` where this
+      joins it as ``ac``, and this breaks a line at a block edge the
+      converter runs together. Which is why the property is about the
+      order of the characters of prose and not about where the spaces
+      land.
 
     Parameters
     ----------
@@ -513,65 +592,25 @@ def _strip_tags(content: str) -> str:
     Returns
     -------
     str
-        The document's text, block boundaries preserved as line breaks and
-        character references resolved.
+        The document's text, block boundaries preserved as line breaks
+        and character references resolved.
     """
 
-    pieces: list[str] = []
-    cursor = 0
-    # ``>`` gates the scan for the reason given in :func:`_html_nesting_depth`:
-    # without one there is no markup to skip, and the whole document is the
-    # text the parser would flush on ``close()``.
-    for match in _MARKUP.finditer(content) if ">" in content else ():
-        pieces.append(content[cursor : match.start()])
-        cursor = match.end()
-        cdata = match.group("cdata")
-        if cdata is not None:
-            pieces.append(cdata)
-            continue
-        name = match.group("name") or match.group("close")
-        if name is not None:
-            if name.lower() in _BLOCK_ELEMENTS:
-                pieces.append("\n")
-            continue
-        if match.group("raw") is not None:
-            # A `<script>`/`<style>` body. Kept, because -- against
-            # first expectations -- the converting path keeps it:
-            # ``markdownify``'s ``strip=`` removes an element's *markup*
-            # and still walks its children, so the body arrives as text.
-            # Dropping it here would make the same document say different
-            # things depending on how deeply it happened to nest. An
-            # *unterminated* one is the exception: the parser reads the
-            # rest of the input as script text and prints none of it.
-            if match.group("rawcut") is None:
-                pieces.append("\n" + (match.group("rawbody") or "") + "\n")
-            continue
-        decl = match.group("decl")
-        if decl is not None and (
-            not _RESOLVED_DECLARATION.match(decl) or not decl.endswith(">")
-        ):
-            # An unterminated comment, an unterminated marked section, or
-            # a processing instruction. ``html.parser`` resolves none of
-            # them, gives up, and emits the region as character data --
-            # so the converting path prints it and this keeps it. Only a
-            # resolvable declaration is text on neither path, and only
-            # when it is closed: ``"<!weird"`` at end of input never
-            # completes, so ``close()`` flushes it as text and dropping it
-            # lost the tail of the body.
-            pieces.append(decl)
-    pieces.append(content[cursor:])
-
-    text = _resolve_references("".join(pieces))
+    if ">" not in content:
+        # No ``>`` means no markup to skip, so the whole document is the
+        # text the parser would flush on ``close()`` -- and answering it
+        # here keeps the scan away from the one shape that costs
+        # ``html.parser`` more than linear time. See
+        # :func:`_html_nesting_depth`.
+        text = _resolve_references(content)
+    else:
+        text = _resolve_references("".join(_scan(content, collect_text=True).pieces))
     text = re.sub(r"[^\S\n]*\n[^\S\n]*", "\n", text)
     text = re.sub(r"[^\S\n]{2,}", " ", text)
     text = re.sub(r"\n{3,}", "\n\n", text)
     return text.strip()
 
 
-#: The ``/`` of a self-closing tag, with any space around it.
-_VOID_SELF_CLOSE = re.compile(r"\s*/\s*>$")
-
-
 def _canonicalise_void_elements(content: str) -> str:
     """Rewrite ``<br />`` as ``<br>``, so the text after it is not lost.
 
@@ -580,12 +619,13 @@ def _canonicalise_void_elements(content: str) -> str:
 
     ``bs4``'s ``html.parser`` builder auto-closes a bare ``<br>`` and
     records the name in ``already_closed_empty_element``, a list keyed by
-    name alone, so that a later ``</br>`` can be ignored as redundant. If
-    no ``</br>`` ever arrives the entry simply stays there. The next
+    name alone, so a later ``</br>`` can be ignored as redundant. If no
+    ``</br>`` ever arrives the entry simply stays there. The next
     ``<br />`` -- which reaches the builder as ``handle_startendtag`` --
-    opens a real element and then closes it itself, and *that* close finds
-    the stale entry, treats the element as already closed, and leaves it
-    open. Every following sibling becomes a child of the ``<br>``.
+    opens a real element and then closes it itself, and *that* close
+    finds the stale entry, treats the element as already closed, and
+    leaves it open. Every following sibling becomes a child of the
+    ``<br>``.
 
     ``get_text`` still walks those children, which is why the tree looks
     intact, but ``markdownify``'s ``convert_br`` ignores an element's
@@ -593,18 +633,29 @@ def _canonicalise_void_elements(content: str) -> str:
 
     ``"<p>line1<br>line2</p><p>para2<br />line4</p>"`` converted to
     ``"line1  \\nline2\\n\\npara2"`` -- and note the two spellings are in
-    different paragraphs, because a name once recorded poisons the rest of
-    the document. ``<img>`` and ``<hr>`` lose text the same way; they are
-    the other two converters that discard children. One bare ``<br>``
+    different paragraphs, because a name once recorded poisons the rest
+    of the document. ``<img>`` and ``<hr>`` lose text the same way; they
+    are the other two converters that discard children. One bare ``<br>``
     anywhere before one ``<br />`` is the whole precondition, and GLPI
     bodies are edited by more than one client.
 
-    Rewriting to the bare spelling removes the ``handle_startendtag`` path
-    for void elements, which is where the asymmetry lives; both spellings
-    already build the same node, so nothing else about the output moves.
-    Only the names in :data:`_VOID_ELEMENTS` are touched, and only in real
-    tag position: a self-closed ``<div/>`` is left alone, and cannot be
-    affected anyway, since only a void name is ever recorded.
+    Rewriting to the bare spelling removes the ``handle_startendtag``
+    path for void elements, which is where the asymmetry lives; both
+    spellings already build the same node, so nothing else about the
+    output moves. Only the names in :data:`_VOID_ELEMENTS` are touched,
+    and only where the parser really reports ``handle_startendtag``: a
+    self-closed ``<div/>`` is left alone, and cannot be affected anyway,
+    since only a void name is ever recorded.
+
+    Which tags those are is the parser's answer rather than this
+    module's, and that is not cosmetic. Deciding it by pattern meant
+    inheriting every way the pattern could be derailed, and a derailed
+    scan reinstates the very defect this works around: measured,
+    ``"<p>one<br>two</p><script>x</ script><p>three<br />TAIL</p>"``
+    lost ``TAIL`` outright, because ``</ script>`` ends raw text for the
+    parser but not for the pattern, so the ``<br />`` after it was never
+    seen and never rewritten. ``<img>`` and ``<hr>`` lost their tails the
+    same way.
 
     Parameters
     ----------
@@ -619,21 +670,15 @@ def _canonicalise_void_elements(content: str) -> str:
 
     if "/>" not in content:
         return content
-
+    spans = _scan(content).void_spans
+    if not spans:
+        return content
     pieces: list[str] = []
     cursor = 0
-    for match in _MARKUP.finditer(content):
-        name = match.group("name")
-        if name is None or name.lower() not in _VOID_ELEMENTS:
-            continue
-        token = match.group(0)
-        if not token.endswith("/>"):
-            continue
-        pieces.append(content[cursor : match.start()])
-        pieces.append(_VOID_SELF_CLOSE.sub(">", token))
-        cursor = match.end()
-    if not pieces:
-        return content
+    for start, end in spans:
+        pieces.append(content[cursor:start])
+        pieces.append(_VOID_SELF_CLOSE.sub(">", content[start:end]))
+        cursor = end
     pieces.append(content[cursor:])
     return "".join(pieces)
 
@@ -671,6 +716,15 @@ def from_transport(value: object) -> str:
         everything after the second spelling of ``<br>`` in a body that
         used both -- see :func:`_canonicalise_void_elements`.
 
+        A document ``html.parser`` refuses outright takes the degraded
+        path as well, rather than the exception it used to. ``<![FOO[``
+        is the reachable case: an unknown marked-section keyword, which
+        ``bs4`` turns into ``ParserRejectedMarkup``. There is nothing to
+        gain from handing such a body to a converter that will reject it
+        too, and a caller who can read their text is better off than one
+        holding an error -- so :func:`_html_nesting_depth` reports past
+        the ceiling and the body is stripped.
+
         Raises
         ------
         GlpiContentError
diff --git a/glpi_python_client/content/tests/test_conversion.py b/glpi_python_client/content/tests/test_conversion.py
index fe92344..38ebff5 100644
--- a/glpi_python_client/content/tests/test_conversion.py
+++ b/glpi_python_client/content/tests/test_conversion.py
@@ -9,6 +9,7 @@
     MAX_HTML_DEPTH,
     GlpiContentConverter,
     _html_nesting_depth,
+    _strip_tags,
 )
 
 
@@ -943,3 +944,56 @@ def test_a_document_with_no_closing_bracket_is_answered_without_scanning() -> No
     assert _html_nesting_depth(html) == 0
     assert GlpiContentConverter.from_transport(html).startswith('<div a="')
     assert "the printer" in GlpiContentConverter.from_transport(html + "the printer")
+
+
+def test_a_document_the_parser_rejects_degrades_instead_of_raising() -> None:
+    """An unknown marked-section keyword stops the parser, not the body.
+
+    ``_markupbase.parse_marked_section`` raises ``AssertionError`` for a
+    keyword it does not know, and ``bs4`` catches that same
+    ``AssertionError`` and re-raises it as ``ParserRejectedMarkup``. So a
+    document carrying ``<![FOO[`` is one the converting path cannot
+    convert either, and the old behaviour was to let it try and fail:
+    the caller got a :class:`GlpiContentError` and none of their text.
+
+    Reporting a depth past the ceiling instead sends it down the degraded
+    path, where it yields its words. Degrading beats raising when the
+    alternative is a body nobody can read.
+    """
+
+    html = "<p>Le serveur ne repond plus. SECRET</p><![FOO[x]]>"
+
+    assert _html_nesting_depth(html) == MAX_HTML_DEPTH + 1
+    assert "SECRET" in GlpiContentConverter.from_transport(html)
+
+
+def test_the_text_after_a_construct_the_parser_rejects_is_still_kept() -> None:
+    """The give-up point is not the end of the body.
+
+    The scan stops where the parser stopped, so everything past that
+    construct would go missing unless it is handed back explicitly --
+    and a body is far more likely to carry the marked section in the
+    middle than at the end.
+    """
+
+    html = "<p>avant</p><![FOO[x]]><p>apres SECRET</p>"
+
+    assert "avant" in _strip_tags(html)
+    assert "SECRET" in _strip_tags(html)
+    assert "SECRET" in GlpiContentConverter.from_transport(html)
+
+
+def test_stripping_a_document_with_no_closing_bracket_keeps_all_of_it() -> None:
+    """The degraded path needs the same guard the depth scan needs.
+
+    ``html.parser`` cannot complete a tag that never closes, so
+    ``close()`` flushes it one character at a time and rescans the tail
+    at each step: measured, 32 KB of ``'<div a="'`` costs it 13 seconds.
+    The whole document is that unfinished tag's text, which is the answer
+    the guard returns directly.
+    """
+
+    html = '<div a="' * 4000 + "le serveur ne repond plus"
+
+    assert _strip_tags(html).endswith("le serveur ne repond plus")
+    assert _strip_tags(html).startswith('<div a="')

From 9759dca1174f9b5f66a6d9beaa94966698a87e56 Mon Sep 17 00:00:00 2001
From: baraline <antoine.guillaume45@gmail.com>
Date: Tue, 8 Sep 2026 23:56:50 +0200
Subject: [PATCH 11/14] test(content): assert the parity promise, not one
 CPython build's quirks

CI has been red on this branch all day, on every Python version, while
the suite passed locally. The cause is not the module: `html.parser`'s
reading of a *malformed* construct is not stable across CPython patch
releases, and six content tests had written down the literal output of
the interpreter they were authored on.

Measured on the same documents, three builds disagree. An unterminated
`<script>` body is discarded on `close()` by 3.12.3 and flushed as
character data by 3.12.14. A comment with no `-->` is handed back as data
by 3.12.3 and 3.12.11 and swallowed by 3.12.14. An end tag carrying a
quoted `>` -- `</p title="> SECRET ">` -- keeps the tail as text on
3.12.3 and 3.12.11 and consumes it on 3.12.14. And `<![FOO[` raises
AssertionError from `_markupbase` on 3.12.3 and 3.12.11 but not on
3.12.14, so the give-up path is reachable on some interpreters and dead
on others. Local is 3.12.3, CI is 3.12.14; 3.12.11 was installed to
confirm the middle point.

None of that is a defect in this module, and none of it is something a
literal can track. What the module promises is parity -- a body must not
say less because of the path it took -- so the expectation is now
computed from the converting path instead of written down. Both paths
read the same parser, so they move together, and the relation asserted
is inclusion rather than equality, which is what was ever true: the
degraded rendering is a superset. Prose is compared as its letters in
order, because whitespace falls differently at a markup boundary in both
directions and the converter adds punctuation of its own.

The construct-by-construct table keeps its measured `kept` booleans as
documentation, and now asserts them only where the running parser still
agrees with the measurement; the parity assertion beside them holds
unconditionally.

`<![FOO[` is asked of the interpreter rather than assumed, so the test
covers both the build that rejects the document and the build that does
not. The handler stays: the package supports 3.10 through 3.14, and the
rejection is live on several of them.

The padding that pushes a body past the ceiling is now closed before the
construct under test rather than wrapped around it. Wrapping changed what
the construct meant -- an unterminated `<!weird` runs to the next `>`,
which inside a wrapper is the `>` of a `</div>`, so the same text was a
bogus comment there and character data at end of input.

Verified on 3.12.3 and 3.12.11: 1351 passed on both. Live integration
against GLPI 11 after the parser rewrite: 44 passed, 4 skipped.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../content/tests/test_conversion.py          | 132 ++++++++++++++----
 1 file changed, 106 insertions(+), 26 deletions(-)

diff --git a/glpi_python_client/content/tests/test_conversion.py b/glpi_python_client/content/tests/test_conversion.py
index 38ebff5..e4ca143 100644
--- a/glpi_python_client/content/tests/test_conversion.py
+++ b/glpi_python_client/content/tests/test_conversion.py
@@ -1,5 +1,8 @@
 from __future__ import annotations
 
+import re
+from html.parser import HTMLParser
+
 import pytest
 from bs4 import BeautifulSoup
 
@@ -12,6 +15,84 @@
     _strip_tags,
 )
 
+#: Everything that is not a letter or a digit.
+_NOT_PROSE = re.compile(r"[^0-9A-Za-z]+")
+
+
+def _prose(text: str) -> str:
+    """Reduce a rendering to its letters and digits, in order.
+
+    Whitespace falls differently at a markup boundary on the two paths --
+    the converter joins ``a<b>c`` as ``a**c**`` where the degraded path
+    joins it as ``ac``, and the degraded path breaks a line at a block
+    edge the converter runs together -- and the converter adds
+    punctuation of its own: table pipes, fence backticks, list bullets,
+    link and image brackets. None of that is prose, and none of it is
+    what the fallback promises to reproduce.
+    """
+
+    return _NOT_PROSE.sub("", text)
+
+
+def _is_subsequence(needle: str, haystack: str) -> bool:
+    remaining = iter(haystack)
+    return all(character in remaining for character in needle)
+
+
+def _parser_rejects(html: str) -> bool:
+    """Return whether ``html.parser`` gives up on this document.
+
+    ``_markupbase`` raises ``AssertionError`` for an unknown
+    marked-section keyword, and which keywords count has changed across
+    CPython patch releases -- so whether a given document is rejected is
+    a question to ask the running interpreter rather than to assume.
+    """
+
+    parser = HTMLParser(convert_charrefs=False)
+    try:
+        parser.feed(html)
+        parser.close()
+    except AssertionError:
+        return True
+    return False
+
+
+def assert_the_degraded_path_says_no_less(shallow: str, depth: int = 300) -> None:
+    """Assert the module's one promise about the fallback, on this parser.
+
+    ``html.parser``'s reading of a *malformed* construct is not stable
+    across CPython patch releases. Measured on the same three documents,
+    3.12.3, 3.12.11 and 3.12.14 disagree about an unterminated
+    ``<script>``, about a comment with no ``-->``, and about an end tag
+    carrying a quoted ``>``: each build emits a different set of events.
+    Writing down the literal output of one of them made this suite assert
+    that interpreter's quirks rather than the module's contract, and it
+    duly went red on a patch bump while the module itself was fine.
+
+    So the expectation is computed from the converting path rather than
+    written down. Both paths read the same parser, so they move together,
+    and the promise was never equality anyway -- it is inclusion: **a
+    body must not say less because of the path it took.**
+    """
+
+    # The padding is closed *before* the construct rather than wrapped
+    # around it. Wrapping changes what the construct means: an
+    # unterminated ``<!weird`` runs to the next ``>``, which inside a
+    # wrapper is the ``>`` of a ``</div>``, so the same text is a bogus
+    # comment there and character data at end of input. The point of the
+    # padding is only to push the depth past the ceiling.
+    deep = "<div>" * depth + "</div>" * depth + shallow
+
+    assert _html_nesting_depth(deep) > MAX_HTML_DEPTH, "the deep body must degrade"
+
+    converted = GlpiContentConverter.from_transport(shallow)
+    degraded = GlpiContentConverter.from_transport(deep)
+
+    assert _is_subsequence(_prose(converted), _prose(degraded)), (
+        f"the degraded path said less than the converting one\n"
+        f"  converted: {converted!r}\n  degraded:  {degraded!r}"
+    )
+
 
 def test_content_converter_uses_markdown_in_python_and_html_for_glpi() -> None:
     markdown = GlpiContentConverter.from_transport(
@@ -267,23 +348,26 @@ def test_the_degraded_path_keeps_exactly_what_the_converter_keeps(
     converted = GlpiContentConverter.from_transport(shallow)
     degraded = GlpiContentConverter.from_transport(deep)
 
-    assert ("SECRET" in converted) is kept
-    assert ("SECRET" in degraded) is kept
+    # ``kept`` records what was measured, and is asserted only where the
+    # running parser still agrees with the measurement -- the reading of a
+    # malformed construct moves between CPython patch releases, and it is
+    # the parity below, not the snapshot, that this module promises.
+    if ("SECRET" in converted) is kept:
+        assert ("SECRET" in degraded) is kept
+    assert not ("SECRET" in converted and "SECRET" not in degraded)
 
 
-def test_an_unterminated_raw_text_element_swallows_the_rest_on_both_paths() -> None:
-    """The one raw-text case where dropping the body IS parity.
+def test_an_unterminated_raw_text_element_reads_the_same_on_both_paths() -> None:
+    """Whether an unclosed ``<script>`` body survives is the parser's call.
 
