From fcab9e1239ef1d5fbbba63a6faef157fe681c078 Mon Sep 17 00:00:00 2001
From: Codex Agent <agent@vakanaut.ru>
Date: Wed, 21 Oct 2026 08:54:10 +0300
Subject: [PATCH 1/3] Keep rootless Docker socket visible to runner

---
 README.md                                |  6 +++---
 backend/README.md                        |  4 ++--
 backend/ingestion/minjust_current.py     |  2 +-
 backend/search/minjust_opensearch.py     |  2 +-
 backend/search/review.html               |  4 ++--
 docs/README.md                           |  2 +-
 docs/operations/CI_RUNNER.md             | 11 +++++++++--
 docs/operations/CURRENT_STATE.md         | 14 +++++++++++---
 docs/operations/project-status.md        |  4 ++--
 docs/product/frontend-search-sps-plan.md |  2 +-
 docs/product/project-overview.md         |  2 +-
 infra/runner/install-runner.sh           |  4 ++--
 infra/runner/test-runner-config.sh       |  7 ++++++-
 13 files changed, 42 insertions(+), 22 deletions(-)

diff --git a/README.md b/README.md
index 38760ed..932be06 100644
--- a/README.md
+++ b/README.md
@@ -10,7 +10,7 @@ Telegram-бот — только часть рабочего окружения
 ## Текущее состояние
 
 Сейчас реализованы Telegram-бот-секретарь версии `0.2.2`, backend версии
-`0.12.1` и внутренний frontend лаборатории `0.1.2`. Авторизация хранится в
+`0.12.2` и внутренний frontend лаборатории `0.1.2`. Авторизация хранится в
 SQLite; первый пользователь `admin` создаётся интерактивной CLI-командой.
 Поиск расширяет аббревиатуры организационно-правовых форм и поднимает
 действующий Налоговый кодекс для запросов о налоге на прибыль.
@@ -18,7 +18,7 @@ SQLite; первый пользователь `admin` создаётся инт
 | Компонент | Версия | Состояние |
 |---|---:|---|
 | Telegram-бот | `0.2.2` | на Synology работает `0.2.1`; обновление после слияния |
-| Backend | `0.12.1` | авторизация, поиск с фильтрами и ограниченный staging текущего API Минюста |
+| Backend | `0.12.2` | авторизация, поиск с фильтрами и ограниченный staging текущего API Минюста |
 | Frontend | `0.1.2` | лаборатория поиска, личный кабинет и управление учетными записями |
 | Сбор и обработка правовых данных | `0.8.0` | добавлены relevance set и оценка выдачи |
 | RAG и база знаний | — | ещё не созданы |
@@ -62,4 +62,4 @@ python3 -m unittest discover -s tools/telegram-bot -v
 
 ---
 
-Акылдаш · Telegram-бот v0.2.2 · Backend v0.12.1 · Frontend v0.1.2
+Акылдаш · Telegram-бот v0.2.2 · Backend v0.12.2 · Frontend v0.1.2
diff --git a/backend/README.md b/backend/README.md
index 54f8c68..298e191 100644
--- a/backend/README.md
+++ b/backend/README.md
@@ -1,6 +1,6 @@
 # Backend Акылдаш
 
-Версия: `0.12.1`
+Версия: `0.12.2`
 
 Первая backend-область проекта — загрузка правовых документов из официального
 Open Data API ЦБД Минюста Кыргызской Республики. Код расположен в
@@ -296,4 +296,4 @@ PYTHONPATH=backend python3 -m search.query "ЖЧК ачуу тартиби" --la
 
 ---
 
-Акылдаш · Backend v0.12.1 · Frontend v0.1.2
+Акылдаш · Backend v0.12.2 · Frontend v0.1.2
diff --git a/backend/ingestion/minjust_current.py b/backend/ingestion/minjust_current.py
index b39a2c1..26d4bea 100644
--- a/backend/ingestion/minjust_current.py
+++ b/backend/ingestion/minjust_current.py
@@ -23,7 +23,7 @@ from typing import Callable
 from ingestion.minjust_cbd import atomic_write, connect_manifest, json_bytes
 
