diff --git a/g9-migration/journal.md b/g9-migration/journal.md
index 7ce6f9f..a3e590e 100644
--- a/g9-migration/journal.md
+++ b/g9-migration/journal.md
@@ -118,3 +118,7 @@
 | 2026-10-11 18:45 | J5040 (E4) | Caddy OVH déployé sur .27 : 7/7 certs Let's Encrypt émis (DNS-01) + proxy 6 briques | E4 : TLS auto achève T4.6/S9.1 | maxcryger/caddy-ovh digest 502996b5 healthy ; cloud 302/pass 200/git 200/media 302/photos 502 (stack en copie)/n8n 200/matrix 302, issuer = Let's Encrypt ; WAN (forward Freebox→G9) et démontage edge G9 = après bascule bridge E3 | docker compose down ; révoquer clé |
 | 2026-10-11 18:10 | 07d : copie parallèle 4 flux (tar par dossier racine) | mono-flux SSH plafonné ~13 Mo/s (lecture HDD NAS, CPU NAS 7% = non saturé) | 29 dirs, xargs -P4 ; + chmod u+rwX post-copie ; intégrité/stack/index = 07d SKIP_COPY=1 | rien (source .25 lecture seule) |
 | 2026-10-11 21:30 | 4 | décision chiffrement restic MAINTENU | Critère 3 : arbitrage chiffrement vs simplicité restore | Décision utilisateur : chiffrement restic conservé, clé de repo locale G9 (/etc/restic/repo.key 600, sauvegardée hors repo git), restore simple via sudo restic sur le G9 ; test restore photo prévu par scripts/10-verify-restore-photo.sh | révoquer/cloner la clé si changement de politique |
+| 2026-10-12 13:40 | 4 | migrate:photoprism : backup restic pré-migration | Garde-fou G2 avant import PhotoPrism | snapshot restic Freebox (log /var/log/restic-daily.log) | restic forget <snapshot> && restic prune |
+| 2026-10-12 14:06 | 4 | migrate:photoprism : intégration PhotoPrism | copie de 530 Go à vérifier avant indexation | manifeste chemins+tailles identique (433941 fichiers, 567394182751 o) + échantillon sha256 200/200 | re-copie ciblée via tar/ssh |
+| 2026-10-12 14:11 | 4 | migrate:photoprism : intégration PhotoPrism | copie de 530 Go à vérifier avant indexation | manifeste chemins+tailles identique (433941 fichiers, 567394182751 o) + échantillon sha256 200/200 | re-copie ciblée via tar/ssh |
+| 2026-10-12 14:17 | 4 | migrate:photoprism : intégration PhotoPrism | copie de 530 Go à vérifier avant indexation | manifeste chemins+tailles identique (433941 fichiers, 567394182751 o) + échantillon sha256 200/200 | re-copie ciblée via tar/ssh |
diff --git a/g9-migration/scripts/07d-migrate-photoprism.sh b/g9-migration/scripts/07d-migrate-photoprism.sh
index 1236d79..633bdf1 100755
--- a/g9-migration/scripts/07d-migrate-photoprism.sh
+++ b/g9-migration/scripts/07d-migrate-photoprism.sh
@@ -59,10 +59,11 @@ log "source .25 : $SRC_COUNT fichiers, $SRC_BYTES octets"
 
 # ---------------------------------------------------------------- 1. backup G2
 log "=== 1/5 BACKUP restic (G2) ==="
-if $SSH_G9 "sudo restic snapshots 2>/dev/null | grep -q '$(date '+%Y-%m-%d')'"; then
+SNAP_TODAY=$(date '+%Y-%m-%d')
+if $SSH_G9 "sudo sh -c 'set -a; . /etc/restic.env; set +a; restic -r \"\$RESTIC_REPOSITORY\" snapshots 2>/dev/null' | grep -q '$SNAP_TODAY'"; then
   log "  ⏭ snapshot du jour déjà présent — backup complet sauté (idempotence)"
 else
-  $SSH_G9 "sudo /usr/local/bin/restic-daily.sh >/dev/null 2>&1; sudo restic snapshots 2>/dev/null | tail -2"
+  $SSH_G9 "sudo /usr/local/bin/restic-daily.sh >/dev/null 2>&1; sudo sh -c 'set -a; . /etc/restic.env; set +a; restic -r \"\$RESTIC_REPOSITORY\" snapshots 2>/dev/null' | tail -2"
   journal "backup restic pré-migration" "Garde-fou G2 avant import PhotoPrism" "snapshot restic Freebox (log /var/log/restic-daily.log)" "restic forget <snapshot> && restic prune"
 fi
 