-    An unclosed ``<script>`` makes the parser read everything after it as
-    script text, and the converting path prints none of it -- so keeping it
-    here would be the divergence.
+    It made this test its own snapshot: 3.12.3 discards the body on
+    ``close()`` and 3.12.14 flushes it as character data, so the literal
+    that was correct on one was wrong on the other. What has to hold on
+    either is that the two paths agree.
     """
 
-    shallow = "<p>keep</p><script>SECRET"
-    deep = "<div>" * 300 + shallow + "</div>" * 300
-
-    assert GlpiContentConverter.from_transport(shallow) == "keep"
-    assert GlpiContentConverter.from_transport(deep) == "keep"
+    assert_the_degraded_path_says_no_less("<p>keep</p><script>SECRET")
+    assert "keep" in GlpiContentConverter.from_transport("<p>keep</p><script>SECRET")
 
 
 def test_a_document_at_the_ceiling_is_still_converted() -> None:
@@ -518,11 +602,7 @@ def test_the_degraded_path_keeps_the_text_of_a_broken_comment() -> None:
     took never changes what it says, so it keeps it too.
     """
 
-    html = "<div>" * 300 + "<p>keep</p>" + "</div>" * 300 + "<!--oops but keep this"
-
-    stripped = GlpiContentConverter.from_transport(html)
-
-    assert stripped == "keep\n\n<!--oops but keep this"
+    assert_the_degraded_path_says_no_less("<p>keep</p><!--oops but keep this")
 
 
 def test_the_degraded_path_drops_a_comment_the_parser_understood() -> None:
@@ -718,11 +798,8 @@ def test_an_unterminated_declaration_at_end_of_input_is_kept() -> None:
     the tail of the body.
     """
 
-    shallow = "<p>keep this</p><!weird"
-    deep = "<div>" * 300 + "<p>keep this</p>" + "</div>" * 300 + "<!weird"
-
-    assert GlpiContentConverter.from_transport(shallow) == "keep this\n\n<!weird"
-    assert GlpiContentConverter.from_transport(deep) == "keep this\n\n<!weird"
+    assert_the_degraded_path_says_no_less("<p>keep this</p><!weird")
+    assert "keep this" in GlpiContentConverter.from_transport("<p>keep this</p><!weird")
 
 
 @pytest.mark.parametrize(
@@ -923,10 +1000,9 @@ def test_a_misread_tag_end_does_not_delete_prose() -> None:
     """
 
     body = '<p>Bonjour</p title="> Le serveur ne repond plus. SECRET ">fin'
-    deep = "<div>" * 300 + body + "</div>" * 300
 
-    assert "SECRET" in GlpiContentConverter.from_transport(body)
-    assert "SECRET" in GlpiContentConverter.from_transport(deep)
+    assert_the_degraded_path_says_no_less(body)
+    assert "Bonjour" in GlpiContentConverter.from_transport(body)
 
 
 def test_a_document_with_no_closing_bracket_is_answered_without_scanning() -> None:
@@ -963,7 +1039,10 @@ def test_a_document_the_parser_rejects_degrades_instead_of_raising() -> None:
 
     html = "<p>Le serveur ne repond plus. SECRET</p><![FOO[x]]>"
 
-    assert _html_nesting_depth(html) == MAX_HTML_DEPTH + 1
+    if _parser_rejects(html):
+        assert _html_nesting_depth(html) == MAX_HTML_DEPTH + 1
+    else:
+        assert _html_nesting_depth(html) <= MAX_HTML_DEPTH
     assert "SECRET" in GlpiContentConverter.from_transport(html)
 
 
@@ -981,6 +1060,7 @@ def test_the_text_after_a_construct_the_parser_rejects_is_still_kept() -> None:
     assert "avant" in _strip_tags(html)
     assert "SECRET" in _strip_tags(html)
     assert "SECRET" in GlpiContentConverter.from_transport(html)
+    assert "avant" in GlpiContentConverter.from_transport(html)
 
 
 def test_stripping_a_document_with_no_closing_bracket_keeps_all_of_it() -> None:

From 3e50eb898eaf3d7a2d2bfe2736b1305d9c7fdef1 Mon Sep 17 00:00:00 2001
From: baraline <antoine.guillaume45@gmail.com>
Date: Wed, 9 Sep 2026 00:01:16 +0200
Subject: [PATCH 12/14] docs(changelog): record that html.parser varies by
 CPython patch level

The give-up path for an unknown marked-section keyword is live on 3.10
through 3.12.11 and gone on 3.12.14, and the same three builds disagree
about an unterminated <script>, a comment with no --> and an end tag
carrying a quoted >. Stating it unconditionally was wrong; the depth
decision tracks the parser on every version, but the text a broken
construct contributes to a degraded body is the interpreter's.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 CHANGELOG.md | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 62e6d3f..01c45d1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -156,9 +156,19 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
     />TAIL</p>"` lost `TAIL` outright, and `<img>` and `<hr>` lost their
     tails the same way.
   - **A document the parser rejects now degrades instead of raising.**
-    `<![FOO[` makes `_markupbase` raise `AssertionError`, which `bs4`
-    re-raises as `ParserRejectedMarkup`; the caller used to get a
+    `<![FOO[` makes `_markupbase` raise `AssertionError` on the
+    interpreters where that keyword is unknown — 3.10 through 3.12.11 as
+    measured, no longer 3.12.14 — and `bs4` re-raises it as
+    `ParserRejectedMarkup`. Where it happens, the caller used to get a
     `GlpiContentError` and none of their text, and now gets their words.
+
+  Note that `html.parser`'s reading of a *malformed* construct is not
+  stable across CPython patch releases: the same three builds disagree
+  about an unterminated `<script>`, a comment with no `-->` and an end
+  tag carrying a quoted `>`. The scan tracks the parser rather than a
+  snapshot of it, so the depth decision stays correct on every version,
+  but the exact text a broken construct contributes to a degraded body is
+  the interpreter's. Well-formed content is unaffected.
   - **A processing instruction no longer leaves `<?` and `>` in the
     degraded text.** The converting path prints the body alone, so this
     does too.

From b5e8cf291928848d234927ee62324bec787026ec Mon Sep 17 00:00:00 2001
From: baraline <antoine.guillaume45@gmail.com>
Date: Wed, 9 Sep 2026 08:27:09 +0200
Subject: [PATCH 13/14] fix(content)!: attempt the conversion instead of
 predicting its depth

MAX_HTML_DEPTH and the scan behind it are gone. from_transport now runs
markdownify and catches the RecursionError, stripping the body to its
text when the walk does not fit.

The bound was wrong in both directions. Too low: the budget is not 1000
frames, it is whatever is left of the stack when the conversion starts,
and that belongs to the caller -- so a bound fixed in advance had to
assume the worst, and 200 against a measured cliff of 494 flattened
everything in between. Measured, a 300-level and a 400-level body now
come back as Markdown with their links, emphasis and lists intact where
they used to come back as plain text, with no error to notice and no way
for a caller to ask for better.

And too fragile: predicting the depth meant reproducing html.parser's
idea of the tree, and three rounds of adversarial review found seven ways
for the estimate to land under the real depth -- each one sending a
document to markdownify and into the very RecursionError the bound
existed to prevent. Trying the conversion cannot be wrong about whether
the conversion fits. That is the whole argument: the failure mode this
guard existed to prevent was only ever reachable through the guard's own
arithmetic.

A document html.parser refuses outright takes the same path. `<![FOO[`
makes _markupbase raise AssertionError on the interpreters where the
keyword is unknown, and bs4 re-raises it as ParserRejectedMarkup; the
caller used to get a GlpiContentError and none of their words.

Two costs, both measured and both stated in the changelog. The outcome
now depends on the caller's remaining stack, so the same body can convert
from one call site and degrade from a deeper one; nothing is lost either
way, since the degraded rendering keeps every character of prose, but it
is no longer a property of the body alone. And a body too deep to convert
pays the failed attempt before it degrades -- 2.0x to 2.6x the old cost
at 600 and 5000 levels. Ordinary bodies got faster, 0.87x to 0.90x,
because the scan they used to pay for on every single read is gone.

The parser scan stays, minus its stack and its high-water mark: it still
backs the void-tag rewrite and the degraded renderer, which inherited
every one of the pattern's misreadings and its backtracking. A thread
with a larger stack was considered and rejected with
sys.setrecursionlimit, and for the same reason -- the recursion limit is
a counter rather than a measurement, so a deeper thread still needs the
global limit raised to use it. That reasoning moved to the module
docstring, where the AST guard in the raise-site audit still enforces it.

Tests follow the same principle. Six suites asserted the scan's arithmetic
against a parallel implementation; they are re-pointed at the property
that survives, over the same corpora -- that the two renderings of one
body do not disagree about what is markup, which is how those
misreadings would surface now. The fallback is called directly rather
than provoked with a 600-level body, because provoking it cost this suite
333 seconds under coverage instrumentation against 108 now, and because
the routing is one test's job rather than fifty's.

Verified on CPython 3.12.3 and 3.12.11: 1343 passed, 97.45% coverage.
257000 fuzzed documents with 0 non-GlpiError escapes, 0 prose losses and
0 crashes. Sphinx, mypy strict, ruff and unasync --check clean.

BREAKING CHANGE: glpi_python_client.content.conversion.MAX_HTML_DEPTH is
removed. It was added earlier in this same unreleased cycle and appears
in no published release, so no released API changes.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 CHANGELOG.md                                  |  52 +-
 docs/api_reference.rst                        |  18 +-
 docs/development.md                           |  11 +-
 docs/user_guide.rst                           |  13 +-
 glpi_python_client/_errors.py                 |   5 +-
 glpi_python_client/content/conversion.py      | 321 ++++------
 .../content/tests/test_conversion.py          | 560 +++++++++---------
 .../models/api_schema/_content.py             |  12 +-
 .../models/custom_schema/_ticket_context.py   |   5 +-
 .../testing/tests/test_raise_site_audit.py    |   7 +-
 skills/glpi-knowledge-base/SKILL.md           |   2 +-
 skills/glpi-plugin-fields/SKILL.md            |   2 +-
 skills/glpi-ticket-timeline/SKILL.md          |   2 +-
 skills/glpi-ticket-workflow/SKILL.md          |   2 +-
 14 files changed, 501 insertions(+), 511 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 01c45d1..b1dc065 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -22,12 +22,45 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   as a bare builtin from a library whose whole error surface is supposed
   to derive from `GlpiError`.
 
-  `from_transport` now measures nesting first, with a flat non-recursive
-  O(n) scan, and past `MAX_HTML_DEPTH` (200) strips tags instead of
-  parsing. **It degrades, it never truncates, and it does not raise for
-  depth**: every character the converting path would have produced also
+  `from_transport` now *attempts* the conversion and answers the
+  `RecursionError` by stripping the document to its text instead.
+  **It degrades, it never truncates, and it does not raise for depth**:
+  every character of prose the converting path would have produced also
   appears in the degraded rendering.
 
+  Attempting it rather than predicting it is the whole design, and it
+  replaced a fixed `MAX_HTML_DEPTH = 200` bound that was wrong in both
+  directions. Too low, because the budget is not 1000 frames but whatever
+  is left of the stack when the conversion starts, and that belongs to
+  the caller — so the bound had to assume the worst and flattened every
+  body between 200 and the real cliff of about 494. Measured, a
+  300-level and a 400-level body now come back as **Markdown with their
+  links, emphasis and lists intact** where they used to come back as
+  plain text, with no error to notice and no way to ask for better. And
+  too fragile, because predicting the depth meant reproducing the
+  parser's idea of the tree: three rounds of adversarial review found
+  seven ways for that estimate to land *under* the real depth, each of
+  which sent a document to `markdownify` and into the very
+  `RecursionError` the bound existed to prevent.
+
+  Trying the conversion cannot be wrong about whether the conversion
+  fits. `MAX_HTML_DEPTH` and the scan behind it are gone; the constant
+  was introduced in this same unreleased cycle and never shipped.
+
+  Two consequences worth knowing. The outcome now depends on the caller's
+  remaining stack, so the same body can convert from one call site and
+  degrade from a deeper one — nothing is lost either way, but a caller
+  comparing two renderings of one body should know which knob moved it.
+  And a body too deep to convert now pays the failed attempt before it
+  degrades: measured, 2.0x to 2.6x the old cost at 600 and 5000 levels.
+  Ordinary bodies got *faster*, at 0.87x to 0.90x, because the scan they
+  used to pay for on every read is gone.
+
+  A document `html.parser` refuses outright — `<![FOO[`, an unknown
+  marked-section keyword, which `bs4` re-raises as
+  `ParserRejectedMarkup` — takes the same degraded path, where it used
+  to raise and give the caller none of their text.
+
   Both halves were fuzzed against the real parser over 15000 documents,
   with zero under-counts, zero over-counts and zero text losses. Getting
   there took several rules that are not the obvious ones:
@@ -174,11 +207,12 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
     does too.
 
   Cost, end to end and on identical output: 0.77x to 1.52x of the previous
-  implementation on realistic bodies — faster on sparse prose, where the
-  scan is four times quicker than the pattern was — and the guard stays 6
-  to 18% of the `markdownify` call it protects. The exponential shapes are
-  flat: 39 bytes of the whitespace bomb went from 20.8 s to 0.12 ms, and
-  20 KB of it costs 0.67 ms.
+  implementation on realistic bodies. The exponential shapes are flat: 39
+  bytes of the whitespace bomb went from 20.8 s to 0.12 ms, and 20 KB of
+  it costs 0.67 ms. The depth scan those defects were found in has since
+  been removed altogether — see the entry above — but the same parser now
+  backs the void-tag rewrite and the degraded renderer, which inherited
+  every one of the misreadings and the backtracking too.
 
   The one shape where `html.parser` is worse than linear is a document
   carrying no `>` at all, where `close()` advances a character at a time
diff --git a/docs/api_reference.rst b/docs/api_reference.rst
index 31af3a5..0c62a1b 100644
--- a/docs/api_reference.rst
+++ b/docs/api_reference.rst
@@ -115,14 +115,16 @@ its page being read.
 
 Very deeply nested HTML is the case worth knowing about.
 ``markdownify`` walks the document recursively and runs out of stack at
-around 494 levels of nesting, so past
-:data:`glpi_python_client.content.conversion.MAX_HTML_DEPTH` (200) the
-converter strips tags instead of parsing. It degrades, it never
-truncates, and it does not raise: every character the normal rendering
-would have produced still appears. What is lost is structure rather than
-words — link targets and image alt text, code fencing and ``<pre>``
-indentation, ``&nbsp;`` alignment. Anything else that goes wrong in
-either direction raises :class:`GlpiContentError`.
+around 494 levels of nesting. The converter does not try to predict
+that: it attempts the conversion and, if the walk does not fit, strips
+tags instead. It degrades, it never truncates, and it does not raise:
+every character the normal rendering would have produced still appears.
+What is lost is structure rather than words — link targets and image alt
+text, code fencing and ``<pre>`` indentation, ``&nbsp;`` alignment.
+Because the budget is the stack left when the conversion starts, the
+same body can convert from one call site and degrade from a deeper one.
+Anything else that goes wrong in either direction raises
+:class:`GlpiContentError`.
 
 Because the conversion is cached on first read, a read model should be
 treated as immutable afterwards: assigning to ``content_html``, or
diff --git a/docs/development.md b/docs/development.md
index 287e227..c8e5cfe 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -86,10 +86,13 @@ python -m pytest
   articles (`content` and `description`) and article revisions. It is
   wired into the models by `models/api_schema/_content.py`, eagerly on
   the write models and through a cached property on the read ones.
-  Inbound HTML nested past `MAX_HTML_DEPTH` is tag-stripped rather than
-  parsed, because `markdownify` recurses per nesting level; that
-  constant carries the derivation, and the rejected alternative
-  (`sys.setrecursionlimit`) beside it. The prohibition is enforced by
+  Inbound HTML too deep for `markdownify` to walk is tag-stripped
+  rather than parsed. The depth is not predicted: the conversion is
+  attempted and the `RecursionError` answered, because the budget is the
+  caller's remaining stack and no bound computed in advance can know it.
+  The module docstring carries the derivation and the rejected
+  alternatives (`sys.setrecursionlimit`, and a thread with a larger
+  stack, which needs the same global). The prohibition is enforced by
   `testing/tests/test_raise_site_audit.py`, not just written down.
 - `glpi_python_client.testing` exposes `make_client` and
   `make_async_client` factories that produce in-memory clients with no
diff --git a/docs/user_guide.rst b/docs/user_guide.rst
index de87416..9fb1b13 100644
--- a/docs/user_guide.rst
+++ b/docs/user_guide.rst
@@ -1556,13 +1556,12 @@ record whose body you actually read.
 
    Deeply nested HTML is the case worth knowing about. The HTML-to-Markdown
    converter walks the document recursively and exhausts the interpreter's
-   stack at around 494 levels of nesting. Past
-   :data:`~glpi_python_client.content.conversion.MAX_HTML_DEPTH` (200,
-   chosen to leave the rest of the stack for your code) ``.content``
-   strips the tags rather than parsing them. **It degrades, it never
-   truncates, and it does not raise**: every character the normal
-   rendering would have produced still appears, so a body never says less
-   because of how deeply it happened to nest. What you lose is structure,
+   stack at around 494 levels of nesting. ``.content`` does not try to
+   predict that -- it attempts the conversion and, when the walk does not
+   fit, strips the tags instead. **It degrades, it never truncates, and it
+   does not raise**: every character the normal rendering would have
+   produced still appears, so a body never says less because of how deeply
+   it happened to nest. What you lose is structure,
    not words — link targets and image alt text, code-block fencing and
    ``<pre>`` indentation, and ``&nbsp;``-padded alignment. Anything else
    that goes wrong raises
diff --git a/glpi_python_client/_errors.py b/glpi_python_client/_errors.py
index dca37f3..b4ae3f4 100644
--- a/glpi_python_client/_errors.py
+++ b/glpi_python_client/_errors.py
@@ -153,8 +153,9 @@ class GlpiContentError(GlpiError):
     used to reach the caller as a bare builtin — most visibly a
     ``RecursionError``, which ``except GlpiError`` does not catch and which
     a caller reading a ticket has no reason to expect from
-    ``get_ticket``. Deeply nested HTML is handled before it gets that far
-    (see :data:`glpi_python_client.content.conversion.MAX_HTML_DEPTH`);
+    ``get_ticket``. Deeply nested HTML is caught and answered with the
+    body's text instead of raising at all (see
+    :meth:`glpi_python_client.content.conversion.GlpiContentConverter.from_transport`);
     this is the backstop for everything else.
 
     Unlike :class:`GlpiStatusError`, :class:`GlpiValidationError` and
diff --git a/glpi_python_client/content/conversion.py b/glpi_python_client/content/conversion.py
index e47718f..55a6a37 100644
--- a/glpi_python_client/content/conversion.py
+++ b/glpi_python_client/content/conversion.py
@@ -1,24 +1,55 @@
 """Content conversion helpers for GLPI payloads.
 
-This module translates between GLPI's HTML transport format and the package's
-canonical Markdown representation used by the rich content models.
-
-Both conversions run third-party parsers, and both walk the document
-recursively, so both have a nesting ceiling. Inbound content is measured
-before it is parsed and degraded past :data:`MAX_HTML_DEPTH` rather than
-allowed to hit that ceiling; anything else that goes wrong in either
-direction surfaces as :class:`~glpi_python_client.GlpiContentError` so no
-parser fault escapes the package's exception taxonomy.
+This module translates between GLPI's HTML transport format and the
+package's canonical Markdown representation used by the rich content
+models.
+
+Neither *parse* recurses -- ``html.parser`` is an iterative scanner --
+but ``markdownify`` walks the finished tree recursively, at about two
+CPython frames per nesting level, so inbound conversion has a nesting
+ceiling. Measured from a shallow stack against the default 1000-frame
+limit, the deepest document that converts is 494 levels: the same 494
+for ``<div>``, ``<p>``, ``<blockquote>`` and ``<table><tr><td>``, and
+495 for ``<ul><li>``, which is what identifies the cost as per-level.
+
+**The ceiling is discovered rather than predicted.** Inbound conversion
+is attempted, and a ``RecursionError`` is caught and answered by
+stripping the document to its text instead -- see
+:meth:`GlpiContentConverter.from_transport`. Estimating the depth up
+front and degrading past a fixed bound was the previous design, and it
+was wrong in both directions: it degraded bodies that would have
+converted, because the bound had to assume the worst about the caller's
+remaining stack, and three rounds of review found seven ways for the
+estimate to come in *under* the real tree, each of which put a document
+through ``markdownify`` and into the ``RecursionError`` the bound
+existed to prevent. Trying the conversion cannot be wrong about whether
+the conversion fits.
+
+Anything else that goes wrong in either direction surfaces as
+:class:`~glpi_python_client.GlpiContentError`, so no parser fault
+escapes the package's exception taxonomy.
+
+**``sys.setrecursionlimit`` is deliberately not called, here or anywhere
+in the package.** It is process-global state that belongs to the
+application, not to a library an application imported; and raising the
+limit past what the C stack can hold turns a catchable
+``RecursionError`` into a hard interpreter crash -- on Windows, an
+access violation with no traceback. It moves the cliff and makes falling
+off it worse. Degrading the one body that does not fit is the answer
+that does not. Running the walk in a thread with a larger stack was
+considered and rejected for the same reason: the recursion limit is a
+counter rather than a measurement of the stack, so a deeper thread still
+needs the global limit raised to use it.
 """
 
 from __future__ import annotations
 
 import re
-from collections import Counter
 from html import unescape
 from html.entities import html5 as _HTML5_REFERENCES
 from html.parser import HTMLParser
 
+from bs4 import ParserRejectedMarkup
 from markdown import markdown as markdown_to_html
 from markdownify import markdownify as html_to_markdown
 
@@ -113,37 +144,6 @@
     """.split()
 )
 
-#: Nesting depth past which inbound HTML is stripped instead of converted.
-#:
-#: ``markdownify`` walks the parsed tree recursively and spends about two
-#: CPython frames per nesting level. Measured against the default
-#: 1000-frame limit, from a shallow stack, the deepest document that
-#: converts is 494 levels: the same 494 for ``<div>``, ``<p>``,
-#: ``<blockquote>`` and ``<table><tr><td>``, and 495 for ``<ul><li>``,
-#: which is what identifies the cost as per-level. One level past it
-#: raises ``RecursionError``.
-#:
-#: The ceiling is 200 rather than 494 because the budget is not 1000 frames,
-#: it is whatever is left of the stack when the conversion starts, and that
-#: belongs to the caller. The package's own contribution is small and, since
-#: conversion moved to the attribute, no longer depends on how the record
-#: was fetched: measured, 5 frames below the caller when ``.content`` is
-#: read -- the same 5 whether the model came from ``model_validate`` or from
-#: ``client.get_ticket`` -- and 9 on the write path, where the renderer runs
-#: inside ``model_dump``. What is not small is an application reading
-#: ``.content`` from inside a request handler, a template render or a
-#: recursive walk. Converting a 200-level document was measured to peak at
-#: 412 frames, so it stays safe until the caller's own stack passes about
-#: 588 -- and no document a human wrote nests 200 elements deep.
-#:
-#: **``sys.setrecursionlimit`` is deliberately not called, here or anywhere
-#: in the package.** It is process-global state that belongs to the
-#: application, not to a library an application imported; and raising the
-#: limit past what the C stack can hold turns a catchable ``RecursionError``
-#: into a hard interpreter crash -- on Windows, an access violation with no
-#: traceback. It moves the cliff and makes falling off it worse. Bounding
-#: the input is the fix that does not.
-MAX_HTML_DEPTH = 200
 
 #: One character reference, with or without its terminating semicolon.
 #:
@@ -208,24 +208,32 @@ def _looks_like_html(content: str) -> bool:
 class _ParserScan(HTMLParser):
     """Walk a document with the parser that will convert it, not one like it.
 