 API_ROOT = "https://cbd.minjust.gov.kg/api/v1"
-APP_VERSION = "0.12.1"
+APP_VERSION = "0.12.2"
 REQUEST_CONTRACT = {
     "version": 2,
     "endpoint": "/GetEdition",
diff --git a/backend/search/minjust_opensearch.py b/backend/search/minjust_opensearch.py
index d86429f..0feda71 100644
--- a/backend/search/minjust_opensearch.py
+++ b/backend/search/minjust_opensearch.py
@@ -17,7 +17,7 @@ from typing import Iterator
 
 from search.catalog import authority_codes, legal_force_code, source_code
 
-APP_VERSION = "0.12.1"
+APP_VERSION = "0.12.2"
 LANGUAGES = {"ru", "ky"}
 DEFAULT_MAPPING = Path(__file__).with_name("minjust-fragments-index.json")
 
diff --git a/backend/search/review.html b/backend/search/review.html
index bbb1ec4..d5a42f0 100644
--- a/backend/search/review.html
+++ b/backend/search/review.html
@@ -176,7 +176,7 @@
   <dialog id="users-dialog" aria-labelledby="users-heading"><section class="review__page"><h2 id="users-heading">Управление пользователями</h2><form id="create-user-form"><label>Логин<input id="new-username" autocomplete="off" minlength="3" maxlength="64" required></label><label>Временный пароль<input id="temporary-password" type="password" autocomplete="new-password" minlength="12" maxlength="256" required></label><p>Пароль — от 12 символов. Новый пользователь сменит его при первом входе. Передайте временный пароль отдельно.</p><p id="users-error" role="alert" class="review__status review__status--error"></p><button class="review__button--primary" type="submit">Создать пользователя</button></form><ul id="user-list" class="review__user-list"></ul><button type="button" data-close="users-dialog">Закрыть</button></section></dialog>
   <dialog id="document-dialog"><button class="review__dialog-close" id="dialog-close" type="button">Закрыть</button><h2 id="dialog-heading">Документ</h2><div class="review__document-body" id="dialog-body"></div></dialog>
   <div class="review__tour-spotlight" id="tutorial-spotlight" hidden aria-hidden="true"></div><dialog class="review__tour" id="tutorial-dialog" aria-labelledby="tutorial-heading" aria-describedby="tutorial-text"><div class="review__tour-content"><p class="review__tour-kicker">Короткое знакомство</p><h2 id="tutorial-heading"></h2><p id="tutorial-text"></p><div class="review__tour-footer"><span class="review__tour-progress" id="tutorial-progress"></span><div class="review__tour-actions"><button id="tutorial-skip" type="button">Пропустить</button><button class="review__button--primary" id="tutorial-next" type="button">Далее</button></div></div></div></dialog>
-  <footer class="review__header"><div class="review__header-content">Акылдаш · Frontend v0.1.2 · Backend v0.12.1 · Внутренняя лаборатория релевантности</div></footer>
+  <footer class="review__header"><div class="review__header-content">Акылдаш · Frontend v0.1.2 · Backend v0.12.2 · Внутренняя лаборатория релевантности</div></footer>
   <script>
     document.body.classList.add('review__locked');
     const DRAFT_KEY = 'akyldash-search-review-draft';
@@ -193,7 +193,7 @@
     let account = null;
     const reviewRoute = location.pathname === '/review';
     $('review').hidden = !reviewRoute; $('search-page').hidden = reviewRoute; $('review-nav').classList.toggle('is-active', reviewRoute); $('search-nav').classList.toggle('is-active', !reviewRoute);
-    if (!reviewRoute) { document.title = 'Поиск по правовой базе · Акылдаш'; document.querySelector('.review__header-content').hidden = true; $('tutorial-open').hidden = true; document.querySelector('.review__skip').href = '#public-results'; document.querySelector('footer .review__header-content').textContent = 'Акылдаш · Frontend v0.1.2 · Backend v0.12.1'; }
+    if (!reviewRoute) { document.title = 'Поиск по правовой базе · Акылдаш'; document.querySelector('.review__header-content').hidden = true; $('tutorial-open').hidden = true; document.querySelector('.review__skip').href = '#public-results'; document.querySelector('footer .review__header-content').textContent = 'Акылдаш · Frontend v0.1.2 · Backend v0.12.2'; }
     async function apiFetch(path, options = {}) { const response = await fetch(path, {credentials: 'same-origin', ...options}); if (response.status === 401 && path !== '/auth/login') { document.body.classList.add('review__locked'); if (!$('login-dialog').open) $('login-dialog').showModal(); $('login-username').focus(); } return response; }
     const showLogin = () => { document.body.classList.add('review__locked'); if (!$('login-dialog').open) $('login-dialog').showModal(); $('login-username').focus(); };
     const enterWorkspace = (user) => { account = user; $('signed-in-user').textContent = `${user.username} · ${user.role}`; $('reviewer').value = user.username; $('profile-username').textContent = user.username; $('profile-role').textContent = user.role; $('profile-created').textContent = new Date(user.created_at * 1000).toLocaleDateString('ru-RU'); $('users-open').hidden = user.username.toLowerCase() !== 'admin'; document.body.classList.remove('review__locked'); if (!reviewRoute) initSearchPage(); else if (!hasSeenTour()) setTimeout(openTutorial, 350); };
diff --git a/docs/README.md b/docs/README.md
index c4492f7..42b5959 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -45,4 +45,4 @@
 
