chore(embedded): cut v0.0.17-beta

The HTML→PDF stage failed with:

  Creating shared memory in /dev/shm/.org.chromium.Chromium.XXXXXX
  failed: Read-only file system (30)
  Unable to access(W_OK|X_OK) /dev/shm: Read-only file system (30)

Chromium tries to put its IPC shared-memory segments under /dev/shm
by default. Our container runs --read-only with /dev/shm inherited
from the image (which makes it read-only too). The well-known fix is
the --disable-dev-shm-usage chromium flag, which routes those
allocations to /tmp instead.

/tmp is a writable tmpfs we already set up. Bump its size from
128 MiB to 256 MiB so chromium has room for both its user-data-dir
and the redirected shared-memory segments. A small PDF flow used
~64 MiB free of 128 MiB available; doubling gives headroom without
materially changing the pod's memory footprint (tmpfs only consumes
RAM for bytes actually written).

The discardable_shared_memory_manager warning ("Less than 64MB of
free space in temporary directory") in the prior chromium log was a
symptom of this same /tmp-too-small condition; the bump quiets it
too.

Other warnings in the log (dbus connect failures) are not load-
bearing — chromium falls back gracefully when dbus is absent. No fix
needed there.

zddc/internal/apps/embedded/archive.html

@@ -2470,7 +2470,7 @@ td[data-field="trackingNumber"] {
                 </svg>
                 <div class="header-title-group">
                     <span class="app-header__title">ZDDC Archive</span>
-                    <span class="build-timestamp"><span style="color:red;font-weight:bold">v0.0.17-beta · 2026-05-13 18:06:45 · b8c6b98</span></span>
+                    <span class="build-timestamp"><span style="color:red;font-weight:bold">v0.0.17-beta · 2026-05-13 18:10:02 · 0fac49e</span></span>
                 </div>
                 <button id="addDirectoryBtn" class="btn btn-primary">Add Local Directory</button>
                 <button id="refreshHeaderBtn" class="btn btn-secondary hidden" title="Refresh Data">⟳</button>

zddc/internal/apps/embedded/browse.html

@@ -1657,7 +1657,7 @@ html, body {
             </svg>
             <div class="header-title-group">
                 <span class="app-header__title">ZDDC Browse</span>
-                <span class="build-timestamp"><span style="color:red;font-weight:bold">v0.0.17-beta · 2026-05-13 18:06:46 · b8c6b98</span></span>
+                <span class="build-timestamp"><span style="color:red;font-weight:bold">v0.0.17-beta · 2026-05-13 18:10:02 · 0fac49e</span></span>
             </div>
             <button id="addDirectoryBtn" class="btn btn-primary">Add Local Directory</button>
             <button id="refreshHeaderBtn" class="btn btn-secondary hidden" title="Refresh listing" aria-label="Refresh listing">⟳</button>

zddc/internal/apps/embedded/classifier.html

@@ -1681,7 +1681,7 @@ body.help-open .app-header {
                     </svg>
                     <div class="header-title-group">
                         <span class="app-header__title">ZDDC Classifier</span>
-                        <span class="build-timestamp"><span style="color:red;font-weight:bold">v0.0.17-beta · 2026-05-13 18:06:45 · b8c6b98</span></span>
+                        <span class="build-timestamp"><span style="color:red;font-weight:bold">v0.0.17-beta · 2026-05-13 18:10:02 · 0fac49e</span></span>
                     </div>
                     <button id="addDirectoryBtn" class="btn btn-primary">Add Local Directory</button>
                     <button id="refreshHeaderBtn" class="btn btn-secondary hidden" title="Refresh and rescan directory" aria-label="Refresh" style="font-size:1.1rem;">⟳</button>

zddc/internal/apps/embedded/index.html

@@ -1424,7 +1424,7 @@ body {
             </svg>
             <div class="header-title-group">
                 <span class="app-header__title">ZDDC</span>
-                <span class="build-timestamp"><span style="color:red;font-weight:bold">v0.0.17-beta · 2026-05-13 18:06:45 · b8c6b98</span></span>
+                <span class="build-timestamp"><span style="color:red;font-weight:bold">v0.0.17-beta · 2026-05-13 18:10:02 · 0fac49e</span></span>
             </div>
         </div>
         <div class="header-right">