-    Everything this module needs to know before it hands content to
-    ``markdownify`` -- how deep the tree will be, which self-closing void
-    tags to rewrite, and what the text is when the tree is too deep to
-    walk -- is a question about ``html.parser``'s dispatch. This subclass
-    asks ``html.parser`` instead of describing it.
+    Both remaining questions this module asks about raw HTML -- which
+    self-closing void tags to rewrite, and what the text is when the tree
+    will not fit the stack -- are questions about ``html.parser``'s
+    dispatch. This subclass asks ``html.parser`` instead of describing
+    it.
 
     It replaces a regular expression that reproduced that dispatch by
-    imitation. The imitation was wrong in five unbounded ways at once, and
-    each was found only after it shipped: a comment closes on ``--\\s*>``
+    imitation, and the imitation kept being wrong in ways that showed up
+    only after they shipped. A comment closes on ``--\\s*>``
     and not only on ``-->``, ``</ script>`` ends raw text, ``<![IGNORE[``
     opens a marked section, ``</ div foo>`` is a bogus comment rather than
     an end tag, and ``<a href=/>`` leaves an element *open* because the
-    unquoted value swallows the ``/``. Each made a document measure one
-    level deep where the real tree was hundreds, which is the one error
-    that ends in the ``RecursionError`` :data:`MAX_HTML_DEPTH` exists to
-    prevent. Two more were cost rather than correctness: a run of
-    whitespace inside a failing tag made the attribute pattern backtrack
-    as ``(a+)*``, and a 62-byte body took 7.45 seconds.
+    unquoted value swallows the ``/``. Two more were cost rather than
+    correctness: a run of whitespace inside a failing tag made the
+    attribute pattern backtrack as ``(a+)*``, and a 39-byte body took
+    20.8 seconds.
+
+    Those seven were found as depth under-counts, back when this module
+    predicted the nesting depth instead of attempting the conversion.
+    Predicting it is gone, but the pattern's other two readers were wrong
+    the same way and are still here: a derailed scan meant
+    :func:`_canonicalise_void_elements` never saw the ``<br />`` it
+    exists to rewrite, so
+    ``"<p>one<br>two</p><script>x</ script><p>three<br />TAIL</p>"`` lost
+    ``TAIL`` outright, and :func:`_strip_tags` inherited both the
+    misreadings and the backtracking.
 
     Reading the parser's own event stream cannot be wrong about the
     parser, so none of those remain judgement calls. It is also not a new
@@ -242,10 +250,9 @@ class _ParserScan(HTMLParser):
     reference arrives as its own event and :func:`_resolve_references`
     applies the whole-name rule the converting path applies.
 
-    One pass answers all three questions, so a conversion scans once
-    rather than once per question. ``collect_text`` is what separates
-    them: measuring depth needs no text, and accumulating the pieces of a
-    150 KB body when only the depth is wanted is waste.
+    ``collect_text`` separates the two callers: the void rewrite needs
+    only the spans, and accumulating the pieces of a 150 KB body for it
+    would be waste.
 
     Parameters
     ----------
@@ -265,13 +272,6 @@ def __init__(self, content: str, *, collect_text: bool = False) -> None:
         for line in content.splitlines(keepends=True):
             offsets.append(offsets[-1] + len(line))
         self._line_offsets = offsets
-        #: Open element names, innermost last.
-        self.stack: list[str] = []
-        #: How many of each name are open, so a close with no match can be
-        #: ignored without walking the stack.
-        self.open_names: Counter[str] = Counter()
-        #: High-water mark of :attr:`stack`.
-        self.deepest = 0
         #: Source spans of ``<void ... />`` tags, for
         #: :func:`_canonicalise_void_elements`.
         self.void_spans: list[tuple[int, int]] = []
@@ -307,25 +307,7 @@ def _boundary(self, tag: str) -> None:
         if self._collect_text and tag in _BLOCK_ELEMENTS:
             self.pieces.append("\n")
 
-    def _leaf(self) -> None:
-        if len(self.stack) + 1 > self.deepest:
-            self.deepest = len(self.stack) + 1
-
     def handle_starttag(self, tag: str, attrs: object) -> None:
-        """Open an element, or count a void one as the leaf it is.
-
-        A void element is a node but never a parent, so it lifts the
-        high-water mark without joining the stack -- which is why
-        ``"<br>" * 5000`` is one level rather than five thousand.
-        """
-
-        if tag in _VOID_ELEMENTS:
-            self._leaf()
-        else:
-            self.stack.append(tag)
-            self.open_names[tag] += 1
-            if len(self.stack) > self.deepest:
-                self.deepest = len(self.stack)
         self._boundary(tag)
 
     def handle_startendtag(self, tag: str, attrs: object) -> None:
@@ -340,7 +322,6 @@ def handle_startendtag(self, tag: str, attrs: object) -> None:
         no others.
         """
 
-        self._leaf()
         if tag in _VOID_ELEMENTS:
             token = self.get_starttag_text()
             start = self._at()
@@ -349,21 +330,6 @@ def handle_startendtag(self, tag: str, attrs: object) -> None:
         self._boundary(tag)
 
     def handle_endtag(self, tag: str) -> None:
-        """Pop to the matching open element, or pop nothing at all.
-
-        ``bs4`` looks up the stack for a match and ignores a close with no
-        open element of that name. A counter that decremented anyway made
-        ``"<div></p>" * 600`` -- a Word or Outlook paste rather than an
-        adversarial input -- measure 1 against a real 600. Interleaved
-        tags (``<b><i>x</b></i>``) pop the way the parser pops them.
-        """
-
-        if self.open_names[tag]:
-            while True:
-                popped = self.stack.pop()
-                self.open_names[popped] -= 1
-                if popped == tag:
-                    break
         self._boundary(tag)
 
     def handle_data(self, data: str) -> None:
@@ -442,11 +408,10 @@ def _scan(content: str, *, collect_text: bool = False) -> _ParserScan:
     is not a case to guess around, because ``bs4`` catches the same
     ``AssertionError`` and re-raises it as ``ParserRejectedMarkup``: a
     document that stops this scan is a document ``markdownify`` cannot
-    convert either. So the partial scan is kept, the remainder of the
-    source is handed to :attr:`_ParserScan.pieces` as text, and the depth
-    reported by :func:`_html_nesting_depth` sends the document down the
-    degraded path -- where it now yields its text instead of the
-    :class:`GlpiContentError` the converting path would have raised.
+    convert either. So the partial scan is kept and the remainder of the
+    source is handed to :attr:`_ParserScan.pieces` as text, which is what
+    lets :meth:`GlpiContentConverter.from_transport` answer that
+    rejection with the body's words instead of an exception.
 
     Parameters
     ----------
@@ -471,80 +436,15 @@ def _scan(content: str, *, collect_text: bool = False) -> _ParserScan:
     return scan
 
 
-def _html_nesting_depth(content: str) -> int:
-    """Return how deeply ``content`` nests, without recursing to find out.
-
-    One pass of :class:`_ParserScan`, keeping the open elements on a list
-    and its high-water mark. Flat in the stack, which is the point: the
-    number this returns decides whether a recursive parser is safe to
-    run, so computing it must not need one. ``html.parser`` is itself an
-    iterative scanner -- the recursion in the pipeline is
-    ``markdownify``'s walk of the finished tree, not the parse that
-    builds it.
-
-    Exact, now, rather than approximately right. The count is the depth
-    of the tree ``bs4`` will really build, because it is derived from the
-    events of the parser ``bs4`` will really use; the rules that used to
-    have to be restated here -- a close pops by name or is ignored, a
-    childless node is still a node, an unknown name counts, an unclosed
-    tag counts -- are either the parser's own behaviour or live on
-    :class:`_ParserScan` beside the handler that implements them.
-
-    Cost is linear in the document, and small against what it guards:
-    measured at 6-18% of the ``markdownify`` call for tag-dense bodies (a
-    400-row table, 8.4 ms against 47 ms) and 6% for sparse prose (154 KB,
-    0.87 ms against 14 ms), where it is four times *faster* than the
-    pattern it replaced.
-
-    The one shape where ``html.parser`` is worse than linear is a
-    document carrying no ``>`` at all: ``check_for_whole_start_tag``
-    cannot complete a tag, ``close()`` then advances one character at a
-    time, and each step rescans the tail -- measured, 32 KB of
-    ``'<div a="'`` takes 13 seconds. The guard below answers that shape
-    in constant time. It is also unreachable from
-    :meth:`GlpiContentConverter.from_transport`, which runs
-    :func:`_looks_like_html` first and needs a ``>`` to find an element
-    at all; the guard is what makes a direct call safe as well. Once a
-    ``>`` is present the parser is no longer the slower of the two:
-    128 KB of the same shape costs it 57 ms against the pattern's 66 ms.
-
-    Verified against a ground-truth iterative walk of the tree ``bs4``
-    actually builds, over fuzzed documents whose token alphabet carries
-    every construct any review round raised -- including the four whose
-    absence is why the previous corpus could not have found the defects
-    it missed: ``-- >``, ``</ script>``, ``<![IGNORE[`` and runs of
-    whitespace and quotes inside a tag.
-
-    Parameters
-    ----------
-    content : str
-        Raw HTML, or text that may contain angle brackets.
-
-    Returns
-    -------
-    int
-        The depth of the deepest element the parser would build. ``0``
-        for text with no tags at all, and ``MAX_HTML_DEPTH + 1`` for a
-        document the parser rejects, so that it degrades to text rather
-        than being handed to a converter that will reject it too.
-    """
-
-    if "<" not in content or ">" not in content:
-        return 0
-    scan = _scan(content)
-    if scan.rejected:
-        return MAX_HTML_DEPTH + 1
-    return scan.deepest
-
-
 def _strip_tags(content: str) -> str:
     """Reduce HTML to its text without building a tree, keeping every word.
 
-    The degraded path for a document too deeply nested to convert. One
-    pass of :class:`_ParserScan` -- the same scan the depth measurement
-    uses, so the two cannot disagree about what is markup -- then
-    whitespace tidying. No tree, no recursion, no depth ceiling of its
-    own, so it answers for input of any shape.
+    The fallback for a document ``markdownify`` could not walk -- deeper
+    than the caller's remaining stack, or refused by the parser outright.
+    One pass of :class:`_ParserScan`, then whitespace tidying. No tree,
+    no recursion and no ceiling of its own, which is what qualifies it as
+    the fallback: it answers for input of any shape and any depth, so
+    there is always something to give the caller.
 
     It **degrades and never truncates.** The property, stated as
     something checkable: after collapsing whitespace, every character the
@@ -598,10 +498,11 @@ def _strip_tags(content: str) -> str:
 
     if ">" not in content:
         # No ``>`` means no markup to skip, so the whole document is the
-        # text the parser would flush on ``close()`` -- and answering it
-        # here keeps the scan away from the one shape that costs
-        # ``html.parser`` more than linear time. See
-        # :func:`_html_nesting_depth`.
+        # text the parser would flush on ``close()``. Answering it here
+        # also keeps the scan away from the one shape that costs
+        # ``html.parser`` more than linear time: with no ``>`` to finish a
+        # tag, ``close()`` advances one character at a time and rescans
+        # the tail, and 32 KB of an unfinished tag takes 13 seconds.
         text = _resolve_references(content)
     else:
         text = _resolve_references("".join(_scan(content, collect_text=True).pieces))
@@ -703,13 +604,34 @@ def from_transport(value: object) -> str:
         text sent down the HTML path loses whatever the parser does not
         recognise, and Markdown sent down it comes back escaped.
 
-        There are therefore three outcomes, not two. Real HTML nested no
-        deeper than :data:`MAX_HTML_DEPTH` is converted. Real HTML nested
-        deeper than that is stripped to its text instead -- ``markdownify``
-        recurses per level and would exhaust the interpreter's stack, so the
-        depth is measured first, flatly, by :func:`_html_nesting_depth`. The
-        caller gets a readable body either way; **this method degrades, it
-        does not truncate, and it does not raise for depth.**
+        There are therefore three outcomes, not two. Real HTML that fits
+        the stack is converted. Real HTML that does not is stripped to its
+        text instead: ``markdownify`` recurses about two frames per
+        nesting level, so the conversion is *attempted* and its
+        ``RecursionError`` answered, rather than the depth predicted and a
+        bound applied. The caller gets a readable body either way;
+        **this method degrades, it does not truncate, and it does not
+        raise for depth.**
+
+        Attempting it is what makes the answer exact. The budget is not
+        1000 frames, it is whatever is left of the stack when the
+        conversion starts, and that belongs to the caller -- an
+        application reading ``.content`` from inside a request handler, a
+        template render or a recursive walk has less of it than a script
+        does. No bound computed in advance can know that number, so the
+        previous design guessed low, 200 against a measured cliff of 494,
+        and flattened bodies that would have converted. It also had to
+        estimate the depth of the tree, and three rounds of review found
+        seven ways for that estimate to come in *under* the real one --
+        each of which sent a document to ``markdownify`` and into the
+        ``RecursionError`` the bound existed to prevent.
+
+        One consequence is the price of that exactness and worth naming:
+        the outcome now depends on the caller's remaining stack, so the
+        same body can convert from one call site and degrade from a
+        deeper one. Nothing is lost either way -- the degraded rendering
+        keeps every character of prose -- but a caller comparing two
+        renderings of one body should know which knob moved it.
 
         Self-closing void tags are written bare before conversion, which
         works around a ``beautifulsoup4`` defect that silently dropped
@@ -719,11 +641,10 @@ def from_transport(value: object) -> str:
         A document ``html.parser`` refuses outright takes the degraded
         path as well, rather than the exception it used to. ``<![FOO[``
         is the reachable case: an unknown marked-section keyword, which
-        ``bs4`` turns into ``ParserRejectedMarkup``. There is nothing to
-        gain from handing such a body to a converter that will reject it
-        too, and a caller who can read their text is better off than one
-        holding an error -- so :func:`_html_nesting_depth` reports past
-        the ceiling and the body is stripped.
+        ``_markupbase`` raises ``AssertionError`` for and ``bs4``
+        re-raises as ``ParserRejectedMarkup``. A caller who can read
+        their text is better off than one holding an error, and there is
+        nothing else to be done with such a body, so it is stripped too.
 
         Raises
         ------
@@ -739,9 +660,6 @@ def from_transport(value: object) -> str:
             return ""
         if not _looks_like_html(content):
             return content.strip()
-        if _html_nesting_depth(content) > MAX_HTML_DEPTH:
-            return _strip_tags(content)
-
         try:
             markdown = html_to_markdown(
                 _canonicalise_void_elements(content),
@@ -751,6 +669,21 @@ def from_transport(value: object) -> str:
                 escape_underscores=False,
                 escape_asterisks=False,
             )
+        except (RecursionError, ParserRejectedMarkup):
+            # The tree is deeper than the stack left, or the parser will
+            # not build it at all. Both are answered with the text.
+            try:
+                return _strip_tags(content)
+            except RecursionError as exc:
+                # Reachable only from a caller already within a few frames
+                # of the limit, where stripping cannot run either. Named
+                # rather than allowed to escape as a bare builtin, which is
+                # what this taxonomy exists for.
+                raise GlpiContentError(
+                    "Could not convert GLPI HTML content to Markdown: the "
+                    "caller's stack left too little room even to strip its "
+                    "tags."
+                ) from exc
         except Exception as exc:
             raise GlpiContentError(
                 "Could not convert GLPI HTML content to Markdown "
diff --git a/glpi_python_client/content/tests/test_conversion.py b/glpi_python_client/content/tests/test_conversion.py
index e4ca143..b061b33 100644
--- a/glpi_python_client/content/tests/test_conversion.py
+++ b/glpi_python_client/content/tests/test_conversion.py
@@ -9,15 +9,31 @@
 from glpi_python_client import GlpiContentError, GlpiError
 from glpi_python_client.content import conversion
 from glpi_python_client.content.conversion import (
-    MAX_HTML_DEPTH,
     GlpiContentConverter,
-    _html_nesting_depth,
     _strip_tags,
 )
 
 #: Everything that is not a letter or a digit.
 _NOT_PROSE = re.compile(r"[^0-9A-Za-z]+")
 
+#: A Markdown link or image destination.
+#:
+#: The converting path renders a target that the fallback documents as
+#: dropped -- "a link becomes its text without the target, an image
+#: contributes nothing" -- so a URL inside ``]( )`` is not prose either,
+#: and comparing it would assert a difference the module declares.
+_DESTINATION = re.compile(r"\]\([^)]*\)")
+
+#: A link, and the target only the *converting* path renders.
+#:
+#: There is no depth number to ask any more -- the converter attempts the
+#: walk and answers the ``RecursionError`` -- so a test that needs to know
+#: which path ran has to read the output. A link is the cheapest tell:
+#: ``markdownify`` writes ``[probe](u)`` and :func:`_strip_tags` writes
+#: ``probe``.
+PROBE_LINK = '<a href="u">probe</a>'
+PROBE_TARGET = "](u)"
+
 
 def _prose(text: str) -> str:
     """Reduce a rendering to its letters and digits, in order.
@@ -31,7 +47,7 @@ def _prose(text: str) -> str:
     what the fallback promises to reproduce.
     """
 
-    return _NOT_PROSE.sub("", text)
+    return _NOT_PROSE.sub("", _DESTINATION.sub("]", text))
 
 
 def _is_subsequence(needle: str, haystack: str) -> bool:
@@ -57,7 +73,7 @@ def _parser_rejects(html: str) -> bool:
     return False
 
 
-def assert_the_degraded_path_says_no_less(shallow: str, depth: int = 300) -> None:
+def assert_the_degraded_path_says_no_less(shallow: str) -> None:
     """Assert the module's one promise about the fallback, on this parser.
 
     ``html.parser``'s reading of a *malformed* construct is not stable
@@ -80,13 +96,28 @@ def assert_the_degraded_path_says_no_less(shallow: str, depth: int = 300) -> Non
     # unterminated ``<!weird`` runs to the next ``>``, which inside a
     # wrapper is the ``>`` of a ``</div>``, so the same text is a bogus
     # comment there and character data at end of input. The point of the
-    # padding is only to push the depth past the ceiling.
-    deep = "<div>" * depth + "</div>" * depth + shallow
-
-    assert _html_nesting_depth(deep) > MAX_HTML_DEPTH, "the deep body must degrade"
-
-    converted = GlpiContentConverter.from_transport(shallow)
-    degraded = GlpiContentConverter.from_transport(deep)
+    # padding is only to be deeper than the converter can walk.
+    #
+    # The probe link is how the test knows which path ran, now that there
+    # is no depth number to consult: only the converting path renders a
+    # target, so its absence is the degradation.
+    # Both renderings are taken from the *same* document, and the
+    # fallback is called directly rather than provoked with a body deep
+    # enough to exhaust the stack. Provoking it costs a 600-level tree
+    # and a walk that runs until it raises, which under coverage
+    # instrumentation took this suite from 69 seconds to 333; and it
+    # tests the routing, which one test can do once, rather than the
+    # property, which is what every shape here is for.
+    #
+    # The probe link carries the document onto the HTML path. Without it
+    # a fragment whose only tag name is not an element -- ``<scripty>`` --
+    # is plain text rather than markup, and the two sides would not be
+    # renderings of the same thing.
+    document = PROBE_LINK + shallow
+    converted = GlpiContentConverter.from_transport(document)
+    degraded = _strip_tags(document)
+
+    assert PROBE_TARGET in converted, "the body must reach the converting path"
 
     assert _is_subsequence(_prose(converted), _prose(degraded)), (
         f"the degraded path said less than the converting one\n"
@@ -212,50 +243,6 @@ def test_incoming_text_is_not_backslash_escaped(html: str, expected: str) -> Non
 # rather than raising or being cut short.
 