 ---
 
-Акылдаш · Telegram-бот v0.2.2 · Backend v0.12.1 · Frontend v0.1.2
+Акылдаш · Telegram-бот v0.2.2 · Backend v0.12.2 · Frontend v0.1.2
diff --git a/docs/operations/CI_RUNNER.md b/docs/operations/CI_RUNNER.md
index b6bd997..d9ac133 100644
--- a/docs/operations/CI_RUNNER.md
+++ b/docs/operations/CI_RUNNER.md
@@ -25,8 +25,15 @@ rootless Docker setup and user service use `.config/act-runner` as writable
 `.config/act-runner/.local/share` as `XDG_DATA_HOME`. This keeps Docker config
 and its systemd user unit in the existing `.config` tree without granting
 write access to the protected home.
-rootless Docker daemon
-and runner user are separate from production Docker; `codex` is not added to
+The runner systemd unit uses `ProtectHome=read-only`: `/home`, `/root`, and
+`/run/user` remain visible read-only. `ReadWritePaths` does not make
+`/run/user/$uid` writable, because read-only mounts still permit communication
+with existing Unix sockets; this lets the runner connect to
+`/run/user/$uid/docker.sock` without write access to the runtime directory.
+`ProtectHome=yes` would hide `/run/user` and break that socket path. See the
+[systemd.exec documentation](https://www.freedesktop.org/software/systemd/man/255/systemd.exec.html#ProtectHome=).
+The rootless Docker daemon and runner user are separate from production Docker;
+`codex` is not added to
 sudo or Docker groups. Jobs do not receive the rootless Docker socket, the
 production Docker socket, production environment/secrets, or arbitrary host
 bind mounts. The runner account has no access to `/etc/akyldash` or the
diff --git a/docs/operations/CURRENT_STATE.md b/docs/operations/CURRENT_STATE.md
index cc869fd..c966960 100644
--- a/docs/operations/CURRENT_STATE.md
+++ b/docs/operations/CURRENT_STATE.md
@@ -63,7 +63,7 @@ protected file metadata remain unverified.
   unverified.
 - No public application listener is observed on TCP `80`/`443`. Docker
   container/volume state still requires the root audit. Repository Compose describes
-  Caddy `2.11.6` pinned by digest, Python Search API `0.12.1` in this branch,
+  Caddy `2.11.6` pinned by digest, Python Search API `0.12.2` in this branch,
   SQLite account/review data, and OpenSearch `3.7.0` with `analysis-icu`.
 - The target publishes only Caddy on TCP `80`/`443`. Backend and Caddy share a
   proxy network; OpenSearch and backend share a separate internal network, and
@@ -111,7 +111,15 @@ protected file metadata remain unverified.
   with exit status 1 since 2026-10-14; its journal had no entries, so the cause
   is unknown. The latest verified main CI run 75 and smoke run 76 succeeded on
   head `0e276ae6`. The Actions API returned 403 during this recheck, so no newer
-  run state was independently retrieved. On
+  run state was independently retrieved. A read-only SSH recheck on 2026-10-21
+  confirmed the active `akyldash-act-runner.service` runs as
+  `akyldash-runner` with `ProtectHome=read-only`; `ReadWritePaths` includes the
+  runner runtime/config/log paths and `/run/user/999`. Its `ExecStart` uses
+  `/etc/akyldash-runner/config.yaml`. The live unit retains a writable carveout
+  for `/run/user/999`; the installer change in this branch removes that
+  carveout while keeping the socket visible over the read-only path. No VPS
+  unit was changed. Main commit
+  `d2fb4b81` passed CI run 115 and smoke run 116. On
   head `3a89dc21`, CI run 63 failed at the host audit root guard and smoke run 64
   succeeded. On head `436806a8`, CI run 65 failed in the Caddy container action
   with `exec: "validate": executable file not found`; Kaniko was skipped and
@@ -129,7 +137,7 @@ protected file metadata remain unverified.
   removed afterward. This does not verify VPS startup, DNS, or public TLS.
 - The app has no migration framework or SMTP setup. Repository versions on this
   branch are:
-  backend `0.12.1`, frontend `0.1.2`, Telegram bot `0.2.2` (the bot is not
+  backend `0.12.2`, frontend `0.1.2`, Telegram bot `0.2.2` (the bot is not
   deployed on this VPS).
 