zddc/internal/apps/embedded/transmittal.html

@@ -2523,7 +2523,7 @@ dialog.modal--narrow {
             </svg>
             <div class="header-title-group">
                 <span class="app-header__title">ZDDC Transmittal</span>
-                <span class="build-timestamp"><span style="color:red;font-weight:bold">v0.0.17-beta · 2026-05-13 18:06:45 · b8c6b98</span></span>
+                <span class="build-timestamp"><span style="color:red;font-weight:bold">v0.0.17-beta · 2026-05-13 18:10:01 · 0fac49e</span></span>
             </div>
             <span id="no-js-notice" class="text-gray-400 text-xs italic">JavaScript not available</span>
             <!-- Publish split-button (Transmittal-specific primary action;

zddc/internal/apps/embedded/versions.txt

@@ -1,8 +1,8 @@
 # Generated by build.sh — do not edit. One <app>=<build label> per line.
-archive=v0.0.17-beta · 2026-05-13 18:06:45 · b8c6b98
-transmittal=v0.0.17-beta · 2026-05-13 18:06:45 · b8c6b98
-classifier=v0.0.17-beta · 2026-05-13 18:06:45 · b8c6b98
-landing=v0.0.17-beta · 2026-05-13 18:06:45 · b8c6b98
-form=v0.0.17-beta · 2026-05-13 18:06:45 · b8c6b98
-tables=v0.0.17-beta · 2026-05-13 18:06:46 · b8c6b98
-browse=v0.0.17-beta · 2026-05-13 18:06:46 · b8c6b98
+archive=v0.0.17-beta · 2026-05-13 18:10:02 · 0fac49e
+transmittal=v0.0.17-beta · 2026-05-13 18:10:01 · 0fac49e
+classifier=v0.0.17-beta · 2026-05-13 18:10:02 · 0fac49e
+landing=v0.0.17-beta · 2026-05-13 18:10:02 · 0fac49e
+form=v0.0.17-beta · 2026-05-13 18:10:02 · 0fac49e
+tables=v0.0.17-beta · 2026-05-13 18:10:02 · 0fac49e
+browse=v0.0.17-beta · 2026-05-13 18:10:02 · 0fac49e

zddc/internal/convert/convert.go

@@ -210,10 +210,17 @@ func ToPDF(ctx context.Context, source []byte, m Metadata) ([]byte, error) {
 	// required because the container drops CAP_SYS_ADMIN; the threat
 	// model is "malicious markdown drives chromium RCE", contained by
 	// --network=none + --cap-drop=ALL + --read-only + tmpfs.
+	//
+	// --disable-dev-shm-usage: without this, chromium tries to allocate
+	// shared memory under /dev/shm, which our --read-only container
+	// can't write to. The flag tells chromium to fall back to /tmp,
+	// which is a writable tmpfs (sized in runner.go). Standard fix for
+	// chromium-in-container; required by every CI/headless setup.
 	cmd := []string{
 		"--headless",
 		"--disable-gpu",
 		"--no-sandbox",
+		"--disable-dev-shm-usage",
 		"--user-data-dir=/tmp/chrome",
 		"--no-pdf-header-footer",
 		"--virtual-time-budget=10000",

zddc/internal/convert/runner.go

@@ -244,7 +244,11 @@ func (cr *containerRunner) Run(ctx context.Context, image string, stdin []byte,
 	args = append(args,
 		"--network=none",
 		"--read-only",
-		"--tmpfs=/tmp:size=128m,exec",
+		// /tmp must be large enough to host chromium's shared-memory
+		// fallback (--disable-dev-shm-usage redirects /dev/shm writes
+		// here) plus the user-data-dir. 256 MiB is plenty for the
+		// HTML→PDF flow; pandoc itself uses almost none.
+		"--tmpfs=/tmp:size=256m,exec",
 		"--tmpfs=/run:size=4m",
 		fmt.Sprintf("--memory=%dm", memMiB),
 		fmt.Sprintf("--cpus=%s", cpus),

zddc/internal/handler/tables.html

@@ -1300,7 +1300,7 @@ body.help-open .app-header {
             </svg>
             <div class="header-title-group">
                 <span class="app-header__title" id="table-title">ZDDC Table</span>
-                <span class="build-timestamp"><span style="color:red;font-weight:bold">v0.0.17-beta · 2026-05-13 18:06:46 · b8c6b98</span></span>
+                <span class="build-timestamp"><span style="color:red;font-weight:bold">v0.0.17-beta · 2026-05-13 18:10:02 · 0fac49e</span></span>
             </div>
         </div>
         <div class="header-right">