diff --git a/ops/timeweb/README.md b/ops/timeweb/README.md
index 55a4380..dd7dfac 100644
--- a/ops/timeweb/README.md
+++ b/ops/timeweb/README.md
@@ -2,11 +2,21 @@
 
 Use this only for the Year/shared-hosting fallback where system `crontab` is unavailable and scheduling is configured in the Timeweb panel.
 
+## Production target: app.caterium.ru
+
+Caterium runs as its own Timeweb site (panel name `caterium-app`), bound to `app.caterium.ru`, with document root:
+
+```text
+$HOME/caterium-app/public_html
+```
+
+`caterium.ru` (the apex domain) is a **separate** Timeweb site (panel name "Основной сайт") reserved for a future, unrelated site. This script must never write there. `CATERIUM_WEB_ROOT` is always passed explicitly in the cron command below for this reason — do not rely on auto-detection for this account.
+
 ## What it does
 
 `caterium-production-sync.sh` checks the GitHub `production` branch, deploys only when the commit changed, validates that `public/index.html` exists, creates a rollback archive before changing live files, prevents overlapping runs, and keeps the four newest backups.
 
-Web root auto-detection tries, in order: `$HOME/caterium.ru/public_html`, `$HOME/app.caterium.ru/public_html`, `$HOME/public_html`. Set `CATERIUM_WEB_ROOT` explicitly to override.
+If `CATERIUM_WEB_ROOT` is unset, it falls back to auto-detecting `$HOME/caterium-app/public_html` only — it will never guess the account's default document root.
 
 ## One-time setup
 
@@ -38,16 +48,16 @@ Create one task:
 - Name: `Caterium production sync`
 - Schedule: every 5 minutes — minute `*/5`, hour `*`, day `*`, month `*`, weekday `*`
 
-If Timeweb offers a "Сценарий SH" interpreter option, point it directly at `$HOME/caterium-production-sync.sh` (simplest, no shell redirection to worry about).
+If Timeweb offers a "Сценарий SH" interpreter option and lets you set environment variables for it, point it at `$HOME/caterium-production-sync.sh` with `CATERIUM_WEB_ROOT` and `CATERIUM_REPO_URL` set as below.
 
 If it only offers an arbitrary command, use:
 
 ```sh
-mkdir -p "$HOME/.caterium-deploy" && CATERIUM_REPO_URL="git@github-caterium:pavlov346346-source/caterium-app.git" /bin/sh "$HOME/caterium-production-sync.sh" >> "$HOME/.caterium-deploy/cron.log" 2>&1
+mkdir -p "$HOME/.caterium-deploy" && CATERIUM_REPO_URL="git@github-caterium:pavlov346346-source/caterium-app.git" CATERIUM_WEB_ROOT="$HOME/caterium-app/public_html" /bin/sh "$HOME/caterium-production-sync.sh" >> "$HOME/.caterium-deploy/cron.log" 2>&1
 ```
 
+`CATERIUM_WEB_ROOT` is set explicitly on purpose, so a change on the Timeweb side (a new site, a renamed site) can never make this script fall back onto the wrong document root instead of failing loudly.
+
 The leading `mkdir -p` matters: without it, the very first cron run fails before the script even starts, because the shell opens the log file for the `>>` redirect before executing anything, and `$HOME/.caterium-deploy` does not exist yet on a fresh account.
 
-Only override `CATERIUM_WEB_ROOT` in the command above if auto-detection (see above) does not match your account's actual document root — verify the real path first (e.g. by checking what a plain HTTP request to the domain currently serves) rather than assuming `$HOME/public_html`.
-
 The old Cloudflare Worker must remain enabled as a fallback until the Timeweb production domain, SSL, Supabase flows, uploads and PDF generation have been verified.
diff --git a/ops/timeweb/caterium-production-sync.sh b/ops/timeweb/caterium-production-sync.sh
index 917166f..cac49f4 100644
--- a/ops/timeweb/caterium-production-sync.sh
+++ b/ops/timeweb/caterium-production-sync.sh
@@ -24,9 +24,7 @@ find_web_root() {
   fi
 
   for candidate in \
-    "$HOME/caterium.ru/public_html" \
-    "$HOME/app.caterium.ru/public_html" \
-    "$HOME/public_html"
+    "$HOME/caterium-app/public_html"
   do
     if [ -d "$candidate" ] && [ -f "$candidate/index.html" ]; then
       printf '%s\n' "$candidate"