Handle foreign-owned compile artifacts

docs/setup.md

@@ -290,6 +290,14 @@ workers continue to use `/etc/uce/settings.cfg`. The parallel precompile
 regression uses private roots so a running proactive compiler cannot consume
 or publish its controlled race fixtures.
 
+Prefer the managed restart when the service runs as an unprivileged user: it
+precompiles as that same user. Request-time publication still accepts readable
+artifacts produced by a trusted administrator. When Linux protected-hardlink
+policy rejects the normal rollback snapshot, UCE copies the prior artifact
+under the unit lock; generation markers are replaced atomically instead of
+requiring write access to the existing inode. Existing readable lock files can
+be locked without write access, including the shared-PCH lock.
+
 Equivalent manual systemd service for a source checkout (`<UCE_REPO>` = checkout root):
 
 ```ini