 
-@pytest.mark.parametrize(
-    ("html", "expected"),
-    [
-        ("", 0),
-        ("no tags here", 0),
-        ("<p>one</p>", 1),
-        ("<p>The printer is <strong>offline</strong>.</p>", 2),
-        ("<div>" * 7 + "x" + "</div>" * 7, 7),
-        # An unclosed tag still nests: ``html.parser`` does not auto-close
-        # ``<p>`` or ``<li>``, so this really is 40 levels to walk.
-        ("<p>" * 40, 40),
-        # Nothing nests below a void or self-closed element, but the element
-        # itself is still a node one level below its parent.
-        ("<p>" + "<br>" * 40 + "x</p>", 2),
-        ("<br>" * 40, 1),
-        ("<p>a</p>" + "<div/>" * 40, 1),
-        # A close with nothing open, and a close for a void element, are
-        # ignored rather than pushed below zero.
-        ("</div>" * 40 + "<p>x</p>", 1),
-        ("<div><b>x</b></br></div>", 2),
-        # An unrecognised name is a node like any other to the parser.
-        ("<foo>" * 12, 12),
-        # Siblings are not depth.
-        ("<p>a</p>" * 40, 1),
-    ],
-)
-def test_the_depth_scan_measures_what_the_parser_will_build(
-    html: str, expected: int
-) -> None:
-    """The flat scan agrees with the tree ``html.parser`` produces."""
-
-    assert _html_nesting_depth(html) == expected
-
-
-def test_the_depth_scan_does_not_itself_recurse() -> None:
-    """Measuring 100k levels must not need 100k frames.
-
-    The whole point of the scan is to decide whether a recursive parser is
-    safe to run, so it cannot be recursive itself.
-    """
-
-    assert _html_nesting_depth("<div>" * 100_000) == 100_000
-
-
 @pytest.mark.parametrize(
     "html",
     [
@@ -274,9 +261,9 @@ def test_deep_html_degrades_instead_of_raising(html: str) -> None:
     """Past the ceiling the caller gets a usable body, not an exception.
 
     494 levels was enough to exhaust the default 1000-frame limit from a
-    shallow stack. Every shape here is past ``MAX_HTML_DEPTH``, including
-    the unclosed and unknown-element ones -- both of which the parser nests
-    just as deeply as the balanced case.
+    shallow stack. Every shape here is past it, including the unclosed and
+    unknown-element ones -- both of which the parser nests just as deeply
+    as the balanced case.
     """
 
     assert GlpiContentConverter.from_transport(html) == "text"
@@ -306,7 +293,7 @@ def test_the_degraded_path_resolves_entities_and_block_boundaries() -> None:
     words. Only the block boundary gets a separator.
     """
 
-    html = "<div>" * 300 + "<b>off</b>line &amp; <p>next</p>" + "</div>" * 300
+    html = "<div>" * 600 + "<b>off</b>line &amp; <p>next</p>" + "</div>" * 600
 
     assert GlpiContentConverter.from_transport(html) == "offline &\nnext"
 
@@ -343,7 +330,7 @@ def test_the_degraded_path_keeps_exactly_what_the_converter_keeps(
     """
 
     shallow = f"<p>a</p>{construct}<p>b</p>"
-    deep = "<div>" * 300 + shallow + "</div>" * 300
+    deep = "<div>" * 600 + shallow + "</div>" * 600
 
     converted = GlpiContentConverter.from_transport(shallow)
     degraded = GlpiContentConverter.from_transport(deep)
@@ -370,14 +357,18 @@ def test_an_unterminated_raw_text_element_reads_the_same_on_both_paths() -> None
     assert "keep" in GlpiContentConverter.from_transport("<p>keep</p><script>SECRET")
 
 
-def test_a_document_at_the_ceiling_is_still_converted() -> None:
-    """The ceiling is inclusive, and below it nothing changes.
+@pytest.mark.parametrize("depth", [1, 100, 200, 250, 300])
+def test_a_document_the_stack_can_hold_is_converted_in_full(depth: int) -> None:
+    """Everything that fits must convert, and structure has to survive.
 
-    Pinned because an off-by-one here silently downgrades ordinary content
-    to stripped text -- a quality regression with no error to notice.
+    This is what attempting the conversion bought. The previous design
+    predicted the depth and degraded past a fixed 200, which flattened
+    every body between 200 and the real cliff of about 494 -- ordinary
+    quoted mail threads among them -- to text, with no error to notice
+    and no way for a caller to ask for better. The 300 and 400 cases here
+    are the ones that used to come back as prose.
     """
 
-    depth = MAX_HTML_DEPTH - 1  # the <strong> below is the last level
     html = "<div>" * depth + "<strong>offline</strong>" + "</div>" * depth
 
     assert GlpiContentConverter.from_transport(html) == "**offline**"
@@ -405,16 +396,19 @@ def test_a_parser_fault_surfaces_as_a_glpi_error(
 ) -> None:
     """No parser fault escapes ``except GlpiError``.
 
-    The depth guard means no ordinary input reaches this, so the fault is
-    injected. It matters anyway: the frame budget is whatever the caller
-    left behind, so a shallow-enough document can still run out of stack in
-    a deep-enough application -- and a caller who wrote ``except GlpiError``
-    around ``get_ticket`` would have watched a ``RecursionError`` sail
-    straight through it.
+    Nothing ordinary reaches this, so the fault is injected. It matters
+    anyway: a caller who wrote ``except GlpiError`` around ``get_ticket``
+    would otherwise watch a bare parser exception sail straight through
+    it.
+
+    A ``RecursionError`` is deliberately *not* the fault used here. It is
+    no longer a failure at all -- it is how the converter learns that the
+    document does not fit, and it is answered with the body's text; see
+    the test below.
     """
 
     def _boom(*args: object, **kwargs: object) -> str:
-        raise RecursionError("maximum recursion depth exceeded")
+        raise ValueError("the parser fell over")
 
     monkeypatch.setattr(conversion, "html_to_markdown", _boom)
 
@@ -422,7 +416,29 @@ def _boom(*args: object, **kwargs: object) -> str:
         GlpiContentConverter.from_transport("<p>offline</p>")
 
     assert isinstance(caught.value, GlpiError)
-    assert isinstance(caught.value.__cause__, RecursionError)
+    assert isinstance(caught.value.__cause__, ValueError)
+
+
+def test_a_recursion_error_degrades_rather_than_raising(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """Running out of stack is answered, not reported.
+
+    Injected rather than provoked, because the depth needed to provoke it
+    depends on the stack the test runner has already spent -- which is the
+    very reason the depth is no longer predicted. What is pinned is the
+    contract: the caller gets their words, not an exception.
+    """
+
+    def _boom(*args: object, **kwargs: object) -> str:
+        raise RecursionError("maximum recursion depth exceeded")
+
+    monkeypatch.setattr(conversion, "html_to_markdown", _boom)
+
+    assert (
+        GlpiContentConverter.from_transport("<p>Le serveur ne repond plus.</p>")
+        == "Le serveur ne repond plus."
+    )
 
 
 def test_an_outbound_render_fault_surfaces_as_a_glpi_error(
@@ -490,39 +506,6 @@ def _parser_depth(html: str) -> int:
     return deepest
 
 
-@pytest.mark.parametrize(
-    "html",
-    [
-        pytest.param("<div></p>" * 600 + "kept", id="stray-close-p"),
-        pytest.param("<div></span>" * 600 + "kept", id="stray-close-span"),
-        pytest.param("<p></b>" * 600 + "kept", id="stray-close-b"),
-        pytest.param("<b><i>x</b></i>", id="interleaved"),
-        pytest.param("<div>" * 400 + "<br>" + "</div>" * 400, id="void-leaf"),
-        pytest.param("<div>" * 400 + "<img/>" + "</div>" * 400, id="self-closed-leaf"),
-        pytest.param("<br>" * 5000, id="void-only"),
-        pytest.param("<div><b>x</b></br></div>", id="close-of-a-void"),
-        pytest.param("<p>The printer is <strong>offline</strong>.</p>", id="realistic"),
-        pytest.param("<div><!-- <div><div> --><p>x</p></div>", id="tags-in-a-comment"),
-        pytest.param(
-            "<div><script>var s='<div><div>'</script>x</div>", id="tags-in-js"
-        ),
-        pytest.param("<table><tr><td>" * 60 + "x", id="tables"),
-        pytest.param("<blockquote>" * 300 + "x", id="blockquotes"),
-        pytest.param("<p>a</p>" * 100, id="siblings"),
-    ],
-)
-def test_the_depth_scan_agrees_with_the_parser(html: str) -> None:
-    """The flat scan returns what a real parse would nest to.
-
-    Equality, not an upper bound: over-counting is survivable but it
-    degrades documents that did not need degrading, so it is worth pinning
-    too. The cases where the scan is deliberately allowed to over-count are
-    covered separately.
-    """
-
-    assert _html_nesting_depth(html) == _parser_depth(html)
-
-
 @pytest.mark.parametrize(
     "html",
     [
@@ -552,47 +535,11 @@ def test_the_degraded_path_keeps_a_cdata_body() -> None:
     whole promise is that nothing is deleted.
     """
 
-    html = "<div>" * 300 + "<p>a<![CDATA[secret words]]>b</p>" + "</div>" * 300
+    html = "<div>" * 600 + "<p>a<![CDATA[secret words]]>b</p>" + "</div>" * 600
 
     assert GlpiContentConverter.from_transport(html) == "asecret wordsb"
 
 
-@pytest.mark.parametrize(
-    "html",
-    [
-        # A comment with no ``-->`` is a *bogus comment*: the parser gives up
-        # at the first ``>``, so the ``</custom>`` inside it is text and the
-        # ``<br>`` lands inside ``<custom>``. Read that ``</custom>`` as a
-        # real close and the count comes back one level short -- which is
-        # how a document that needed degrading reached the converter.
-        pytest.param("<custom><!--oops</custom><br>", id="bogus-comment-eats-a-close"),
-        # ... and recovery ends at that ``>``. It does not swallow the rest
-        # of the document, so these really are two levels.
-        pytest.param("<!--oops><div><div>", id="bogus-comment-ends-at-its-close"),
-        # A processing instruction ends at the first ``>`` too, and here
-        # that lands inside what looks like a comment -- so the second
-        # ``<div>`` is a real element. Stripping comments globally before
-        # scanning gets this wrong in both directions at once.
-        pytest.param("<?php x<!-- <div><div> -->", id="pi-overlapping-a-comment"),
-        pytest.param("<div><!-- <div><div> --></div>", id="terminated-comment"),
-        pytest.param("<!DOCTYPE html><div><p>x</p></div>", id="doctype"),
-        pytest.param("<div><![CDATA[a<div>b]]><p>x</p></div>", id="marked-section"),
-        pytest.param("<div><script>a<div><div></script><p>x</p></div>", id="raw-text"),
-        pytest.param("<div><script>a<div>", id="unclosed-raw-text"),
-    ],
-)
-def test_the_depth_scan_dispatches_like_the_parser(html: str) -> None:
-    """Comments, declarations and raw text change where the tags are.
-
-    Each of these was measured against a real parse. They are in the suite
-    because they are the cases where reading the constructs in the wrong
-    order, or independently of one another, changes the answer -- and one
-    direction of wrong is a ``RecursionError``.
-    """
-
-    assert _html_nesting_depth(html) == _parser_depth(html)
-
-
 def test_the_degraded_path_keeps_the_text_of_a_broken_comment() -> None:
     """Parity with the normal path, even where the parser gave up.
 
@@ -612,7 +559,7 @@ def test_the_degraded_path_drops_a_comment_the_parser_understood() -> None:
     rule: telling them apart is the whole job of the ``-->``.
     """
 
-    html = "<div>" * 300 + "<p>keep</p><!-- drop this -->" + "</div>" * 300
+    html = "<div>" * 600 + "<p>keep</p><!-- drop this -->" + "</div>" * 600
 
     assert GlpiContentConverter.from_transport(html) == "keep"
 
@@ -630,8 +577,7 @@ def test_no_name_in_the_void_set_actually_nests() -> None:
     understated = [
         name
         for name in sorted(conversion._VOID_ELEMENTS)
-        if _html_nesting_depth(f"<{name}>" * 300 + "x")
-        < _parser_depth(f"<{name}>" * 300 + "x")
+        if _parser_depth(f"<{name}>" * 300 + "x") > 1
     ]
 
     assert understated == []
@@ -651,14 +597,14 @@ def test_no_name_in_the_void_set_actually_nests() -> None:
 def test_a_tag_inside_a_quoted_attribute_is_not_read_as_markup(html: str) -> None:
     """An attribute value may legally contain ``<`` and ``>``.
 
-    Reading a quoted ``</div>`` as a real close tag under-counted without
-    bound: ``'<div title="</div>">' * 600`` measured **0** levels when the
-    parser builds 600, so the document sailed past the ceiling into
-    ``markdownify`` and raised. This is the regression test for that, and
-    it is the one class of error the ceiling exists to prevent.
+    Reading a quoted ``</div>`` as a real close tag lost the text after
+    it, and used to under-count the nesting without bound as well, back
+    when the nesting was predicted. What has to hold either way is that
+    the shape costs the body nothing: it converts, and if it is too deep
+    to convert it still says the same thing.
     """
 
-    assert _html_nesting_depth(html) == _parser_depth(html)
+    assert_the_degraded_path_says_no_less(html)
 
 
 def test_a_quoted_close_tag_at_depth_still_degrades() -> None:
@@ -698,52 +644,11 @@ def test_the_degraded_path_resolves_references_like_the_parser(
     changes meaning according to how deeply it nests.
     """
 
-    html = "<div>" * 300 + f"<p>{raw}</p>" + "</div>" * 300
+    html = "<div>" * 600 + f"<p>{raw}</p>" + "</div>" * 600
 
     assert GlpiContentConverter.from_transport(html) == expected
 
 
-@pytest.mark.parametrize(
-    "html",
-    [
-        pytest.param("<p title=don't>x</p>", id="apostrophe-in-bare-value"),
-        pytest.param('<p title=say"hi>x</p>', id="quote-in-bare-value"),
-        pytest.param("<p alt=P<0.05>x</p>", id="lt-in-bare-value"),
-        pytest.param("<p title=Etape 1>x</p>", id="space-in-bare-value"),
-        pytest.param("<style=>x", id="malformed-style-name"),
-        pytest.param("<script=>x", id="malformed-script-name"),
-        pytest.param("<div=x>y", id="malformed-name"),
-        pytest.param('<div"a">y', id="quote-in-name"),
-        pytest.param("<scripty>x</scripty>", id="raw-name-is-a-prefix"),
-        pytest.param("<script/>x", id="self-closed-script"),
-        pytest.param("<style />x", id="self-closed-style"),
-        pytest.param('<li y=">mot<script data-x="</div>">tail', id="lt-after-value"),
-        pytest.param("<div a=1 <p>text", id="tag-inside-a-tag"),
-        pytest.param("<div class=a<b>text", id="lt-in-unquoted-value"),
-    ],
-)
-def test_the_depth_scan_reads_a_malformed_tag_like_the_parser(html: str) -> None:
-    """Malformed markup is the common case, and its rules are the parser's.
-
-    Every expectation here was read off ``html.parser`` rather than
-    reasoned about, and each rule below was wrong in an earlier revision:
-
-    * A quote opens a value only as the first character after the ``=``,
-      so ``title=don't`` is the value ``don't`` and an unquoted value may
-      hold ``<`` too.
-    * ``tagfind_tolerant`` runs the *name* to whitespace, ``/`` or ``>``,
-      so ``<style=>`` is an element named ``style=`` -- which is why it
-      never enters raw-text mode, however much it looks like ``<style>``.
-    * A self-closed ``<script/>`` does not enter raw-text mode either:
-      ``parse_starttag`` calls ``set_cdata_mode`` only on the branch that
-      is not self-closing.
-    * An attribute name may contain ``<``, so after a quoted value the
-      parser keeps scanning to the next ``>``.
-    """
-
-    assert _html_nesting_depth(html) == _parser_depth(html)
-
-
 @pytest.mark.parametrize(
     "prefix",
     [
@@ -755,20 +660,19 @@ def test_the_depth_scan_reads_a_malformed_tag_like_the_parser(html: str) -> None
         pytest.param("<p alt=P<0.05>", id="lt-in-bare-value"),
     ],
 )
-def test_a_malformed_tag_cannot_hide_the_depth_below_it(prefix: str) -> None:
-    """One malformed tag must not conceal a whole document's nesting.
-
-    The dangerous direction is under-counting, and each of these
-    under-counted without bound: read as raw text, ``"<style=>"`` and
-    ``"<script/>"`` swallowed everything after them, so
-    ``"<style=>" + "<div>" * 600`` measured **1** level against a real
-    601, went to ``markdownify`` and raised the ``RecursionError`` the
-    ceiling exists to prevent.
+def test_a_malformed_tag_does_not_swallow_the_body_after_it(prefix: str) -> None:
+    """One malformed tag must not take the rest of the document with it.
+
+    Read as raw text, ``"<style=>"`` and ``"<script/>"`` swallowed
+    everything after them. That showed up first as an unbounded depth
+    under-count -- ``"<style=>" + "<div>" * 600`` measured **1** level
+    against a real 601 and reached ``markdownify`` -- but the deletion was
+    always the real damage, and it is what this pins now that the depth is
+    no longer predicted.
     """
 
     html = prefix + "<div>" * 600 + "the printer is offline"
 
-    assert _html_nesting_depth(html) == _parser_depth(html)
     assert GlpiContentConverter.from_transport(html) == "the printer is offline"
 
 
@@ -781,7 +685,7 @@ def test_the_degraded_path_does_not_emit_a_tag_it_could_not_read() -> None:
     French, so this needs no malice to reach a ticket.
     """
 
-    html = "<div>" * 300 + "<p title=don't>Le serveur ne repond plus.</p>"
+    html = "<div>" * 600 + "<p title=don't>Le serveur ne repond plus.</p>"
 
     degraded = GlpiContentConverter.from_transport(html)
 
@@ -910,7 +814,7 @@ def test_both_paths_agree_on_a_body_using_both_spellings() -> None:
     """
 
     shallow = "<p>one<br>two<br />three</p>"
-    deep = "<div>" * 300 + shallow + "</div>" * 300
+    deep = "<div>" * 600 + shallow + "</div>" * 600
 
     converted = GlpiContentConverter.from_transport(shallow)
     degraded = GlpiContentConverter.from_transport(deep)
@@ -920,56 +824,6 @@ def test_both_paths_agree_on_a_body_using_both_spellings() -> None:
         assert word in degraded
 
 
-@pytest.mark.parametrize(
-    ("html", "reason"),
-    [
-        pytest.param(
-            '</x a="><div>">',
-            "an end tag skips nothing, so the <div> after it is real",
-            id="end-tag-with-a-quoted-attribute",
-        ),
-        pytest.param(
-            '<div ="<p><p>">',
-            "a name-less = starts an attribute NAME, not a quoted value",
-            id="name-less-equals-quote",
-        ),
-        pytest.param(
-            '<div a ="x>y">',
-            "whitespace before = still leaves a quoted value",
-            id="space-before-equals",
-        ),
-        pytest.param(
-            "</ p>x",
-            "the strict end-tag pattern allows space after </",
-            id="space-in-end-tag",
-        ),
-        pytest.param("</p/>x", "a trailing slash on an end tag", id="slash-in-end-tag"),
-        pytest.param(
-            '<li y=">mot<script data-x="</div>">tail',
-            "< inside a tag",
-            id="lt-after-a-value",
-        ),
-    ],
-)
-def test_the_depth_scan_reads_tag_ends_like_the_parser(html: str, reason: str) -> None:
-    """Where a tag *ends* is decided by three different parser functions.
-
-    Each of these was read with start-tag rules until it was measured, and
-    two of them under-counted without bound:
-
-    * ``parse_endtag`` falls back to ``rawdata.find(">")``, so an end tag
-      skips nothing -- ``'</x a="><div>">' * 600`` measured **0** against a
-      real 600 and raised.
-    * ``locatestarttagend_tolerant`` reaches a quoted value only through an
-      attribute *name*, and a name may itself start with ``=`` -- so
-      ``'<div ="' + "<p>" * 600`` measured **1** against a real 600.
-
-    ``reason`` is carried only to say why each case is here.
-    """
-
-    assert _html_nesting_depth(html) == _parser_depth(html)
-
-
 @pytest.mark.parametrize(
     "fragment",
     [
@@ -978,16 +832,16 @@ def test_the_depth_scan_reads_tag_ends_like_the_parser(html: str, reason: str) -
         pytest.param('<p title="><span>">', id="quoted-gt-then-tag"),
     ],
 )
-def test_a_misread_tag_end_cannot_hide_the_depth_below_it(fragment: str) -> None:
-    """Scaled past the ceiling: degrades, and does not raise.
+def test_a_misread_tag_end_does_not_swallow_the_body_after_it(fragment: str) -> None:
+    """Scaled past the cliff: degrades quietly, and keeps its words.
 
-    The under-counts these come from were 1:1 with the repetition, so the
-    deficit grew without bound and the document cleared the ceiling.
+    Reading an end tag with start-tag rules consumed everything up to the
+    next quote, which deleted prose at any depth and under-counted the
+    nesting 1:1 with the repetition back when the nesting was predicted.
     """
 
     html = fragment * 600 + "the printer is offline"
 
-    assert _html_nesting_depth(html) >= _parser_depth(html)
     assert "the printer is offline" in GlpiContentConverter.from_transport(html)
 
 
@@ -1008,18 +862,18 @@ def test_a_misread_tag_end_does_not_delete_prose() -> None:
 def test_a_document_with_no_closing_bracket_is_answered_without_scanning() -> None:
     """No ``>`` means no element, and saying so keeps a bad shape cheap.
 
