chore(deps): update non-major dependencies #9

.ai/conventions/data.md

@@ -40,6 +40,11 @@ Authorization. Auth endpoints исключены из Bearer/retry middleware. R
 координируется single-flight; после `401` с `UNAUTHORIZED` возможен один retry.
 Не добавляй собственный refresh/retry loop в caller.
 
+Refresh, завершившийся `401`, очищает session. Сетевая ошибка и `5xx`
+(например, деплой backend) не доказывают конец session: она сохраняется,
+`unavailable` показывает retry-экран вместо login, а следующий `401` снова
+запускает refresh. Retry/backoff внутри refresh не добавляется.
+
 Cookie-writing requests упорядочены только в текущей вкладке. Cross-tab auth
 synchronization не требуется; допустим reload/re-login. Web Locks и отдельные
 token stores не добавляются.

.nvmrc

@@ -1 +1 @@
-24.21.0
+24.22.1

Dockerfile

@@ -1,4 +1,4 @@
-FROM node:24.21.0-bookworm-slim AS dependencies
+FROM node:24.22.1-bookworm-slim AS dependencies
 WORKDIR /app
 ENV HUSKY=0
 COPY package.json package-lock.json ./
@@ -19,7 +19,7 @@ COPY . .
 ENV VITE_API_BASE_URL=""
 RUN npm run build
 
-FROM nginx:1.28.0-alpine AS production
+FROM nginx:1.31.8-alpine AS production
 ARG VERSION
 ARG REVISION
 LABEL org.opencontainers.image.version=$VERSION \