 ## Corpus readiness (2026-10-18)
diff --git a/docs/operations/project-status.md b/docs/operations/project-status.md
index f96f0d8..d8acb00 100644
--- a/docs/operations/project-status.md
+++ b/docs/operations/project-status.md
@@ -5,7 +5,7 @@
 
 - Telegram-бот: `0.2.2`
 - Telegram-бот на Synology: `0.2.1`
-- Backend: `0.12.1`
+- Backend: `0.12.2`
 - Frontend: `0.1.2` — поиск, лаборатория релевантности, аккаунты
 
 ## Краткий итог
@@ -282,4 +282,4 @@
 
 ---
 
-Акылдаш · Telegram-бот v0.2.2 · Backend v0.12.1 · Frontend v0.1.2
+Акылдаш · Telegram-бот v0.2.2 · Backend v0.12.2 · Frontend v0.1.2
diff --git a/docs/product/frontend-search-sps-plan.md b/docs/product/frontend-search-sps-plan.md
index f77eca9..9cfcb64 100644
--- a/docs/product/frontend-search-sps-plan.md
+++ b/docs/product/frontend-search-sps-plan.md
@@ -262,4 +262,4 @@ runtime-зависимостями frontend. Регистрация в стор
 
 ---
 
-Акылдаш · Telegram-бот v0.2.2 · Backend v0.12.1 · Frontend v0.1.2
+Акылдаш · Telegram-бот v0.2.2 · Backend v0.12.2 · Frontend v0.1.2
diff --git a/docs/product/project-overview.md b/docs/product/project-overview.md
index 5483449..d8445f8 100644
--- a/docs/product/project-overview.md
+++ b/docs/product/project-overview.md
@@ -44,4 +44,4 @@
 
 ---
 
-Акылдаш · Telegram-бот v0.2.2 · Backend v0.12.1 · Frontend v0.1.2
+Акылдаш · Telegram-бот v0.2.2 · Backend v0.12.2 · Frontend v0.1.2
diff --git a/infra/runner/install-runner.sh b/infra/runner/install-runner.sh
index e8fe971..e4586d8 100644
--- a/infra/runner/install-runner.sh
+++ b/infra/runner/install-runner.sh
@@ -179,12 +179,12 @@ TasksMax=256
 NoNewPrivileges=yes
 PrivateTmp=yes
 ProtectSystem=strict
-ProtectHome=yes
+ProtectHome=read-only
 ProtectKernelTunables=yes
 ProtectKernelModules=yes
 ProtectKernelLogs=yes
 RestrictSUIDSGID=yes
-ReadWritePaths=$runner_runtime_home $runner_xdg_config_home /var/log/akyldash-runner /run/user/$runner_uid
+ReadWritePaths=$runner_runtime_home $runner_xdg_config_home /var/log/akyldash-runner
 StandardOutput=append:/var/log/akyldash-runner/act_runner.log
 StandardError=append:/var/log/akyldash-runner/act_runner.log
 