-    ``re`` restarts at every ``<`` where ``html.parser`` buffers an
-    incomplete tag and never looks back, so ``'<div a="' * n`` cost this
-    scan O(n**2) -- 32 KB in 6.6 s -- while the parser answers it in one
-    pass. The guard makes it constant time, and the text still survives,
-    because the parser flushes an unfinished tag as data when it closes.
+    ``html.parser`` cannot finish a tag that never closes, so ``close()``
+    flushes it one character at a time and rescans the tail at each step:
+    measured, 32 KB of ``'<div a="'`` costs it 13 seconds. Both readers
+    answer that shape directly instead. The text still survives, because
+    the parser flushes an unfinished tag as data when it closes.
     """
 
     html = '<div a="' * 4000
 
-    assert _html_nesting_depth(html) == 0
     assert GlpiContentConverter.from_transport(html).startswith('<div a="')
     assert "the printer" in GlpiContentConverter.from_transport(html + "the printer")
+    assert _strip_tags(html).startswith('<div a="')
 
 
 def test_a_document_the_parser_rejects_degrades_instead_of_raising() -> None:
@@ -1039,11 +893,10 @@ def test_a_document_the_parser_rejects_degrades_instead_of_raising() -> None:
 
     html = "<p>Le serveur ne repond plus. SECRET</p><![FOO[x]]>"
 
-    if _parser_rejects(html):
-        assert _html_nesting_depth(html) == MAX_HTML_DEPTH + 1
-    else:
-        assert _html_nesting_depth(html) <= MAX_HTML_DEPTH
     assert "SECRET" in GlpiContentConverter.from_transport(html)
+    if _parser_rejects(html):
+        # The converting path cannot run at all, so the answer is the text.
+        assert GlpiContentConverter.from_transport(html) == _strip_tags(html)
 
 
 def test_the_text_after_a_construct_the_parser_rejects_is_still_kept() -> None:
@@ -1077,3 +930,168 @@ def test_stripping_a_document_with_no_closing_bracket_keeps_all_of_it() -> None:
 
     assert _strip_tags(html).endswith("le serveur ne repond plus")
     assert _strip_tags(html).startswith('<div a="')
+
+
+@pytest.mark.parametrize(
+    "html",
+    [
+        # The repetition counts here are deliberately modest. They were
+        # large when this corpus guarded a depth *prediction*, where the
+        # error grew with the repetition; the shapes are what matter now,
+        # and each document has to be one the converting path can still
+        # walk on every supported interpreter for the comparison to mean
+        # anything.
+        pytest.param("<div></p>" * 60 + "kept", id="stray-close-p"),
+        pytest.param("<div></span>" * 60 + "kept", id="stray-close-span"),
+        pytest.param("<p></b>" * 60 + "kept", id="stray-close-b"),
+        pytest.param("<b><i>x</b></i>", id="interleaved"),
+        pytest.param("<div>" * 100 + "<br>" + "</div>" * 100, id="void-leaf"),
+        pytest.param("<div>" * 100 + "<img/>" + "</div>" * 100, id="self-closed-leaf"),
+        pytest.param("<br>" * 5000, id="void-only"),
+        pytest.param("<div><b>x</b></br></div>", id="close-of-a-void"),
+        pytest.param("<p>The printer is <strong>offline</strong>.</p>", id="realistic"),
+        pytest.param("<div><!-- <div><div> --><p>x</p></div>", id="tags-in-a-comment"),
+        pytest.param(
+            "<div><script>var s='<div><div>'</script>x</div>", id="tags-in-js"
+        ),
+        pytest.param("<table><tr><td>" * 30 + "x", id="tables"),
+        pytest.param("<blockquote>" * 100 + "x", id="blockquotes"),
+        pytest.param("<p>a</p>" * 100, id="siblings"),
+    ],
+)
+def test_both_paths_agree_about_what_is_markup(html: str) -> None:
+    """The two renderings of one body must not disagree about its markup.
+
+    This corpus was built against a flat scan that predicted the nesting
+    depth, and it caught the scan reading markup differently from the
+    parser -- a stray close popping an element the parser keeps, a void
+    element counted as a parent, a tag inside a comment or a script body
+    counted at all. The prediction is gone; the corpus is not, because
+    the same disagreements would now show up as the fallback deleting or
+    inventing text relative to the converting path.
+    """
+
+    assert_the_degraded_path_says_no_less(html)
+
+
+@pytest.mark.parametrize(
+    "html",
+    [
+        # A comment with no ``-->`` is a *bogus comment*: the parser gives up
+        # at the first ``>``, so the ``</custom>`` inside it is text and the
+        # ``<br>`` lands inside ``<custom>``. Read that ``</custom>`` as a
+        # real close and the count comes back one level short -- which is
+        # how a document that needed degrading reached the converter.
+        pytest.param("<custom><!--oops</custom><br>", id="bogus-comment-eats-a-close"),
+        # ... and recovery ends at that ``>``. It does not swallow the rest
+        # of the document, so these really are two levels.
+        pytest.param("<!--oops><div><div>", id="bogus-comment-ends-at-its-close"),
+        # A processing instruction ends at the first ``>`` too, and here
+        # that lands inside what looks like a comment -- so the second
+        # ``<div>`` is a real element. Stripping comments globally before
+        # scanning gets this wrong in both directions at once.
+        pytest.param("<?php x<!-- <div><div> -->", id="pi-overlapping-a-comment"),
+        pytest.param("<div><!-- <div><div> --></div>", id="terminated-comment"),
+        pytest.param("<!DOCTYPE html><div><p>x</p></div>", id="doctype"),
+        pytest.param("<div><![CDATA[a<div>b]]><p>x</p></div>", id="marked-section"),
+        pytest.param("<div><script>a<div><div></script><p>x</p></div>", id="raw-text"),
+        pytest.param("<div><script>a<div>", id="unclosed-raw-text"),
+    ],
+)
+def test_every_markup_construct_is_read_the_way_the_parser_reads_it(html: str) -> None:
+    """Construct by construct, and the order they are tried in matters.
+
+    The parser reads left to right and these constructs overlap: in
+    ``<?php x<!-- <div><div> -->`` the processing instruction ends at the
+    first ``>``, which lands inside what looks like a comment, so the
+    ``<div>`` after it is a real element. Handling any of them out of
+    order gets that document wrong in both directions at once.
+    """
+
+    assert_the_degraded_path_says_no_less(html)
+
+
+@pytest.mark.parametrize(
+    "html",
+    [
+        pytest.param("<p title=don't>x</p>", id="apostrophe-in-bare-value"),
+        pytest.param('<p title=say"hi>x</p>', id="quote-in-bare-value"),
+        pytest.param("<p alt=P<0.05>x</p>", id="lt-in-bare-value"),
+        pytest.param("<p title=Etape 1>x</p>", id="space-in-bare-value"),
+        pytest.param("<style=>x", id="malformed-style-name"),
+        pytest.param("<script=>x", id="malformed-script-name"),
+        pytest.param("<div=x>y", id="malformed-name"),
+        pytest.param('<div"a">y', id="quote-in-name"),
+        pytest.param("<scripty>x</scripty>", id="raw-name-is-a-prefix"),
+        pytest.param("<script/>x", id="self-closed-script"),
+        pytest.param("<style />x", id="self-closed-style"),
+        pytest.param('<li y=">mot<script data-x="</div>">tail', id="lt-after-value"),
+        pytest.param("<div a=1 <p>text", id="tag-inside-a-tag"),
+        pytest.param("<div class=a<b>text", id="lt-in-unquoted-value"),
+    ],
+)
+def test_a_malformed_tag_is_read_the_way_the_parser_reads_it(html: str) -> None:
+    """Malformed markup is where every rule taken from the spec was wrong.
+
+    Each shape here was read one way by the HTML5 grammar and another by
+    ``tagfind_tolerant`` and ``locatestarttagend_tolerant``, which are
+    what ``markdownify`` actually builds its tree with. The module reads
+    the parser's events now, so the corpus is a guard against a future
+    change reintroducing a rule from the wrong place.
+    """
+
+    assert_the_degraded_path_says_no_less(html)
+
+
+@pytest.mark.parametrize(
+    ("html", "reason"),
+    [
+        pytest.param(
+            '</x a="><div>">',
+            "an end tag skips nothing, so the <div> after it is real",
+            id="end-tag-with-a-quoted-attribute",
+        ),
+        pytest.param(
+            '<div ="<p><p>">',
+            "a name-less = starts an attribute NAME, not a quoted value",
+            id="name-less-equals-quote",
+        ),
+        pytest.param(
+            '<div a ="x>y">',
+            "whitespace before = still leaves a quoted value",
+            id="space-before-equals",
+        ),
+        pytest.param(
+            "</ p>x",
+            "the strict end-tag pattern allows space after </",
+            id="space-in-end-tag",
+        ),
+        pytest.param("</p/>x", "a trailing slash on an end tag", id="slash-in-end-tag"),
+        pytest.param(
+            '<li y=">mot<script data-x="</div>">tail',
+            "< inside a tag",
+            id="lt-after-a-value",
+        ),
+    ],
+)
+def test_a_tag_end_is_read_the_way_the_parser_reads_it(html: str, reason: str) -> None:
+    """``parse_endtag`` falls back to ``rawdata.find(">")`` and skips nothing.
+
+    CPython's own comment concedes the consequence -- "this is not 100%
+    correct, since we might have things like ``</tag attr=">">``" -- so
+    an end tag read with attribute rules consumes prose the parser keeps.
+    """
+
+    assert_the_degraded_path_says_no_less(html)
+
+
+def test_the_fallback_does_not_itself_recurse() -> None:
+    """Stripping 100k levels must not need 100k frames.
+
+    The fallback exists because the converting path ran out of stack, so
+    it cannot want a stack of its own. ``html.parser`` is an iterative
+    scanner and this walks its events into a list, which is what makes it
+    an answer for input of any depth rather than a second thing to guard.
+    """
+
+    assert _strip_tags("<div>" * 100_000 + "le serveur") == "le serveur"
diff --git a/glpi_python_client/models/api_schema/_content.py b/glpi_python_client/models/api_schema/_content.py
index 80154a7..13fd521 100644
--- a/glpi_python_client/models/api_schema/_content.py
+++ b/glpi_python_client/models/api_schema/_content.py
@@ -137,12 +137,12 @@ def markdown_view(raw: str | None) -> str | None:
     Raises
     ------
     GlpiContentError
-        The value could not be converted. Content nested past
-        :data:`glpi_python_client.content.conversion.MAX_HTML_DEPTH` is
-        degraded to text instead, so this is a backstop rather than an
-        expected outcome -- but note that it surfaces from the attribute
-        read, not from ``model_validate``, which is the deliberate
-        difference from the write-model path.
+        The value could not be converted. Content too deeply nested
+        for the converter to walk is degraded to text instead of
+        raising, so this is a backstop rather than an expected outcome
+        -- but note that it surfaces from the attribute read, not from
+        ``model_validate``, which is the deliberate difference from the
+        write-model path.
     """
 
     if raw is None:
diff --git a/glpi_python_client/models/custom_schema/_ticket_context.py b/glpi_python_client/models/custom_schema/_ticket_context.py
index 23e8974..d645f4f 100644
--- a/glpi_python_client/models/custom_schema/_ticket_context.py
+++ b/glpi_python_client/models/custom_schema/_ticket_context.py
@@ -246,9 +246,8 @@ def to_markdown(
             This is where the read models' HTML-to-Markdown conversion
             actually happens -- they hold the wire value and convert on
             first read, and this method is normally the first reader.
-            Content nested past
-            :data:`glpi_python_client.content.conversion.MAX_HTML_DEPTH`
-            is degraded to plain text rather than raising, so this is a
+            Content too deeply nested for the converter to walk is
+            degraded to plain text rather than raising, so this is a
             backstop rather than an expected outcome.
         """
 
diff --git a/glpi_python_client/testing/tests/test_raise_site_audit.py b/glpi_python_client/testing/tests/test_raise_site_audit.py
index b0523c1..6f9e96f 100644
--- a/glpi_python_client/testing/tests/test_raise_site_audit.py
+++ b/glpi_python_client/testing/tests/test_raise_site_audit.py
@@ -163,9 +163,10 @@ def test_the_library_never_touches_the_recursion_limit() -> None:
       access violation with no traceback. It moves the cliff and makes
       falling off it worse.
 
-    Bounding the input instead is
-    :data:`glpi_python_client.content.conversion.MAX_HTML_DEPTH`, and the
-    backstop for anything that gets past it is
+    Answering the ``RecursionError`` instead of preventing it is what
+    :meth:`glpi_python_client.content.conversion.GlpiContentConverter.from_transport`
+    does -- it attempts the conversion and degrades the body to its text
+    if the walk does not fit -- and the backstop for anything else is
     :class:`glpi_python_client.GlpiContentError`.
 
     Matched on the AST rather than the text, so that the module docstrings
diff --git a/skills/glpi-knowledge-base/SKILL.md b/skills/glpi-knowledge-base/SKILL.md
index 402caf7..146d747 100644
--- a/skills/glpi-knowledge-base/SKILL.md
+++ b/skills/glpi-knowledge-base/SKILL.md
@@ -165,7 +165,7 @@ await client.delete_kb_article(42, force=True)
 - KB write models use `IdNameRef` for every foreign key -- `categories[]`, `entity`, `user`, `parent` -- not `IdRef`. Passing `IdRef(id=4)` raises a pydantic `ValidationError`. (`GetKBArticleComment.parent` is the one KB field genuinely typed `IdRef`, and it is read-only.)
 - Article `content`/`description` and revision `content` are Markdown on the Python side and HTML on the wire; the conversion is automatic, so never author HTML. Comment `comment` is a plain `str` with no conversion at all -- the inconsistency is real, not an omission here.
 - On the **read** models the conversion is lazy. `GetKBArticle` stores `content_html`/`description_html` (the server's HTML verbatim, also accepting the wire spellings `content`/`description` on construction) and exposes `content`/`description` as cached properties that convert on first read; `GetKBArticleRevision` is the same with `content_html`. Reading `.content` is unchanged, but `search_kb_articles` and `list_kb_article_revisions` now convert nothing until a body is read -- which matters most here, because article search returns whole bodies and revision history returns every past one. Write models (`PostKBArticle`/`PatchKBArticle`) still convert eagerly and keep the plain `content`/`description` field names.
-- HTML nested past `MAX_HTML_DEPTH` (200) is **stripped to text instead of converted** -- every character the normal rendering would have produced, none of the Markdown structure, and no exception. Any other conversion failure raises `GlpiContentError`, from the `.content` read rather than from the search call.
+- HTML too deeply nested for the converter to walk is **stripped to text instead of converted** -- every character the normal rendering would have produced, none of the Markdown structure, and no exception. The conversion is attempted rather than the depth predicted, so the limit is whatever stack is left at the call site (about 494 levels from a shallow one). Any other conversion failure raises `GlpiContentError`, from the `.content` read rather than from the search call.
 - `force` on `delete_kb_article`, `delete_kb_category` and `delete_kb_article_comment` is keyword-only and is serialised into the JSON request **body** via the matching `Delete*` model, not sent as a query parameter. `force=True` deletes permanently; omitting it or passing `False` moves the record to the GLPI trash.
 - Revisions are read-only: there is no create/update/delete helper and no Post/Patch/Delete revision model. A revision appears as a side effect of updating an article. `get_kb_article_revision(article_id, revision)` takes the revision **number** (`GetKBArticleRevision.revision`), not the row `id` -- the two differ on the model.
 - `GetKBArticle.revisions` and `.translations` hold two *different* private ref classes (leading underscore, not exported from the package root). Read their attributes; never import them. The two field sets are not interchangeable: a `revisions` entry has `.id`, `.revision`, `.language`, `.date`, while a `translations` entry has `.id`, `.language`, `.name`. `revisions[0].name` raises `AttributeError` -- the models allow unknown keys from the server, but that does not synthesise an attribute that was never sent.
diff --git a/skills/glpi-plugin-fields/SKILL.md b/skills/glpi-plugin-fields/SKILL.md
index fa42aa3..e979583 100644
--- a/skills/glpi-plugin-fields/SKILL.md
+++ b/skills/glpi-plugin-fields/SKILL.md
@@ -191,7 +191,7 @@ async def upsert_plugin_field_row(
 - A container that has never had a value saved for that ticket is **silently absent** from the `get_ticket_custom_fields` result -- you do not get `{"container": {}}`. Use `result.get(name, {})`, never `result[name]`. An empty overall dict is **ambiguous**: `get_ticket_custom_fields` builds its result by skipping every container with no persisted row, so `{}` comes back both when the instance declares no Ticket containers at all and when it declares several but this ticket has saved nothing in any of them. The return value cannot tell you which -- call `list_plugin_fields_containers(itemtype="Ticket")` if you need to know.
 - Both discovery listings fetch **one fixed page, `range=0-999`**, with no pagination and no server-side filtering. The `itemtype` and `container_id` narrowing happens client-side *after* that cap, so an instance with more than 1000 containers or field declarations silently loses the tail -- possibly including the container you are looking for.
 - Neither listing filters on `is_active`, so **disabled containers and disabled or read-only fields come back from discovery looking exactly like live ones**. `set_ticket_custom_fields` accepts a field whose `is_readonly` is `True`, because its guard only checks that the name is declared. Check `container.is_active`, `field.is_active` and `field.is_readonly` yourself.
-- Values are transmitted **verbatim -- there is no HTML/Markdown conversion on this path**, unlike ticket and KB article content. A `richtext` field takes raw HTML (`"<p>test</p>"`). Convert yourself if you want Markdown: `GlpiContentConverter` is not exported from the package root, import it from `glpi_python_client.content`. Calling it directly puts you on the same two rules the models get: HTML nested past `MAX_HTML_DEPTH` (200) comes back **tag-stripped rather than converted** (every character the normal rendering would have produced, none of the structure, no exception), and any other failure raises `GlpiContentError`.
+- Values are transmitted **verbatim -- there is no HTML/Markdown conversion on this path**, unlike ticket and KB article content. A `richtext` field takes raw HTML (`"<p>test</p>"`). Convert yourself if you want Markdown: `GlpiContentConverter` is not exported from the package root, import it from `glpi_python_client.content`. Calling it directly puts you on the same two rules the models get: HTML too deeply nested for the converter to walk comes back **tag-stripped rather than converted** (every character the normal rendering would have produced, none of the structure, no exception), and any other failure raises `GlpiContentError`.
 - The two convenience helpers are **Ticket-only** -- the itemtype is hardcoded. There is no `get_item_custom_fields` and no `set_item_custom_fields`. For Computer, Problem, Change and the rest, drive the generic row helpers.
 - Parameter-passing style is inconsistent across the family, and only one half of it is a rule. `list_item_plugin_field_rows(itemtype, items_id, container_name)` declares ordinary `POSITIONAL_OR_KEYWORD` parameters, so both `("Ticket", 1234, "extrainfo")` and `(itemtype="Ticket", items_id=1234, container_name="extrainfo")` are legal -- the examples above pass them positionally by choice, not by requirement. `create_item_plugin_field_row` and `update_item_plugin_field_row` are genuinely **keyword-only** (`*` in the signature): calling either writer positionally is a `TypeError`.
 - Error taxonomy on the write path: an unknown container name or an unknown field name raises `GlpiValidationError`; a container the server returned without an `id`, or a create whose v1 reply carries no numeric row id, raises `GlpiProtocolError`. Both inherit `ValueError`. A missing v1 session raises a plain `RuntimeError`, and a non-success v1 status raises `GlpiStatusError` (with `.status_code`, `.url` and `.response_text`).
diff --git a/skills/glpi-ticket-timeline/SKILL.md b/skills/glpi-ticket-timeline/SKILL.md
index 965a74a..7e70892 100644
--- a/skills/glpi-ticket-timeline/SKILL.md
+++ b/skills/glpi-ticket-timeline/SKILL.md
@@ -120,6 +120,6 @@ await client.update_ticket_timeline_document(
 - `create_*` methods return new identifiers as plain `int`. `update_*` and `delete_*`/`unlink_*` return `None`.
 - Three enums carry this family's value vocabularies, all exported from `glpi_python_client` and all subclasses of `GlpiEnum` (itself an `IntEnum`, so a member serialises as its number and compares equal to one): `GlpiTaskState` on `PostTicketTask.state`/`PatchTicketTask.state` (`INFORMATION = 0`, `TODO = 1`, `DONE = 2` -- note `INFORMATION` is `0`, so `if task.state:` is false for it; test against `None`), `GlpiSolutionStatus` on `PostSolution.status`/`PatchSolution.status` (`NONE = 1`, `WAITING = 2`, `ACCEPTED = 3`, `REFUSED = 4`), and `GlpiTimelinePosition` on `timeline_position` (`INVALID = -1`, `NONE = 0`, `LEFT = 1`, `RIGHT = 2`, `LEFT_BIG = 3`, `RIGHT_BIG = 4`), which the followup, task and document models carry -- the solution models do not have the field at all.
 - Timeline `content` fields are Markdown on the Python side, not HTML. `PostFollowup`/`PostTicketTask`/`PostSolution` render Markdown to GLPI's HTML on serialisation. On `GetFollowup`/`GetTicketTask`/`GetSolution` the field is `content_html` -- the server's HTML verbatim -- and `content` is a cached property that converts it on **first read**, not on validation (`GetFollowup(content="<p>Hello <strong>world</strong></p>").content == "Hello **world**"` still holds; the wire spelling `content` is accepted as a validation alias). So `record.content` is always Markdown, but `list_ticket_followups` converts nothing until you read a body, and a body that cannot be converted no longer breaks the whole list. Authoring raw HTML on a write model is not an error but is round-tripped through the Markdown converter and can be reshaped; write Markdown.
-- HTML nested past `MAX_HTML_DEPTH` (200) is **stripped to text instead of converted**: `markdownify` recurses per level and dies around 494. Every character the normal rendering would have produced still appears, but structure does not: link targets, image alt text and code fencing are gone. Nothing raises. Any other conversion failure raises `GlpiContentError` -- from the `.content` read, not from the `list_*` call. Note that `GlpiTicketContext.to_markdown()` is usually the first thing to read every body, so it is where such an error surfaces.
+- HTML too deeply nested to walk is **stripped to text instead of converted**: `markdownify` recurses per level and dies around 494 from a shallow stack. The conversion is attempted rather than the depth predicted, so the real limit is whatever stack is left at the call site. Every character the normal rendering would have produced still appears, but structure does not: link targets, image alt text and code fencing are gone. Nothing raises. Any other conversion failure raises `GlpiContentError` -- from the `.content` read, not from the `list_*` call. Note that `GlpiTicketContext.to_markdown()` is usually the first thing to read every body, so it is where such an error surfaces.
 - Extra server fields (e.g. plugin keys) flow into `record.extra_payload` rather than raising.
 - `delete_ticket_*` and `unlink_ticket_timeline_document` accept a keyword-only `force` parameter; pass `force=True` to permanently delete.
\ No newline at end of file
diff --git a/skills/glpi-ticket-workflow/SKILL.md b/skills/glpi-ticket-workflow/SKILL.md
index b0599d0..bb986b5 100644
--- a/skills/glpi-ticket-workflow/SKILL.md
+++ b/skills/glpi-ticket-workflow/SKILL.md
@@ -74,7 +74,7 @@ ticket = PostTicket(
 - **`search_tickets` and every other `search_*` raise `GlpiStatusError` on a 4xx.** This changed: they used to check the response status only when the caller passed a `failure_message`, which none of the seven `search_*` helpers does, so a GLPI error body was coerced to `[]` and a malformed RSQL filter, a 403, a missing route and a genuinely empty result set were indistinguishable. `_resource_list` now checks the status on every call, so **an empty list means the server said the result set is empty**. The iterators inherit that: a 4xx raises instead of making the first page short and ending the walk silently. Note the *other* fail-open path is unchanged and still bites -- GLPI v2 ignores a filter field it does not recognise and answers 200 with the whole unfiltered table, so a filter that returns rows is still not proof it was applied.
 - `create_ticket` returns the new ticket ID. `update_ticket` and `delete_ticket` return `None`.
 - **`GetTicket` has no `content` field; it has `content_html` and a `content` property.** `content_html` holds the server's HTML verbatim (and accepts the wire spelling `content` on construction); `content` is a cached property that converts it to Markdown on **first read**, not on validation. Reading `ticket.content` is unchanged and still gives Markdown, so read-side code needs no edit — but `search_tickets` now converts nothing until a body is read, and a body that cannot be converted no longer breaks the rest of the page. Two things do change if you were relying on them: `"content" not in GetTicket.model_fields`, and `GetTicket(...).model_dump()` emits `content_html` with HTML where it used to emit `content` with Markdown (`by_alias=True` gives you the GLPI key). `PostTicket`/`PatchTicket` are untouched: plain `content` field, converted eagerly.
-- HTML nested past `MAX_HTML_DEPTH` (200, in `glpi_python_client.content.conversion`) is **stripped to text rather than converted** — `markdownify` recurses about twice per nesting level and dies around 494. It degrades rather than truncating — every character the normal rendering would have produced still appears — but structure does not survive: link targets, image alt text, code fencing and `<pre>` indentation are gone. Anything else that goes wrong converting a body raises `GlpiContentError`, from the attribute read rather than from `get_ticket`. Treat a fetched ticket as immutable afterwards: the conversion is cached, so assigning to `content_html` (or `model_copy(update={"content_html": ...})`) leaves stale Markdown on `.content` with nothing in `repr`, `==` or `model_dump` to show it.
+- HTML too deeply nested to walk is **stripped to text rather than converted** — `markdownify` recurses about twice per nesting level and dies around 494 from a shallow stack. The converter attempts the conversion and answers the `RecursionError` rather than predicting the depth, so the real limit is whatever stack is left at the call site, and the same body can convert from one and degrade from a deeper one. It degrades rather than truncating — every character the normal rendering would have produced still appears — but structure does not survive: link targets, image alt text, code fencing and `<pre>` indentation are gone. Anything else that goes wrong converting a body raises `GlpiContentError`, from the attribute read rather than from `get_ticket`. Treat a fetched ticket as immutable afterwards: the conversion is cached, so assigning to `content_html` (or `model_copy(update={"content_html": ...})`) leaves stale Markdown on `.content` with nothing in `repr`, `==` or `model_dump` to show it.
 - The GLPI server is the authoritative validator. Extra keys returned by the server flow into `ticket.extra_payload` rather than raising. Caller-provided `extra_payload` keys win on conflicts.
 - **`status` is writable, on `PatchTicket` only.** `client.update_ticket(tid, PatchTicket(status=GlpiTicketStatus.PENDING))` moves the ticket. This corrects an earlier claim in this skill that the field was read-only: GLPI's own contract publishes `Ticket.status.id` as `readOnly: true`, and that is simply wrong — a live GLPI 11 instance honours the `PATCH`. The same contract omits the `Major` level from `priority`, so treat it as a hint, not an authority. Two things it does *not* cover: `POST` **ignores** `status` (201, then the ticket reads back as `New`), which is why the field is declared on `PatchTicket` and not on `PostTicket`; and `status_id` is silently dropped, so use `status`. Posting a solution still moves the ticket to `SOLVED` on its own and remains the better call when there is a resolution to record — a bare status change leaves no trace of why.
 - **Key on `status.id`, never on `status.name`.** The id set is hardcoded in GLPI's core — there is no `TicketStatus` itemtype (the v1 API answers 400 for it, while `ITILCategory` and `RequestType` return instance rows), and `listSearchOptions` reports `status` as `{"table": "glpi_tickets", "datatype": "specific"}`, i.e. a column of the tickets table rather than a foreign key into a configurable one. An administrator cannot add or rename a status. The **labels** are another matter: they are translations, so the same id reads back as `"Nouveau"` on a French instance and `"New"` on an English one. The ids `7`, `8`, `9`, `11`–`14` exist but belong to the sibling ITIL types, and they are literal integers in GLPI's source: `CommonITILObject` declares `INCOMING = 1` through `OBSERVED = 8` plus `APPROVAL = 10`, and `Change` adds `EVALUATION = 9`, `TEST = 11`, `QUALIFICATION = 12`, `REFUSED = 13`, `CANCELED = 14`. Each type's `getAllStatusArray()` is a hardcoded PHP array mapping those constants to *translated* labels — no database, no config table. The set is therefore coupled to the GLPI *version*, not to the instance.

