Added a survey of VPN blocking on T-Mobile Russia (MVNO over Tele2) as of late July 2026: XRay VLESS+Reality and AmneziaWG 2.0 still work; OpenVPN/WireGuard/IKEv2/legacy Shadowsocks/commercial VPN apps/AmneziaWG 1.x are TSPU-blocked; in whitelist mode (Ministry of Digital Development, UAV-threat periods) no VPN works.
Deployed elriseio/demo_application_layer demo for elriseio/application-layer-bundle in RU and EN.
// TODO: build demos for the rest of the bundles — dbal-bundle, doctrine-shard-manager-bundle, dto-entity-updater, finance-money-bundle.
opencode 1.18.7 was throwing "unknown certificate verification error" on every streaming response to api.minimax.io — the new Let's Encrypt YR2 root is missing from every CA source the embedded Bun runtime consults (system store, bundled webpki-roots, NODE_EXTRA_CA_CERTS). 577 occurrences across all 14 active roles between 2026-06-15 and 2026-07-27; per-process RSS stuck at 600–770 MB and 30–45% CPU in a hot retry loop.
Fixed via a personal augmented CA bundle + NODE_EXTRA_CA_CERTS / SSL_CERT_FILE override, every opencode process bounced. Full diagnosis, evidence (sha256s of bundle/certs/env-file/backups), reversibility and pending follow-ups in the incident report.