diff --git a/infra/runner/test-runner-config.sh b/infra/runner/test-runner-config.sh
index b1267aa..5d23f7b 100644
--- a/infra/runner/test-runner-config.sh
+++ b/infra/runner/test-runner-config.sh
@@ -23,6 +23,10 @@ grep -Fq 'test -w "$HOME" && test -w "$XDG_CONFIG_HOME" && test -w "$XDG_DATA_HO
 grep -Fq 'rootless_env=(HOME="$runner_runtime_home" XDG_CONFIG_HOME="$runner_xdg_config_home" XDG_DATA_HOME="$runner_xdg_data_home"' "$installer"
 grep -Fq 'Environment=XDG_CONFIG_HOME=$runner_xdg_config_home' "$installer"
 grep -Fq 'Environment=XDG_DATA_HOME=$runner_xdg_data_home' "$installer"
+grep -Fq 'Environment=XDG_RUNTIME_DIR=/run/user/$runner_uid' "$installer"
+grep -Fq 'Environment=DOCKER_HOST=unix:///run/user/$runner_uid/docker.sock' "$installer"
+grep -Fq 'ProtectHome=read-only' "$installer"
+assert_absent '^ProtectHome=yes$' "$installer"
 grep -Fq 'runner_home/.config/systemd/user/docker.service.d/environment.conf' "$installer"
 grep -Fq 'Environment=HOME=$runner_runtime_home' "$installer"
 grep -Fq 'systemctl --user restart docker.service' "$installer"
@@ -41,7 +45,8 @@ if grep -Fq 'env HOME="$runner_home"' "$installer"; then
   exit 1
 fi
 grep -Fq 'die '\''stop akyldash-act-runner.service after all jobs finish before rerunning this installer' "$installer"
-grep -Fq 'ReadWritePaths=$runner_runtime_home $runner_xdg_config_home /var/log/akyldash-runner /run/user/$runner_uid' "$installer"
+grep -Fq 'ReadWritePaths=$runner_runtime_home $runner_xdg_config_home /var/log/akyldash-runner' "$installer"
+assert_absent 'ReadWritePaths=.*(/run/user/|docker.sock)' "$installer"
 grep -Fq 'os.O_NOFOLLOW | os.O_CLOEXEC' infra/runner/secure-runner-image.py
 grep -Fq 'os.posix_fallocate(image_fd, 0, int(bytes_text))' infra/runner/secure-runner-image.py
 grep -Fq 'pass_fds=(image_fd,)' infra/runner/secure-runner-image.py
-- 
2.54.0


From d6799ec59b6bab796f4318e0a37232a56158a72a Mon Sep 17 00:00:00 2001
From: Codex Agent <agent@vakanaut.ru>
Date: Wed, 21 Oct 2026 08:57:00 +0300
Subject: [PATCH 2/3] Preserve runner runtime path carve-out

---
 docs/operations/CI_RUNNER.md       | 10 ++++------
 docs/operations/CURRENT_STATE.md   |  6 +++---
 infra/runner/install-runner.sh     |  2 +-
 infra/runner/test-runner-config.sh |  4 ++--
 4 files changed, 10 insertions(+), 12 deletions(-)