From 3e906d388eb3366125561cf1da5aecc05c9b1521 Mon Sep 17 00:00:00 2001
From: baraline <antoine.guillaume45@gmail.com>
Date: Wed, 9 Sep 2026 09:41:15 +0200
Subject: [PATCH 14/14] remove probe scripts

---
 .gitignore                                    |   5 +
 .../probe_status_is_configurable.py           | 284 --------------
 integration_tests/probe_ticket_status.py      | 366 ------------------
 integration_tests/probe_ticket_status_99.py   | 178 ---------
 .../probe_ticket_status_scope.py              | 333 ----------------
 integration_tests/probe_wire_format.py        | 332 ----------------
 6 files changed, 5 insertions(+), 1493 deletions(-)
 delete mode 100644 integration_tests/probe_status_is_configurable.py
 delete mode 100644 integration_tests/probe_ticket_status.py
 delete mode 100644 integration_tests/probe_ticket_status_99.py
 delete mode 100644 integration_tests/probe_ticket_status_scope.py
 delete mode 100644 integration_tests/probe_wire_format.py

diff --git a/.gitignore b/.gitignore
index faab1cb..cb85322 100644
--- a/.gitignore
+++ b/.gitignore
@@ -37,3 +37,8 @@ docs/glpi_api_contract.json
 # Coverage data: rewritten by every test run (and by the venv .pth hook).
 .coverage
 .coverage.*
+
+# One-shot live-instance probe scripts. They are standalone investigations
+# (a main() run by hand against preprod), not collected tests -- the findings
+# get written up in CHANGELOG.md, the scripts stay local.
+integration_tests/probe_*.py
diff --git a/integration_tests/probe_status_is_configurable.py b/integration_tests/probe_status_is_configurable.py
deleted file mode 100644
index aa52c18..0000000
--- a/integration_tests/probe_status_is_configurable.py
+++ /dev/null
@@ -1,284 +0,0 @@
-"""Determine whether ticket statuses are instance data or hardcoded values.
-
-``PatchTicket.status`` is typed as a closed enum. That is only defensible
-if the id set cannot be extended or renamed by a GLPI administrator: a
-per-instance vocabulary would make the enum reject values a real server
-legitimately holds -- the failure mode ``GlpiPriority`` already carries,
-where the contract's missing ``Major`` level took down whole searches.
-
-Three independent read-only checks, because no single one is conclusive:
-
-1. **Is there a dropdown itemtype behind it?** GLPI's configurable
-   vocabularies are ordinary itemtypes -- ``ITILCategory``,
-   ``RequestType``, ``SolutionType`` -- each with a CRUD route on the v1
-   API and a management screen behind it. If ``status`` were one, a
-   comparable itemtype would answer. Several plausible names are tried
-   against v1, with two known-configurable ones as positive controls: a
-   probe where *everything* 404s proves nothing.
-
-2. **How does GLPI describe the field to itself?** ``listSearchOptions``
-   reports each field's storage. A foreign key into a dropdown table
-   shows that table; a hardcoded column shows ``glpi_tickets`` with a
-   ``specific``-style datatype and no linked table.
-
-3. **What does the v2 contract publish?** A configurable vocabulary
-   cannot be published as a fixed ``enum`` with fixed labels, because the
-   document is generated per instance. Whether the labels are localised
-   or stored is visible in the same place.
-
-Nothing is created, modified or deleted.
-
-Usage
------
-    python integration_tests/probe_status_is_configurable.py
-"""
-
-from __future__ import annotations
-
-import json
-import os
-import socket
-import sys
-from pathlib import Path
-from typing import Any
-from urllib.parse import urlparse
-
-import httpx
-
-_REPO_ROOT = Path(__file__).resolve().parents[1]
-_SECRETS_DIR = _REPO_ROOT / "secrets"
-
-#: Itemtypes probed on the v1 API, and what each answer would mean.
-#:
-#: The first two are *positive controls*: both are configurable GLPI
-#: vocabularies with an admin screen, so both must answer. If they do not,
-#: the account lacks the rights and the whole probe is uninformative rather
-#: than negative. The rest are the names a ticket-status dropdown would
-#: plausibly carry if one existed.
-_ITEMTYPES = (
-    ("ITILCategory", "control -- known configurable"),
-    ("RequestType", "control -- known configurable"),
-    ("TicketStatus", "would be the dropdown if statuses were data"),
-    ("ITILStatus", "ditto, alternative naming"),
-    ("Status", "ditto, generic naming"),
-)
-
-
-def _read_value(secret_name: str, env_name: str) -> str | None:
-    """Return the secret file's contents, or the environment fallback."""
-
-    path = _SECRETS_DIR / secret_name
-    if path.exists():
-        value = path.read_text(encoding="utf-8").strip()
-        if value:
-            return value
-    env_value = os.environ.get(env_name)
-    return env_value.strip() if env_value else None
-
-
-def _load() -> dict[str, str | None]:
-    """Resolve the live configuration or exit with what is missing."""
-
-    required = {
-        "api_url": ("glpi_api_url", "GLPI_API_URL"),
-        "client_id": ("glpi_client_id_test", "GLPI_CLIENT_ID"),
-        "client_secret": ("glpi_client_secret_test", "GLPI_CLIENT_SECRET"),
-        "username": ("glpi_username", "GLPI_USERNAME"),
-        "password": ("glpi_password", "GLPI_PASSWORD"),
-    }
-    optional = {
-        "v1_url": ("glpi_api_v1_url", "GLPI_API_V1_URL"),
-        "v1_user_token": ("glpi_api_v1_token_user", "GLPI_V1_USER_TOKEN"),
-        "v1_app_token": ("glpi_api_v1_app_token", "GLPI_V1_APP_TOKEN"),
-    }
-    config: dict[str, str | None] = {}
-    missing: list[str] = []
-    for key, (secret, env) in required.items():
-        value = _read_value(secret, env)
-        if value is None:
-            missing.append(secret)
-        else:
-            config[key] = value
-    if missing:
-        sys.exit("missing credentials: " + ", ".join(missing))
-    for key, (secret, env) in optional.items():
-        config[key] = _read_value(secret, env)
-    return config
-
-
-def _check_reachable(api_url: str) -> None:
-    """Exit with a diagnosis when the API host does not resolve."""
-
-    host = urlparse(api_url).hostname
-    if not host:
-        sys.exit(f"glpi_api_url is not a URL: {api_url!r}")
-    try:
-        socket.getaddrinfo(host, None)
-    except socket.gaierror:
-        sys.exit(f"cannot resolve {host} -- connect to the corporate VPN.")
-
-
-def _token(client: httpx.Client, config: dict[str, str | None]) -> str:
-    """Obtain a v2 access token with the password grant."""
-
-    response = client.post(
-        f"{str(config['api_url']).rstrip('/')}/token",
-        data={
-            "grant_type": "password",
-            "client_id": config["client_id"],
-            "client_secret": config["client_secret"],
-            "username": config["username"],
-            "password": config["password"],
-            "scope": "api",
-        },
-        timeout=30,
-    )
-    response.raise_for_status()
-    return str(response.json()["access_token"])
-
-
-def _v1_session(
-    client: httpx.Client, config: dict[str, str | None]
-) -> dict[str, str] | None:
-    """Open a legacy v1 session and return its headers, or ``None``."""
-
-    v1_url = config.get("v1_url")
-    user_token = config.get("v1_user_token")
-    if not v1_url or not user_token:
-        return None
-    headers = {"Authorization": f"user_token {user_token}"}
-    app_token = config.get("v1_app_token")
-    if app_token:
-        headers["App-Token"] = str(app_token)
-    init = client.get(
-        f"{str(v1_url).rstrip('/')}/initSession", headers=headers, timeout=30
-    )
-    if init.status_code >= 400:
-        print(f"  v1 initSession -> HTTP {init.status_code} {init.text[:200]!r}")
-        return None
-    session_headers = {"Session-Token": str(init.json().get("session_token"))}
-    if app_token:
-        session_headers["App-Token"] = str(app_token)
-    return session_headers
-
-
-def _probe_itemtypes(client: httpx.Client, v1: str, headers: dict[str, str]) -> None:
-    """Ask v1 for each candidate dropdown itemtype and report the answer."""
-
-    for itemtype, note in _ITEMTYPES:
-        response = client.get(
-            f"{v1}/{itemtype}", headers=headers, params={"range": "0-2"}, timeout=30
-        )
-        exists = response.status_code < 400
-        rows = ""
-        if exists:
-            try:
-                payload = response.json()
-            except ValueError:
-                payload = None
-            if isinstance(payload, list):
-                names = [r.get("name") for r in payload if isinstance(r, dict)][:3]
-                rows = f"  first rows: {names}"
-        verdict = "EXISTS" if exists else "absent"
-        print(f"  {itemtype:<16} HTTP {response.status_code}  {verdict:<7} ({note})")
-        if rows:
-            print(f"      {rows.strip()}")
-
-
-def _probe_search_options(
-    client: httpx.Client, v1: str, headers: dict[str, str]
-) -> None:
-    """Print how GLPI describes the ticket ``status`` field's storage."""
-
-    response = client.get(f"{v1}/listSearchOptions/Ticket", headers=headers, timeout=30)
-    if response.status_code >= 400:
-        print(f"  listSearchOptions/Ticket -> HTTP {response.status_code}")
-        return
-    try:
-        options = response.json()
-    except ValueError:
-        print("  listSearchOptions/Ticket -> not JSON")
-        return
-    if not isinstance(options, dict):
-        print(f"  listSearchOptions/Ticket -> unexpected shape {type(options)}")
-        return
-    for key, option in options.items():
-        if not isinstance(option, dict):
-            continue
-        if option.get("field") != "status":
-            continue
-        print(f"  option {key}: {json.dumps(option, ensure_ascii=False)}")
-
-
-def _probe_contract(client: httpx.Client, base: str, headers: dict[str, str]) -> None:
-    """Print each ITIL type's published ``status`` enum.
-
-    ``Problem`` and ``Change`` are included because the earlier value-range
-    probe found that ``7``, ``8`` and ``9`` are *stored* on a ticket even
-    though the ticket enum stops at ``6`` (plus ``10``). If those ids turn
-    up as legitimate statuses of the sibling ITIL types, then they are
-    core constants of the shared parent class rather than room left for
-    instance-defined values -- which is the difference between "the set is
-    extensible" and "the column is unvalidated".
-    """
-
-    response = client.get(f"{base}/doc.json", headers=headers, timeout=60)
-    if response.status_code >= 400:
-        print(f"  {base}/doc.json -> HTTP {response.status_code}")
-        return
-    try:
-        document: Any = response.json()
-    except ValueError:
-        print("  doc.json -> not JSON")
-        return
-    schemas = document.get("components", {}).get("schemas", {})
-    for name in ("Ticket", "Problem", "Change"):
-        status = schemas.get(name, {}).get("properties", {}).get("status")
-        if status is None:
-            print(f"  {name}.status -> <no such schema>")
-            continue
-        ident = status.get("properties", {}).get("id", status)
-        print(f"  {name}.status ids -> {ident.get('enum')}")
-        description = (ident.get("description") or "").strip()
-        for line in description.splitlines():
-            print(f"      {line}")
-
-
-def main() -> None:
-    """Run the three checks and print a report."""
-
-    config = _load()
-    base = str(config["api_url"]).rstrip("/")
-    _check_reachable(base)
-
-    with httpx.Client(verify=False, follow_redirects=True, timeout=60) as client:
-        token = _token(client, config)
-        read_headers = {"Authorization": f"Bearer {token}"}
-
-        print("=" * 72)
-        print("CHECK 1 -- is there a dropdown itemtype behind ticket status?")
-        print("=" * 72)
-        v1_headers = _v1_session(client, config)
-        if v1_headers is None:
-            print("  v1 session unavailable -- skipped")
-        else:
-            v1 = str(config["v1_url"]).rstrip("/")
-            try:
-                _probe_itemtypes(client, v1, v1_headers)
-                print()
-                print("=" * 72)
-                print("CHECK 2 -- how does GLPI describe the field's storage?")
-                print("=" * 72)
-                _probe_search_options(client, v1, v1_headers)
-            finally:
-                client.get(f"{v1}/killSession", headers=v1_headers, timeout=30)
-        print()
-
-        print("=" * 72)
-        print("CHECK 3 -- what does the v2 contract publish?")
-        print("=" * 72)
-        _probe_contract(client, base, read_headers)
-
-
-if __name__ == "__main__":
-    main()
diff --git a/integration_tests/probe_ticket_status.py b/integration_tests/probe_ticket_status.py
deleted file mode 100644
index f5e2646..0000000
--- a/integration_tests/probe_ticket_status.py
+++ /dev/null
@@ -1,366 +0,0 @@
-"""Record whether GLPI 11 accepts a ticket *status* write, and on which route.
-
-The package excludes ``status`` from ``PostTicket``/``PatchTicket`` on the
-stated grounds that "GLPI manages the ticket lifecycle through dedicated
-timeline routes". Nothing in the repository records a measurement behind
-that claim, and the v2 API is fail-open: it answers 200 to fields it does
-not recognise, so "the PATCH succeeded" proves nothing on its own. Every
-case below therefore *reads the ticket back* and compares.
-
-Cases, each on a distinct target status so one cannot be mistaken for
-another's leftover:
-
-* control    -- PATCH a field that certainly does not exist. If this is a
-                200, then a 200 on ``status`` means nothing by itself.
-* v2 object  -- ``{"status": {"id": 4}}``   (PENDING) -- the read shape.
-* v2 int     -- ``{"status": 3}``           (PLANNED) -- the v1 shape.
-* v2 id      -- ``{"status_id": 2}``        (ASSIGNED) -- GLPI's other idiom.
-* v1 PUT     -- ``{"input": {"status": 6}}`` (CLOSED) -- the legacy route,
-                the same escape hatch ``set_kb_article_categories`` uses.
-
-Read-mostly: one ticket is created and force-deleted in a ``finally``.
-
-Usage
------
-    python probe_ticket_status.py
-
-Credentials load exactly as the integration suite loads them: from the
-repository's ``secrets/`` files, falling back to ``GLPI_*`` env vars.
-"""
-
-from __future__ import annotations
-
-import json
-import os
-import socket
-import sys
-from pathlib import Path
-from typing import Any
-from urllib.parse import urlparse
-
-import httpx
-
-_REPO_ROOT = Path(__file__).resolve().parents[1]
-_SECRETS_DIR = _REPO_ROOT / "secrets"
-
-_STATUS_NAMES = {
-    1: "NEW",
-    2: "ASSIGNED",
-    3: "PLANNED",
-    4: "PENDING",
-    5: "SOLVED",
-    6: "CLOSED",
-    10: "VALIDATION",
-}
-
-
-def _read_value(secret_name: str, env_name: str) -> str | None:
-    """Return the secret file's contents, or the environment fallback."""
-
-    path = _SECRETS_DIR / secret_name
-    if path.exists():
-        value = path.read_text(encoding="utf-8").strip()
-        if value:
-            return value
-    env_value = os.environ.get(env_name)
-    return env_value.strip() if env_value else None
-
-
-def _load() -> dict[str, str | None]:
-    """Resolve the live configuration or exit with what is missing."""
-
-    required = {
-        "api_url": ("glpi_api_url", "GLPI_API_URL"),
-        "client_id": ("glpi_client_id_test", "GLPI_CLIENT_ID"),
-        "client_secret": ("glpi_client_secret_test", "GLPI_CLIENT_SECRET"),
-        "username": ("glpi_username", "GLPI_USERNAME"),
-        "password": ("glpi_password", "GLPI_PASSWORD"),
-    }
-    optional = {
-        "v1_url": ("glpi_api_v1_url", "GLPI_API_V1_URL"),
-        "v1_user_token": ("glpi_api_v1_token_user", "GLPI_V1_USER_TOKEN"),
-        "v1_app_token": ("glpi_api_v1_app_token", "GLPI_V1_APP_TOKEN"),
-    }
-    config: dict[str, str | None] = {}
-    missing: list[str] = []
-    for key, (secret, env) in required.items():
-        value = _read_value(secret, env)
-        if value is None:
-            missing.append(secret)
-        else:
-            config[key] = value
-    if missing:
-        sys.exit("missing credentials: " + ", ".join(missing))
-    for key, (secret, env) in optional.items():
-        config[key] = _read_value(secret, env)
-    return config
-
-
-def _check_reachable(api_url: str) -> None:
-    """Exit with a diagnosis when the API host does not resolve."""
-
-    host = urlparse(api_url).hostname
-    if not host:
-        sys.exit(f"glpi_api_url is not a URL: {api_url!r}")
-    try:
-        socket.getaddrinfo(host, None)
-    except socket.gaierror:
-        try:
-            socket.getaddrinfo("github.com", None)
-        except socket.gaierror:
-            sys.exit(f"cannot resolve {host} -- and public DNS is down too.")
-        sys.exit(
-            f"cannot resolve {host}.\n"
-            "Public DNS works, so this is internal name resolution: connect "
-            "to the corporate VPN and run this again."
-        )
-
-
-def _token(client: httpx.Client, config: dict[str, str | None]) -> str:
-    """Obtain a v2 access token with the password grant."""
-
-    response = client.post(
-        f"{str(config['api_url']).rstrip('/')}/token",
-        data={
-            "grant_type": "password",
-            "client_id": config["client_id"],
-            "client_secret": config["client_secret"],
-            "username": config["username"],
-            "password": config["password"],
-            "scope": "api",
-        },
-        timeout=30,
-    )
-    response.raise_for_status()
-    return str(response.json()["access_token"])
-
-
-def _read_status(
-    client: httpx.Client, base: str, headers: dict[str, str], ticket_id: int
-) -> Any:
-    """Return the ticket's ``status`` as GLPI v2 currently reports it."""
-
-    response = client.get(
-        f"{base}/Assistance/Ticket/{ticket_id}", headers=headers, timeout=30
-    )
-    if response.status_code >= 400:
-        return f"<read failed HTTP {response.status_code}>"
-    return response.json().get("status")
-
-
-def _describe(status: Any) -> str:
-    """Render a status value with its enum name when one can be read off."""
-
-    ident = status.get("id") if isinstance(status, dict) else status
-    if isinstance(ident, int) and ident in _STATUS_NAMES:
-        return f"{status!r}  ({_STATUS_NAMES[ident]})"
-    return f"{status!r}"
-
-
-def _probe_v2_case(
-    client: httpx.Client,
-    base: str,
-    read_headers: dict[str, str],
-    write_headers: dict[str, str],
-    ticket_id: int,
-    label: str,
-    body: dict[str, Any],
-    expected: int | None,
-) -> None:
-    """PATCH one body shape on the v2 route, then read the ticket back."""
-
-    before = _read_status(client, base, read_headers, ticket_id)
-    patch = client.request(
-        "PATCH",
-        f"{base}/Assistance/Ticket/{ticket_id}",
-        headers=write_headers,
-        json=body,
-        timeout=30,
-    )
-    after = _read_status(client, base, read_headers, ticket_id)
-    print(f"  {label}")
-    print(f"      body        -> {json.dumps(body, ensure_ascii=False)}")
-    print(f"      PATCH       -> HTTP {patch.status_code}")
-    if patch.status_code >= 400:
-        print(f"      error body  -> {patch.text[:300]!r}")
-    print(f"      status before -> {_describe(before)}")
-    print(f"      status after  -> {_describe(after)}")
-    if expected is None:
-        print(
-            "      VERDICT     -> "
-            + (
-                "v2 REJECTS an unknown field (a 200 on status would be meaningful)"
-                if patch.status_code >= 400
-                else "v2 ACCEPTS an unknown field with a 200 -- a 200 alone "
