Handle foreign-owned compile artifacts

docs/setup.md

@@ -290,6 +290,14 @@ workers continue to use `/etc/uce/settings.cfg`. The parallel precompile
 regression uses private roots so a running proactive compiler cannot consume
 or publish its controlled race fixtures.
 
+Prefer the managed restart when the service runs as an unprivileged user: it
+precompiles as that same user. Request-time publication still accepts readable
+artifacts produced by a trusted administrator. When Linux protected-hardlink
+policy rejects the normal rollback snapshot, UCE copies the prior artifact
+under the unit lock; generation markers are replaced atomically instead of
+requiring write access to the existing inode. Existing readable lock files can
+be locked without write access, including the shared-PCH lock.
+
 Equivalent manual systemd service for a source checkout (`<UCE_REPO>` = checkout root):
 
 ```ini

docs/wasm-runtime-architecture.md

@@ -578,7 +578,14 @@ header free-functions are `inline`. The wasm backend exposes only declarations
   held unit and registry locks, silent nonzero and missing-output compiler
   results, compiler descendants, staged-output timeout, prior-generation
   hashes, same-worker recovery, configured-error-page boundedness, residue,
-  and deadline-independent offline precompile.
+  foreign-owned offline-precompile artifacts, and deadline-independent offline
+  precompile. Normal rollback snapshots are hard links. If Linux ownership or
+  link policy rejects that fast path, the compiler copies the prior artifact
+  under the same unit lock and keeps the same all-or-nothing publication.
+  Source-generation markers likewise publish through a same-directory rename,
+  so a runtime user can replace a readable marker created by an administrator.
+  Existing foreign-owned unit, registry, generation, and PCH lock files are
+  opened read-only for `flock`; new locks are still created read-write.
   `scripts/test_cold_component_deadline.sh` separately compiles a deliberately
   cold component that exceeds the development epoch window and proves the
   parent request still renders it. The focused shell gates create temporary