diff --git a/docs/operations/CI_RUNNER.md b/docs/operations/CI_RUNNER.md
index d9ac133..1ac88b1 100644
--- a/docs/operations/CI_RUNNER.md
+++ b/docs/operations/CI_RUNNER.md
@@ -25,12 +25,10 @@ rootless Docker setup and user service use `.config/act-runner` as writable
 `.config/act-runner/.local/share` as `XDG_DATA_HOME`. This keeps Docker config
 and its systemd user unit in the existing `.config` tree without granting
 write access to the protected home.
-The runner systemd unit uses `ProtectHome=read-only`: `/home`, `/root`, and
-`/run/user` remain visible read-only. `ReadWritePaths` does not make
-`/run/user/$uid` writable, because read-only mounts still permit communication
-with existing Unix sockets; this lets the runner connect to
-`/run/user/$uid/docker.sock` without write access to the runtime directory.
-`ProtectHome=yes` would hide `/run/user` and break that socket path. See the
+The runner systemd unit uses `ProtectHome=read-only` so `/run/user` remains
+visible; `ReadWritePaths` retains the existing `/run/user/$uid` writable
+carve-out for the runner's rootless runtime. `ProtectHome=yes` would hide
+`/run/user` and break the configured runtime and Docker socket paths. See the
 [systemd.exec documentation](https://www.freedesktop.org/software/systemd/man/255/systemd.exec.html#ProtectHome=).
 The rootless Docker daemon and runner user are separate from production Docker;
 `codex` is not added to
diff --git a/docs/operations/CURRENT_STATE.md b/docs/operations/CURRENT_STATE.md
index c966960..eb32e5d 100644
--- a/docs/operations/CURRENT_STATE.md
+++ b/docs/operations/CURRENT_STATE.md
@@ -116,9 +116,9 @@ protected file metadata remain unverified.
   `akyldash-runner` with `ProtectHome=read-only`; `ReadWritePaths` includes the
   runner runtime/config/log paths and `/run/user/999`. Its `ExecStart` uses
   `/etc/akyldash-runner/config.yaml`. The live unit retains a writable carveout
-  for `/run/user/999`; the installer change in this branch removes that
-  carveout while keeping the socket visible over the read-only path. No VPS
-  unit was changed. Main commit
+  for `/run/user/999`; the installer keeps that existing carveout and changes
+  `ProtectHome` from `yes` to `read-only` so the runtime path remains visible.
+  No VPS unit was changed. Main commit
   `d2fb4b81` passed CI run 115 and smoke run 116. On
   head `3a89dc21`, CI run 63 failed at the host audit root guard and smoke run 64
   succeeded. On head `436806a8`, CI run 65 failed in the Caddy container action
diff --git a/infra/runner/install-runner.sh b/infra/runner/install-runner.sh
index e4586d8..5aab49b 100644
--- a/infra/runner/install-runner.sh
+++ b/infra/runner/install-runner.sh
@@ -184,7 +184,7 @@ ProtectKernelTunables=yes
 ProtectKernelModules=yes
 ProtectKernelLogs=yes
 RestrictSUIDSGID=yes
-ReadWritePaths=$runner_runtime_home $runner_xdg_config_home /var/log/akyldash-runner
+ReadWritePaths=$runner_runtime_home $runner_xdg_config_home /var/log/akyldash-runner /run/user/$runner_uid
 StandardOutput=append:/var/log/akyldash-runner/act_runner.log
 StandardError=append:/var/log/akyldash-runner/act_runner.log
 
diff --git a/infra/runner/test-runner-config.sh b/infra/runner/test-runner-config.sh
index 5d23f7b..dc89fc9 100644
--- a/infra/runner/test-runner-config.sh
+++ b/infra/runner/test-runner-config.sh
@@ -45,8 +45,8 @@ if grep -Fq 'env HOME="$runner_home"' "$installer"; then
   exit 1
 fi
 grep -Fq 'die '\''stop akyldash-act-runner.service after all jobs finish before rerunning this installer' "$installer"
-grep -Fq 'ReadWritePaths=$runner_runtime_home $runner_xdg_config_home /var/log/akyldash-runner' "$installer"
-assert_absent 'ReadWritePaths=.*(/run/user/|docker.sock)' "$installer"
+grep -Fq 'ReadWritePaths=$runner_runtime_home $runner_xdg_config_home /var/log/akyldash-runner /run/user/$runner_uid' "$installer"
+assert_absent 'ReadWritePaths=.*(/var/run/docker.sock|/run/docker.sock)' "$installer"
 grep -Fq 'os.O_NOFOLLOW | os.O_CLOEXEC' infra/runner/secure-runner-image.py
 grep -Fq 'os.posix_fallocate(image_fd, 0, int(bytes_text))' infra/runner/secure-runner-image.py
 grep -Fq 'pass_fds=(image_fd,)' infra/runner/secure-runner-image.py
-- 
2.54.0


From 1f6129e0090921537a01c67df1eb38ac0648cfa1 Mon Sep 17 00:00:00 2001
From: Codex Agent <agent@vakanaut.ru>
Date: Wed, 21 Oct 2026 09:00:43 +0300
Subject: [PATCH 3/3] Document runner ProtectHome fix

---
 CHANGELOG.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f17ccd2..25f7c95 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,9 @@
 
 ## Не выпущено
 
+- Infrastructure: systemd unit Gitea Actions runner теперь использует
+  `ProtectHome=read-only`, сохраняя доступность `/run/user` и существующий
+  writable carve-out для rootless runtime; VPS не изменялся.
 - Backend `0.12.1`: добавлен ограниченный возобновляемый staging редакций из
   текущего API Минюста с проверкой точных ID и метаданных, изоляцией от
   legacy-корпуса и сохранением исходного порядка редакций при нормализации и
-- 
2.54.0