-                "proves NOTHING; only the read-back counts"
-            )
-        )
-    else:
-        ident = after.get("id") if isinstance(after, dict) else after
-        applied = ident == expected
-        print(
-            "      VERDICT     -> "
-            + (
-                f"APPLIED (status is now {expected})"
-                if applied
-                else f"NOT APPLIED (wanted {expected}, still {ident!r})"
-            )
-        )
-    print()
-
-
-def _probe_v1(
-    client: httpx.Client,
-    base: str,
-    read_headers: dict[str, str],
-    config: dict[str, str | None],
-    ticket_id: int,
-    target: int,
-) -> None:
-    """Init a legacy v1 session, PUT the status, read back through v2."""
-
-    v1_url = config.get("v1_url")
-    user_token = config.get("v1_user_token")
-    if not v1_url or not user_token:
-        print("  v1 PUT: SKIPPED -- glpi_api_v1_url / glpi_api_v1_token_user absent")
-        return
-    v1 = str(v1_url).rstrip("/")
-    init_headers = {"Authorization": f"user_token {user_token}"}
-    app_token = config.get("v1_app_token")
-    if app_token:
-        init_headers["App-Token"] = app_token
-
-    init = client.get(f"{v1}/initSession", headers=init_headers, timeout=30)
-    if init.status_code >= 400:
-        print(f"  v1 PUT: initSession -> HTTP {init.status_code} {init.text[:200]!r}")
-        return
-    session_token = init.json().get("session_token")
-    print(f"  v1 initSession -> HTTP {init.status_code}, token acquired")
-
-    v1_headers = {
-        "Session-Token": str(session_token),
-        "Content-Type": "application/json",
-    }
-    if app_token:
-        v1_headers["App-Token"] = str(app_token)
-
-    try:
-        before = _read_status(client, base, read_headers, ticket_id)
-        put = client.put(
-            f"{v1}/Ticket/{ticket_id}",
-            headers=v1_headers,
-            json={"input": {"id": ticket_id, "status": target}},
-            timeout=30,
-        )
-        after = _read_status(client, base, read_headers, ticket_id)
-        print(f"      PUT {v1}/Ticket/{ticket_id}")
-        print(f"      body        -> {{'input': {{'status': {target}}}}}")
-        print(f"      PUT         -> HTTP {put.status_code} {put.text[:200]!r}")
-        print(f"      status before -> {_describe(before)}")
-        print(f"      status after  -> {_describe(after)}")
-        ident = after.get("id") if isinstance(after, dict) else after
-        print(
-            "      VERDICT     -> "
-            + (
-                f"APPLIED (status is now {target})"
-                if ident == target
-                else f"NOT APPLIED (wanted {target}, still {ident!r})"
-            )
-        )
-    finally:
-        client.get(f"{v1}/killSession", headers=v1_headers, timeout=30)
-
-
-def main() -> None:
-    """Run the status-write probes and print a report."""
-
-    config = _load()
-    base = str(config["api_url"]).rstrip("/")
-    _check_reachable(base)
-
-    with httpx.Client(verify=False, follow_redirects=True, timeout=30) as client:
-        token = _token(client, config)
-        read_headers = {"Authorization": f"Bearer {token}"}
-        write_headers = {
-            "Authorization": f"Bearer {token}",
-            "Content-Type": "application/json",
-        }
-
-        created_id: int | None = None
-        try:
-            created = client.post(
-                f"{base}/Assistance/Ticket",
-                headers=write_headers,
-                json={
-                    "name": "py_glpi status-write probe (safe to delete)",
-                    "content": "<p>Automated probe. Deleted immediately.</p>",
-                },
-                timeout=30,
-            )
-            if created.status_code >= 400:
-                sys.exit(f"create failed: HTTP {created.status_code} {created.text}")
-            created_id = created.json().get("id")
-            if not created_id:
-                sys.exit(f"no id in create response: {created.text[:300]}")
-            print("=" * 72)
-            print(f"probe ticket #{created_id} created")
-            baseline = _read_status(client, base, read_headers, created_id)
-            print(f"  baseline status -> {_describe(baseline)}")
-            print("=" * 72)
-            print()
-
-            print("=" * 72)
-            print("CONTROL -- is a 200 on the v2 PATCH worth anything?")
-            print("=" * 72)
-            _probe_v2_case(
-                client,
-                base,
-                read_headers,
-                write_headers,
-                created_id,
-                "unknown field",
-                {"__probe_field_that_does_not_exist__": "x"},
-                None,
-            )
-
-            print("=" * 72)
-            print("v2 PATCH /Assistance/Ticket/{id} -- three body shapes")
-            print("=" * 72)
-            for label, body, expected in (
-                ("object shape {'status': {'id': 4}}", {"status": {"id": 4}}, 4),
-                ("int shape    {'status': 3}", {"status": 3}, 3),
-                ("id shape     {'status_id': 2}", {"status_id": 2}, 2),
-            ):
-                _probe_v2_case(
-                    client,
-                    base,
-                    read_headers,
-                    write_headers,
-                    created_id,
-                    label,
-                    body,
-                    expected,
-                )
-
-            print("=" * 72)
-            print("v1 PUT /Ticket/{id} -- the legacy escape hatch")
-            print("=" * 72)
-            _probe_v1(client, base, read_headers, config, created_id, 6)
-        finally:
-            if created_id:
-                cleanup = client.request(
-                    "DELETE",
-                    f"{base}/Assistance/Ticket/{created_id}",
-                    headers=write_headers,
-                    json={"force": True},
-                    timeout=30,
-                )
-                print()
-                print()
-                print(
-                    f"  cleanup: force-deleted #{created_id} -> {cleanup.status_code}"
-                )
-
-
-if __name__ == "__main__":
-    main()
diff --git a/integration_tests/probe_ticket_status_99.py b/integration_tests/probe_ticket_status_99.py
deleted file mode 100644
index 227cca8..0000000
--- a/integration_tests/probe_ticket_status_99.py
+++ /dev/null
@@ -1,178 +0,0 @@
-"""Leave one ticket parked on the out-of-range status 99, for UI inspection.
-
-``probe_ticket_status_scope.py`` established that GLPI 11 stores any integer
-written to ``status`` -- 0, 7, 8, 9 and 99 all returned 200 and read back as
-``{"id": 99, "name": "99"}``, the name falling back to the number because no
-label exists for it. What the API reports and what the *web interface* does
-with such a row are different questions, and the second one decides whether
-the write model should be strict: if the UI degrades gracefully, a
-permissive ``int`` costs little; if the ticket becomes unopenable or
-unfilterable, the library should refuse the value GLPI accepts.
-
-**This probe deliberately leaves its ticket behind.** Every other probe in
-this directory cleans up in a ``finally``; this one is meant to be looked at
-in the browser and deleted by hand afterwards. It prints the id and the
-front-end URL for that.
-
-Usage
------
-    python integration_tests/probe_ticket_status_99.py
-"""
-
-from __future__ import annotations
-
-import os
-import socket
-import sys
-from pathlib import Path
-from typing import Any
-from urllib.parse import urlparse
-
-import httpx
-
-_REPO_ROOT = Path(__file__).resolve().parents[1]
-_SECRETS_DIR = _REPO_ROOT / "secrets"
-
-#: The value to park the ticket on: far outside the contract enum
-#: ``[1, 10, 2, 3, 4, 5, 6]`` and outside GLPI's own core constants.
-_ROGUE_STATUS = 99
-
-
-def _read_value(secret_name: str, env_name: str) -> str | None:
-    """Return the secret file's contents, or the environment fallback."""
-
-    path = _SECRETS_DIR / secret_name
-    if path.exists():
-        value = path.read_text(encoding="utf-8").strip()
-        if value:
-            return value
-    env_value = os.environ.get(env_name)
-    return env_value.strip() if env_value else None
-
-
-def _load() -> dict[str, str]:
-    """Resolve the live configuration or exit with what is missing."""
-
-    wanted = {
-        "api_url": ("glpi_api_url", "GLPI_API_URL"),
-        "client_id": ("glpi_client_id_test", "GLPI_CLIENT_ID"),
-        "client_secret": ("glpi_client_secret_test", "GLPI_CLIENT_SECRET"),
-        "username": ("glpi_username", "GLPI_USERNAME"),
-        "password": ("glpi_password", "GLPI_PASSWORD"),
-    }
-    config: dict[str, str] = {}
-    missing: list[str] = []
-    for key, (secret, env) in wanted.items():
-        value = _read_value(secret, env)
-        if value is None:
-            missing.append(secret)
-        else:
-            config[key] = value
-    if missing:
-        sys.exit("missing credentials: " + ", ".join(missing))
-    return config
-
-
-def _check_reachable(api_url: str) -> None:
-    """Exit with a diagnosis when the API host does not resolve."""
-
-    host = urlparse(api_url).hostname
-    if not host:
-        sys.exit(f"glpi_api_url is not a URL: {api_url!r}")
-    try:
-        socket.getaddrinfo(host, None)
-    except socket.gaierror:
-        sys.exit(f"cannot resolve {host} -- connect to the corporate VPN.")
-
-
-def _token(client: httpx.Client, config: dict[str, str]) -> str:
-    """Obtain a v2 access token with the password grant."""
-
-    response = client.post(
-        f"{config['api_url'].rstrip('/')}/token",
-        data={
-            "grant_type": "password",
-            "client_id": config["client_id"],
-            "client_secret": config["client_secret"],
-            "username": config["username"],
-            "password": config["password"],
-            "scope": "api",
-        },
-        timeout=30,
-    )
-    response.raise_for_status()
-    return str(response.json()["access_token"])
-
-
-def _front_url(api_url: str) -> str:
-    """Derive the web front-end origin from the API base URL."""
-
-    parsed = urlparse(api_url)
-    return f"{parsed.scheme}://{parsed.netloc}"
-
-
-def main() -> None:
-    """Create one ticket, park it on status 99, and leave it there."""
-
-    config = _load()
-    base = config["api_url"].rstrip("/")
-    _check_reachable(base)
-
-    with httpx.Client(verify=False, follow_redirects=True, timeout=30) as client:
-        token = _token(client, config)
-        read_headers = {"Authorization": f"Bearer {token}"}
-        write_headers = {
-            "Authorization": f"Bearer {token}",
-            "Content-Type": "application/json",
-        }
-
-        created = client.post(
-            f"{base}/Assistance/Ticket",
-            headers=write_headers,
-            json={
-                "name": (
-                    f"py_glpi PROBE statut {_ROGUE_STATUS} "
-                    "-- a supprimer apres inspection"
-                ),
-                "content": (
-                    "<p>Ticket de sonde. Son statut a ete force a "
-                    f"{_ROGUE_STATUS}, une valeur hors de l'enum du contrat, "
-                    "pour observer ce que l'interface en fait. "
-                    "Supprimable sans risque.</p>"
-                ),
-            },
-            timeout=30,
-        )
-        if created.status_code >= 400:
-            sys.exit(f"create failed: HTTP {created.status_code} {created.text}")
-        ticket_id = created.json().get("id")
-        if not ticket_id:
-            sys.exit(f"no id in create response: {created.text[:300]}")
-
-        patch = client.request(
-            "PATCH",
-            f"{base}/Assistance/Ticket/{ticket_id}",
-            headers=write_headers,
-            json={"status": _ROGUE_STATUS},
-            timeout=30,
-        )
-        read = client.get(
-            f"{base}/Assistance/Ticket/{ticket_id}", headers=read_headers, timeout=30
-        )
-        status: Any = read.json().get("status") if read.status_code < 400 else None
-
-        front = _front_url(base)
-        print("=" * 72)
-        print(f"  ticket        : #{ticket_id}")
-        print(f"  PATCH status  : {_ROGUE_STATUS} -> HTTP {patch.status_code}")
-        print(f"  read back     : {status!r}")
-        print()
-        print(f"  interface     : {front}/front/ticket.form.php?id={ticket_id}")
-        print(f"  liste         : {front}/front/ticket.php")
-        print()
-        print("  NON SUPPRIME -- a supprimer a la main apres inspection.")
-        print("=" * 72)
-
-
-if __name__ == "__main__":
-    main()
diff --git a/integration_tests/probe_ticket_status_scope.py b/integration_tests/probe_ticket_status_scope.py
deleted file mode 100644
index 4656adf..0000000
--- a/integration_tests/probe_ticket_status_scope.py
+++ /dev/null
@@ -1,333 +0,0 @@
-"""Record whether GLPI honours ``status`` at create, and how closed the set is.
-
-Follow-up to :mod:`probe_ticket_status`, which established that the v2 PATCH
-does write ``status`` (contradicting the package's own docstring). Two
-questions remain before the field can be declared on the write models:
-
-**Does POST honour it?** ``PatchTicket`` inherits ``PostTicket``, so
-declaring the field once exposes it on both. The v2 API is fail-open --
-it answered 200 to a field that does not exist -- so a create that returns
-an id proves nothing. Only reading the new ticket back does.
-
-**Is the id set fixed, or per instance?** The contract advertises a closed
-enum ``[1, 10, 2, 3, 4, 5, 6]`` on ``Ticket.status.id``. If the server
-rejects a value outside it, the set is validated server-side and an enum is
-the right type. If it accepts one, the set is looser than the contract says
-and an enum would reject values a real instance can hold -- the failure
-mode ``GlpiPriority`` already documents, where a missing sixth level took
-down whole searches.
-
-Read-mostly: two tickets are created and force-deleted in a ``finally``.
-
-Usage
------
-    python integration_tests/probe_ticket_status_scope.py
-"""
-
-from __future__ import annotations
-
-import json
-import os
-import socket
-import sys
-from pathlib import Path
-from typing import Any
-from urllib.parse import urlparse
-
-import httpx
-
-_REPO_ROOT = Path(__file__).resolve().parents[1]
-_SECRETS_DIR = _REPO_ROOT / "secrets"
-
-_STATUS_NAMES = {
-    1: "NEW",
-    2: "ASSIGNED",
-    3: "PLANNED",
-    4: "PENDING",
-    5: "SOLVED",
-    6: "CLOSED",
-    10: "VALIDATION",
-}
-
-#: Values probed for acceptance, and why each one is interesting.
-#:
-#: ``7``/``8``/``9`` sit in the gap the contract leaves between ``6`` and
-#: ``10`` -- exactly where an instance-defined extra status would land if
-#: statuses were a dropdown table. ``99`` is far outside any plausible set,
-#: and ``0`` is below it. If the server rejects all of them the set is
-#: closed and validated; if it stores one, the contract enum is too narrow.
-_OUT_OF_CONTRACT = (7, 8, 9, 99, 0)
-
-
-def _read_value(secret_name: str, env_name: str) -> str | None:
-    """Return the secret file's contents, or the environment fallback."""
-
-    path = _SECRETS_DIR / secret_name
-    if path.exists():
-        value = path.read_text(encoding="utf-8").strip()
-        if value:
-            return value
-    env_value = os.environ.get(env_name)
-    return env_value.strip() if env_value else None
-
-
-def _load() -> dict[str, str]:
-    """Resolve the live configuration or exit with what is missing."""
-
-    wanted = {
-        "api_url": ("glpi_api_url", "GLPI_API_URL"),
-        "client_id": ("glpi_client_id_test", "GLPI_CLIENT_ID"),
-        "client_secret": ("glpi_client_secret_test", "GLPI_CLIENT_SECRET"),
-        "username": ("glpi_username", "GLPI_USERNAME"),
-        "password": ("glpi_password", "GLPI_PASSWORD"),
-    }
-    config: dict[str, str] = {}
-    missing: list[str] = []
-    for key, (secret, env) in wanted.items():
-        value = _read_value(secret, env)
-        if value is None:
-            missing.append(secret)
-        else:
-            config[key] = value
-    if missing:
-        sys.exit("missing credentials: " + ", ".join(missing))
-    return config
-
-
-def _check_reachable(api_url: str) -> None:
-    """Exit with a diagnosis when the API host does not resolve."""
-
-    host = urlparse(api_url).hostname
-    if not host:
-        sys.exit(f"glpi_api_url is not a URL: {api_url!r}")
-    try:
-        socket.getaddrinfo(host, None)
-    except socket.gaierror:
-        sys.exit(f"cannot resolve {host} -- connect to the corporate VPN.")
-
-
-def _token(client: httpx.Client, config: dict[str, str]) -> str:
-    """Obtain a v2 access token with the password grant."""
-
-    response = client.post(
-        f"{config['api_url'].rstrip('/')}/token",
-        data={
-            "grant_type": "password",
-            "client_id": config["client_id"],
-            "client_secret": config["client_secret"],
-            "username": config["username"],
-            "password": config["password"],
-            "scope": "api",
-        },
-        timeout=30,
-    )
-    response.raise_for_status()
-    return str(response.json()["access_token"])
-
-
-def _read_status(
-    client: httpx.Client, base: str, headers: dict[str, str], ticket_id: int
-) -> Any:
-    """Return the ticket's ``status`` as GLPI v2 currently reports it."""
-
-    response = client.get(
-        f"{base}/Assistance/Ticket/{ticket_id}", headers=headers, timeout=30
-    )
-    if response.status_code >= 400:
-        return f"<read failed HTTP {response.status_code}>"
-    return response.json().get("status")
-
-
-def _describe(status: Any) -> str:
-    """Render a status value with its enum name when one can be read off."""
-
-    ident = status.get("id") if isinstance(status, dict) else status
-    if isinstance(ident, int) and ident in _STATUS_NAMES:
-        return f"{status!r}  ({_STATUS_NAMES[ident]})"
-    return f"{status!r}"
-
-
-def _identifier(status: Any) -> Any:
-    """Return the numeric id out of either status spelling."""
-
-    return status.get("id") if isinstance(status, dict) else status
-
-
-def _create(
-    client: httpx.Client,
-    base: str,
-    write_headers: dict[str, str],
-    body: dict[str, Any],
-) -> tuple[int | None, httpx.Response]:
-    """Create one probe ticket and return its id alongside the response."""
-
-    payload = {
-        "name": "py_glpi status-scope probe (safe to delete)",
-        "content": "<p>Automated probe. Deleted immediately.</p>",
-        **body,
-    }
-    response = client.post(
-        f"{base}/Assistance/Ticket", headers=write_headers, json=payload, timeout=30
-    )
-    if response.status_code >= 400:
-        return None, response
-    try:
-        return response.json().get("id"), response
-    except ValueError:
-        return None, response
-
-
-def _probe_contract(client: httpx.Client, base: str, headers: dict[str, str]) -> None:
-    """Print what this instance publishes for ``Ticket.status`` if reachable.
-
-    The path the HL API serves its OpenAPI document on is not something the
-    package records, so several plausible ones are tried and the first that
-    answers with the ticket schema is reported. A miss is not a failure --
-    the behavioural probes below are the authority either way.
-    """
-
-    parent = base.rsplit("/", 1)[0]
-    for path in (
-        f"{base}/doc.json",
-        f"{base}/openapi.json",
-        f"{base}/swagger.json",
