# SHiRE Academy Stage 3A.2 — Service Write Boundary Fix

This patch corrects the Stage 3A canary preflight after the local UI service correctly reported a read-only filesystem.

The cause was systemd hardening (`ProtectSystem=strict` and `ProtectHome=read-only`). The interactive installer could write to SHiREVault, but the Academy UI service was intentionally read-only and therefore could not create canary status/evidence files.

Stage 3A.2 preserves the hardened service and adds only two narrow write exceptions:

- `/home/shire3d/ARMOR/apps/shire-academy/runtime` for canary status and its private lock.
- The resolved network-backed `/SHiREVault/SHiREAcademy` tree for Academy canary evidence.

The UI service remains unable to write to `/SHiREVault/Backup/OSBackups`, the 371-skill practice state, certifications, Forge permissions, or arbitrary ARMOR paths. Installer/recovery backups remain external to the UI service.

This patch does not run the Boolean Operations canary. It only makes the preflight accurately report **Ready** when the narrow service sandbox is working.