@@ -119,13 +120,13 @@ $SSH_G9 "sudo rsync -a $KIT_ON_G9/compose/$BRIQUE/ $G9_DIR/ && sudo chmod 755 $G
 $SSH_G9 "sudo chown -R 999:999 $G9_DIR/db && sudo chmod 750 $G9_DIR/db"
 # PhotoPrism n'accepte pas les *_FILE : env_file construit à partir des secrets (600, root, hors git).
 $SSH_G9 "sudo sh -c 'umask 077; { echo PHOTOPRISM_ADMIN_PASSWORD=\$(cat $G9_DIR/secrets/admin); echo PHOTOPRISM_DATABASE_PASSWORD=\$(cat $G9_DIR/secrets/dbpass); } > $G9_DIR/secrets/photoprism.env' && sudo chown root:root $G9_DIR/secrets/photoprism.env"
-$SSH_G9 "cd $G9_DIR && docker compose up -d && sleep 30 && docker compose ps --format '{{.Name}} {{.Status}}'"
+$SSH_G9 "cd $G9_DIR && sudo docker compose up -d && sleep 30 && sudo docker compose ps --format '{{.Name}} {{.Status}}'"
 
 # ---------------------------------------------------------------- 5. indexation + vérifs
 log "=== 5/5 INDEXATION (progressive, décision #4) + VÉRIFS ==="
-$SSH_G9 "curl -sf -o /dev/null -w 'photoprism HTTP %{http_code}\n' http://127.0.0.1:2342/api/v1/session/health"
-$SSH_G9 "cd $G9_DIR && timeout $INDEX_TIMEOUT docker compose exec -T photoprism photoprism index 2>&1 | tail -6 < /dev/null || true"
-$SSH_G9 "cd $G9_DIR && docker compose exec -T photoprism sh -c 'photoprism count 2>/dev/null | head -12' < /dev/null || true"
+$SSH_G9 "curl -s -o /dev/null -w 'photoprism HTTP %{http_code}\n' http://127.0.0.1:2342/api/v1/health"
+$SSH_G9 "cd $G9_DIR && timeout $INDEX_TIMEOUT sudo docker compose exec -T photoprism photoprism index 2>&1 | tail -6 < /dev/null || true"
+$SSH_G9 "cd $G9_DIR && sudo docker compose exec -T photoprism sh -c 'photoprism count 2>/dev/null | head -12' < /dev/null || true"
 journal "stack PhotoPrism déployée + indexation lancée" "T4.3 : stack saine, index progressif (photothèque 530 Go sur le G9)" "image épinglée 260919, MariaDB 10.11 (watchtower OFF), secrets via env_file 600, port 2342 LAN ; originals = copie locale" "docker compose down + rm -rf /data/docker/photoprism"
 
 echo
diff --git a/g9-migration/scripts/10-verify-restore-photo.sh b/g9-migration/scripts/10-verify-restore-photo.sh
index 6c9c549..925f261 100755
--- a/g9-migration/scripts/10-verify-restore-photo.sh
+++ b/g9-migration/scripts/10-verify-restore-photo.sh
@@ -44,7 +44,13 @@ EOF
 log "  ✅ snapshot contient $N entrées sous $G9_ORIG"
 
 log "=== 2/3 restauration d'un fichier photo ==="
-REL=$($SSH_G9 "find '$G9_ORIG' -type f -name '*.jpg' | sort | tail -1")
+G9_META="${HOME}/migration-staging/photoprism/g9.meta"
+if [[ -f "$G9_META" ]]; then
+  REL=$(grep -i '\.jpg$' "$G9_META" | cut -f1 | LC_ALL=C sort | tail -1)
+  REL="${G9_ORIG}/${REL#./}"
+else
+  REL=$($SSH_G9 "find '$G9_ORIG' -type f -iname '*.jpg' | LC_ALL=C sort | tail -1")
+fi
 log "fichier test = ${REL#$G9_ORIG/}"
 B64=$(printf '%s' "$REL" | base64 -w0)
 $SSH_G9 "sudo bash -s -- '$B64' '$SNAP' '$TARGET'" <<'EOF'