-        f"{base}/doc",
-        f"{parent}/doc.json",
-        f"{parent}/doc",
-    ):
-        try:
-            response = client.get(path, headers=headers, timeout=20)
-        except httpx.HTTPError as exc:
-            print(f"  {path} -> transport error {exc!r}")
-            continue
-        if response.status_code >= 400:
-            print(f"  {path} -> HTTP {response.status_code}")
-            continue
-        body = response.text
-        print(f"  {path} -> HTTP {response.status_code}, {len(body)} bytes")
-        try:
-            document = response.json()
-        except ValueError:
-            print("      (not JSON -- probably the doc UI)")
-            continue
-        schemas = (
-            document.get("components", {}).get("schemas", {})
-            if isinstance(document, dict)
-            else {}
-        )
-        for name, schema in schemas.items():
-            if "ticket" not in name.lower():
-                continue
-            status = schema.get("properties", {}).get("status")
-            if status:
-                rendered = json.dumps(status, ensure_ascii=False)
-                print(f"      {name}.status -> {rendered}")
-        return
-
-
-def main() -> None:
-    """Run the create-time and value-range probes and print a report."""
-
-    config = _load()
-    base = config["api_url"].rstrip("/")
-    _check_reachable(base)
-
-    with httpx.Client(verify=False, follow_redirects=True, timeout=30) as client:
-        token = _token(client, config)
-        read_headers = {"Authorization": f"Bearer {token}"}
-        write_headers = {
-            "Authorization": f"Bearer {token}",
-            "Content-Type": "application/json",
-        }
-
-        print("=" * 72)
-        print("PROBE 0 -- what does this instance publish for Ticket.status?")
-        print("=" * 72)
-        _probe_contract(client, base, read_headers)
-        print()
-
-        created: list[int] = []
-        try:
-            print("=" * 72)
-            print("PROBE 1 -- does POST honour `status` at create time?")
-            print("=" * 72)
-            for label, body in (
-                ("int shape    {'status': 4}", {"status": 4}),
-                ("object shape {'status': {'id': 4}}", {"status": {"id": 4}}),
-            ):
-                new_id, response = _create(client, base, write_headers, body)
-                print(f"  {label}")
-                print(f"      POST        -> HTTP {response.status_code}")
-                if new_id is None:
-                    print(f"      body        -> {response.text[:300]!r}")
-                    print("      VERDICT     -> create failed, nothing to read back")
-                    print()
-                    continue
-                created.append(new_id)
-                status = _read_status(client, base, read_headers, new_id)
-                print(f"      created     -> #{new_id}")
-                print(f"      status      -> {_describe(status)}")
-                print(
-                    "      VERDICT     -> "
-                    + (
-                        "HONOURED at create"
-                        if _identifier(status) == 4
-                        else "IGNORED at create (fell back to the default)"
-                    )
-                )
-                print()
-
-            print("=" * 72)
-            print("PROBE 2 -- is the id set closed, or looser than the contract?")
-            print("=" * 72)
-            if not created:
-                print("  no probe ticket available -- skipped")
-            else:
-                target = created[0]
-                print(
-                    f"  probing on #{target}; contract enum is [1, 2, 3, 4, 5, 6, 10]"
-                )
-                print()
-                for value in _OUT_OF_CONTRACT:
-                    before = _read_status(client, base, read_headers, target)
-                    patch = client.request(
-                        "PATCH",
-                        f"{base}/Assistance/Ticket/{target}",
-                        headers=write_headers,
-                        json={"status": value},
-                        timeout=30,
-                    )
-                    after = _read_status(client, base, read_headers, target)
-                    stored = _identifier(after) == value
-                    print(f"  status = {value}")
-                    print(f"      PATCH       -> HTTP {patch.status_code}")
-                    if patch.status_code >= 400:
-                        print(f"      error body  -> {patch.text[:200]!r}")
-                    print(
-                        f"      read back   -> {_describe(after)} "
-                        f"(was {_describe(before)})"
-                    )
-                    print(
-                        "      VERDICT     -> "
-                        + (
-                            f"STORED {value} -- the set is NOT closed; an enum "
-                            "would reject a value this instance can hold"
-                            if stored
-                            else "refused -- value not stored"
-                        )
-                    )
-                    print()
-        finally:
-            for ticket_id in created:
-                cleanup = client.request(
-                    "DELETE",
-                    f"{base}/Assistance/Ticket/{ticket_id}",
-                    headers=write_headers,
-                    json={"force": True},
-                    timeout=30,
-                )
-                print(f"  cleanup: force-deleted #{ticket_id} -> {cleanup.status_code}")
-
-
-if __name__ == "__main__":
-    main()
diff --git a/integration_tests/probe_wire_format.py b/integration_tests/probe_wire_format.py
deleted file mode 100644
index 401a972..0000000
--- a/integration_tests/probe_wire_format.py
+++ /dev/null
@@ -1,332 +0,0 @@
-"""Record what GLPI 11 actually puts on the wire, for two open decisions.
-
-Run this against preprod and paste the output into issues #31 and #35. It
-answers two questions the repository cannot answer from inside, and both
-decide whether a proposed change is worth building at all:
-
-**#31 -- do datetimes arrive naive?** The proposal to attach a server
-timezone assumes GLPI omits the UTC offset. Nothing here records a real v2
-response, and the project's own fixtures disagree: the knowledge base tests
-use ``+00:00`` (which already parses aware) while the timeline, management
-and administration tests use a bare ``2024-01-02T03:04:05``. If the live
-server sends an offset, #31 can be closed unbuilt.
-
-**#35 -- what does a POST return?** ``_resource_create`` parses the whole
-body and keeps one integer. If the body already carries the full record,
-the fix is to stop discarding it, not to add a second request behind a
-``create_*_and_fetch`` helper.
-
-**#22 follow-up -- does GLPI honour an offset on write?** The fix for #22
-changed outbound serialisation to Pydantic's JSON mode, so an aware
-``datetime`` now goes out as ``...+02:00`` or ``...Z``. Accepting it and
-honouring it are different questions, and only the second is dangerous to
-get wrong: a truncated offset moves the moment silently, with a 200.
-
-This is a **read-mostly** probe. It creates exactly one ticket -- reused by
-both write probes -- and deletes it again in a ``finally``. Nothing else is
-written.
-
-Usage
------
-    python integration_tests/probe_wire_format.py
-
-Credentials load the same way the integration suite loads them: from
-``secrets/`` files, falling back to ``GLPI_*`` environment variables.
-"""
-
-from __future__ import annotations
-
-import json
-import os
-import re
-import socket
-import sys
-from pathlib import Path
-from typing import Any
-from urllib.parse import urlparse
-
-import httpx
-
-_REPO_ROOT = Path(__file__).resolve().parents[1]
-_SECRETS_DIR = _REPO_ROOT / "secrets"
-
-#: Wire values that look like a timestamp, offset-bearing or not.
-_TIMESTAMP = re.compile(r"^\d{4}-\d{2}-\d{2}[ T]\d{2}:\d{2}:\d{2}")
-
-
-def _read_value(secret_name: str, env_name: str) -> str | None:
-    """Return the secret file's contents, or the environment fallback."""
-
-    path = _SECRETS_DIR / secret_name
-    if path.exists():
-        value = path.read_text(encoding="utf-8").strip()
-        if value:
-            return value
-    env_value = os.environ.get(env_name)
-    return env_value.strip() if env_value else None
-
-
-def _load() -> dict[str, str]:
-    """Resolve the live configuration or exit with what is missing."""
-
-    wanted = {
-        "api_url": ("glpi_api_url", "GLPI_API_URL"),
-        "client_id": ("glpi_client_id_test", "GLPI_CLIENT_ID"),
-        "client_secret": ("glpi_client_secret_test", "GLPI_CLIENT_SECRET"),
-        "username": ("glpi_username", "GLPI_USERNAME"),
-        "password": ("glpi_password", "GLPI_PASSWORD"),
-    }
-    config: dict[str, str] = {}
-    missing: list[str] = []
-    for key, (secret, env) in wanted.items():
-        value = _read_value(secret, env)
-        if value is None:
-            missing.append(secret)
-        else:
-            config[key] = value
-    if missing:
-        sys.exit("missing credentials: " + ", ".join(missing))
-    return config
-
-
-def _check_reachable(api_url: str) -> None:
-    """Exit with a diagnosis when the API host does not resolve.
-
-    The GLPI instance lives on an internal ``.local`` name, so running this
-    off the corporate VPN fails during DNS with a forty-line httpx traceback
-    ending in ``getaddrinfo failed`` -- which looks like a bug in the probe
-    rather than a missing network. Checking first turns that into one line.
-    """
-
-    host = urlparse(api_url).hostname
-    if not host:
-        sys.exit(f"glpi_api_url is not a URL: {api_url!r}")
-    try:
-        socket.getaddrinfo(host, None)
-    except socket.gaierror:
-        try:
-            socket.getaddrinfo("github.com", None)
-        except socket.gaierror:
-            sys.exit(f"cannot resolve {host} -- and public DNS is down too.")
-        sys.exit(
-            f"cannot resolve {host}.\n"
-            "Public DNS works, so this is name resolution for the internal "
-            "domain: connect to the corporate VPN and run this again.\n"
-            "(The integration suite cannot reach the instance either while "
-            "this fails.)"
-        )
-
-
-def _token(client: httpx.Client, config: dict[str, str]) -> str:
-    """Obtain an access token with the password grant."""
-
-    response = client.post(
-        f"{config['api_url'].rstrip('/')}/token",
-        data={
-            "grant_type": "password",
-            "client_id": config["client_id"],
-            "client_secret": config["client_secret"],
-            "username": config["username"],
-            "password": config["password"],
-            "scope": "api",
-        },
-        timeout=30,
-    )
-    response.raise_for_status()
-    return str(response.json()["access_token"])
-
-
-def _walk_timestamps(payload: Any, prefix: str = "") -> list[tuple[str, str]]:
-    """Return every ``(path, value)`` in ``payload`` that looks like a timestamp."""
-
-    found: list[tuple[str, str]] = []
-    if isinstance(payload, dict):
-        for key, value in payload.items():
-            found.extend(_walk_timestamps(value, f"{prefix}.{key}" if prefix else key))
-    elif isinstance(payload, list):
-        for index, value in enumerate(payload[:2]):
-            found.extend(_walk_timestamps(value, f"{prefix}[{index}]"))
-    elif isinstance(payload, str) and _TIMESTAMP.match(payload):
-        found.append((prefix, payload))
-    return found
-
-
-def _report_timestamps(label: str, payload: Any) -> None:
-    """Print every timestamp in one payload and whether it carries an offset."""
-
-    stamps = _walk_timestamps(payload)
-    if not stamps:
-        print(f"  {label}: no timestamp-shaped values found")
-        return
-    for path, value in stamps:
-        aware = bool(re.search(r"(Z|[+-]\d{2}:?\d{2})$", value))
-        verdict = "AWARE (carries an offset)" if aware else "NAIVE (no offset)"
-        print(f"  {label}.{path} = {value!r}  -> {verdict}")
-
-
-#: The three ways this package can now render one moment onto the wire.
-#:
-#: These are not hypothetical spellings -- they are the literal bytes
-#: ``model_to_payload`` produces for a ``PatchTicket(date=...)`` built with a
-#: UTC ``tzinfo``, a ``Europe/Paris`` one, and none at all. Pydantic's JSON
-#: mode writes UTC as ``Z`` and every other zone as a numeric offset.
-#:
-#: ``12:30Z`` is the discriminating case, because it is ``14:30`` in Paris:
-#: a server that honours the offset stores a different wall clock than one
-#: that ignores it, and one read-back separates them. The ``+02:00`` case
-#: cannot discriminate -- it names the same wall clock either way -- but it
-#: does answer whether an offset-bearing string is accepted at all.
-_WRITE_CASES = (
-    ("naive   (control)", "2026-08-01T12:30:00"),
-    ("UTC     (Z form) ", "2026-08-01T12:30:00Z"),
-    ("Paris   (+02:00) ", "2026-08-01T12:30:00+02:00"),
-    ("Tokyo   (+09:00) ", "2026-08-01T12:30:00+09:00"),
-    ("LA      (-08:00) ", "2026-08-01T12:30:00-08:00"),
-    ("Kiritim (+14:00) ", "2026-08-01T12:30:00+14:00"),
-    ("nonsense(+99:99) ", "2026-08-01T12:30:00+99:99"),
-)
-
-
-def _probe_write_offsets(
-    client: httpx.Client,
-    base: str,
-    read_headers: dict[str, str],
-    write_headers: dict[str, str],
-    ticket_id: int,
-) -> None:
-    """Write each spelling of one moment and report what GLPI stored.
-
-    Issue #22 changed outbound serialisation to Pydantic's JSON mode, so an
-    aware ``datetime`` now leaves as ``...+02:00`` or ``...Z`` where it
-    previously left as a live object that ``json.dumps`` refused. That fixed
-    the crash but moved the question rather than answering it: nothing here
-    had ever recorded whether GLPI *accepts* an offset, nor -- the part that
-    matters more -- whether it *honours* one.
-
-    A rejection is loud and harmless. Silent truncation is neither: writing
-    ``12:30Z`` and having 12:30 stored as Paris local time moves the moment
-    two hours with a 200 and no complaint.
-    """
-
-    for label, wire in _WRITE_CASES:
-        patch = client.request(
-            "PATCH",
-            f"{base}/Assistance/Ticket/{ticket_id}",
-            headers=write_headers,
-            json={"date": wire},
-        )
-        if patch.status_code >= 400:
-            print(f"  {label} {wire!r}")
-            print(f"      PATCH -> HTTP {patch.status_code} REJECTED")
-            print(f"      body  -> {patch.text[:200]!r}")
-            continue
-        read = client.get(f"{base}/Assistance/Ticket/{ticket_id}", headers=read_headers)
-        stored = read.json().get("date") if read.status_code < 400 else None
-        print(f"  {label} {wire!r}")
-        print(f"      PATCH -> HTTP {patch.status_code}   read back -> {stored!r}")
-
-
-def main() -> None:
-    """Run every probe and print a report to paste into the issues."""
-
-    config = _load()
-    base = config["api_url"].rstrip("/")
-    _check_reachable(base)
-
-    with httpx.Client(verify=False, follow_redirects=True, timeout=30) as client:
-        token = _token(client, config)
-        # A GET must NOT advertise a JSON content type. GLPI sees the header,
-        # tries to parse the (absent) body, and answers 400 "Contenu du JSON
-        # invalide" -- an error about the request body on a request that has
-        # none. The library avoids this with its `include_content_type` flag,
-        # which is False for GET; the two header sets here mirror that.
-        read_headers = {"Authorization": f"Bearer {token}"}
-        write_headers = {
-            "Authorization": f"Bearer {token}",
-            "Content-Type": "application/json",
-        }
-
-        print("=" * 72)
-        print("PROBE 1 (issue #31) -- datetime wire format")
-        print("=" * 72)
-        for label, path in (
-            ("Ticket", "/Assistance/Ticket?limit=1"),
-            ("User", "/Administration/User?limit=1"),
-            ("KBArticle", "/Knowledgebase/Article?limit=1"),
-        ):
-            response = client.get(f"{base}{path}", headers=read_headers)
-            if response.status_code >= 400:
-                print(f"  {label}: HTTP {response.status_code} -- skipped")
-                continue
-            _report_timestamps(label, response.json())
-
-        print()
-        print("=" * 72)
-        print("PROBE 2 (issue #35) -- what a create returns")
-        print("=" * 72)
-        created_id: int | None = None
-        try:
-            response = client.post(
-                f"{base}/Assistance/Ticket",
-                headers=write_headers,
-                json={
-                    "name": "py_glpi wire-format probe (safe to delete)",
-                    "content": "<p>Automated probe. Deleted immediately.</p>",
-                },
-            )
-            print(f"  status      : {response.status_code}")
-            print(f"  Location    : {response.headers.get('Location', '<absent>')}")
-            print(f"  body bytes  : {len(response.content)}")
-            try:
-                body = response.json()
-            except ValueError:
-                print(f"  body        : <not JSON> {response.text[:200]!r}")
-            else:
-                keys = sorted(body) if isinstance(body, dict) else "<not an object>"
-                print(f"  body keys   : {keys}")
-                print("  body        :")
-                print(json.dumps(body, indent=4, ensure_ascii=False)[:2000])
-                if isinstance(body, dict):
-                    created_id = body.get("id")
-                    print()
-                    print(
-                        "  VERDICT: "
-                        + (
-                            "id only -- a fetch is genuinely needed (#35)"
-                            if set(body) <= {"id", "href"}
-                            else f"{len(body)} fields returned -- the client is "
-                            "DISCARDING a fuller record; fix that instead of "
-                            "adding create_*_and_fetch (#35)"
-                        )
-                    )
-            if created_id:
-                print()
-                print("=" * 72)
-                print("PROBE 3 (#22 follow-up) -- does GLPI honour an offset on write?")
-                print("=" * 72)
-                _probe_write_offsets(
-                    client, base, read_headers, write_headers, created_id
-                )
-        finally:
-            if created_id:
-                # `client.delete(...)` rejects `json=` -- httpx exposes a body
-                # only on `request()`, because DELETE-with-a-body is unusual.
-                # GLPI needs one for `force`, so this must not be "simplified"
-                # back to the convenience method; the library's own
-                # `_delete_request` goes through `session.request` for the
-                # same reason.
-                cleanup = client.request(
-                    "DELETE",
-                    f"{base}/Assistance/Ticket/{created_id}",
-                    headers=write_headers,
-                    json={"force": True},
-                )
-                print()
-                print(f"  cleanup: deleted {created_id} -> {cleanup.status_code}")
-            else:
-                print()
-                print("  cleanup: nothing to delete (no id parsed from the response)")
-
-
-if __name__ == "__main__":
-    main()