package.json

@@ -4,7 +4,7 @@
 	"version": "1.2.0",
 	"type": "module",
 	"engines": {
-		"node": "24.21.0"
+		"node": "24.22.1"
 	},
 	"scripts": {
 		"dev": "npm run build:packages && vite",
@@ -37,89 +37,94 @@
 		"*.{js,mjs,cjs,ts,tsx}": "eslint --fix --max-warnings=0 --no-warn-ignored"
 	},
 	"dependencies": {
-		"@hookform/resolvers": "5.9.1",
-		"@mantine/charts": "9.6.1",
-		"@mantine/core": "9.6.1",
-		"@mantine/dates": "9.6.1",
-		"@mantine/hooks": "9.6.1",
-		"@mantine/notifications": "9.6.1",
-		"@tanstack/react-query": "5.102.8",
+		"@hookform/resolvers": "5.9.2",
+		"@mantine/charts": "9.7.3",
+		"@mantine/core": "9.7.3",
+		"@mantine/dates": "9.7.3",
+		"@mantine/hooks": "9.7.3",
+		"@mantine/notifications": "9.7.3",
+		"@tanstack/react-query": "5.104.5",
 		"@wealthledger/icons": "file:packages/icons",
 		"@wealthledger/tokens": "file:packages/tokens",
 		"@wealthledger/ui": "file:packages/ui",
 		"dayjs": "1.11.23",
-		"i18next": "26.4.2",
-		"motion": "13.2.0",
+		"i18next": "26.5.10",
+		"motion": "13.5.1",
 		"openapi-fetch": "0.17.0",
 		"openapi-react-query": "0.5.4",
-		"react": "19.3.0",
-		"react-dom": "19.3.0",
-		"react-hook-form": "7.88.0",
-		"react-i18next": "17.0.14",
-		"react-is": "19.3.0",
-		"react-router": "8.3.1",
+		"react": "19.3.1",
+		"react-dom": "19.3.1",
+		"react-hook-form": "7.91.0",
+		"react-i18next": "17.1.8",
+		"react-is": "19.3.1",
+		"react-router": "8.5.0",
 		"recharts": "3.10.1",
-		"zod": "4.6.4"
+		"zod": "4.6.7"
 	},
 	"devDependencies": {
-		"@babel/core": "8.0.5",
-		"@commitlint/cli": "21.2.2",
-		"@commitlint/config-conventional": "21.2.2",
-		"@eslint-react/eslint-plugin": "5.21.0",
+		"@babel/core": "8.0.9",
+		"@commitlint/cli": "21.2.4",
+		"@commitlint/config-conventional": "21.2.4",
+		"@eslint-react/eslint-plugin": "5.28.8",
 		"@eslint/js": "10.0.1",
-		"@release-it/conventional-changelog": "12.0.0",
+		"@release-it/conventional-changelog": "12.0.2",
 		"@rolldown/plugin-babel": "0.2.4",
-		"@storybook/addon-docs": "10.6.0",
-		"@storybook/react-vite": "10.6.0",
+		"@storybook/addon-docs": "10.6.3",
+		"@storybook/react-vite": "10.6.3",
 		"@stylistic/eslint-plugin": "5.10.0",
-		"@tanstack/eslint-plugin-query": "5.104.0",
+		"@tanstack/eslint-plugin-query": "5.104.5",
 		"@testing-library/jest-dom": "7.0.1",
 		"@testing-library/react": "16.3.3",
-		"@types/node": "24.13.4",
+		"@types/node": "24.19.2",
 		"@types/react": "19.3.0",
 		"@types/react-dom": "19.3.0",
-		"@vitejs/plugin-react": "6.1.1",
-		"@vitest/browser-playwright": "5.0.0",
-		"@vitest/coverage-v8": "5.0.0",
+		"@vitejs/plugin-react": "6.1.2",
+		"@vitest/browser": "5.0.5",
+		"@vitest/browser-playwright": "5.0.5",
+		"@vitest/coverage-v8": "5.0.5",
 		"@vitest/eslint-plugin": "1.6.27",
+		"@vitest/ui": "5.0.5",
 		"babel-plugin-react-compiler": "1.0.0",
-		"conventional-changelog-conventionalcommits": "10.4.0",
-		"dependency-cruiser": "18.2.0",
-		"eslint": "10.11.0",
+		"conventional-changelog-conventionalcommits": "10.4.1",
+		"dependency-cruiser": "18.7.0",
+		"eslint": "10.13.0",
 		"eslint-import-resolver-typescript": "4.4.5",
 		"eslint-plugin-import-x": "4.17.1",
 		"eslint-plugin-jest-dom": "5.10.1",
 		"eslint-plugin-no-unsanitized": "4.1.5",
-		"eslint-plugin-perfectionist": "5.12.1",
+		"eslint-plugin-perfectionist": "5.13.0",
 		"eslint-plugin-react-hooks": "7.1.1",
 		"eslint-plugin-react-refresh": "0.5.7",
 		"eslint-plugin-regexp": "3.3.1",
-		"eslint-plugin-security": "4.1.0",
-		"eslint-plugin-sonarjs": "4.2.1",
-		"eslint-plugin-storybook": "10.6.0",
+		"eslint-plugin-security": "4.2.0",
+		"eslint-plugin-sonarjs": "4.2.2",
+		"eslint-plugin-storybook": "10.6.3",
 		"eslint-plugin-testing-library": "7.16.2",
 		"eslint-plugin-unicorn": "76.0.0",
-		"globals": "17.12.0",
+		"globals": "17.13.0",
 		"husky": "9.1.7",
-		"jsdom": "30.0.1",
-		"knip": "6.35.1",
-		"lint-staged": "17.5.1",
+		"jsdom": "30.1.3",
+		"knip": "6.43.0",
+		"lint-staged": "17.6.0",
 		"msw": "2.15.0",
 		"openapi-typescript": "7.13.0",
-		"playwright": "1.63.0",
-		"release-it": "21.0.2",
-		"storybook": "10.6.0",
+		"playwright": "1.64.1",
+		"release-it": "21.1.1",
+		"storybook": "10.6.3",
 		"typescript": "5.9.3",
-		"typescript-eslint": "8.70.1",
-		"vite": "8.3.0",
+		"typescript-eslint": "8.72.0",
+		"vite": "8.3.5",
 		"vite-plugin-pwa": "1.3.0",
-		"vitest": "5.0.0"
+		"vitest": "5.0.5"
 	},
 	"overrides": {
 		"release-it": {
-			"basic-ftp": "6.2.1",
-			"undici": "7.29.1"
-		}
+			"basic-ftp": "6.2.3",
+			"undici": "8.12.3"
+		},
+		"@vitest/browser": "5.0.5",
+		"@vitest/ui": "5.0.5",
+		"@vitest/mocker": "5.0.5"
 	},
 	"allowScripts": {
 		"esbuild@0.28.2": true,

packages/icons/package.json

@@ -20,14 +20,14 @@
 		"build": "vite build && tsc -p tsconfig.json"
 	},
 	"peerDependencies": {
-		"react": "19.3.0"
+		"react": "19.3.1"
 	},
 	"devDependencies": {
-		"@storybook/react-vite": "10.6.0",
+		"@storybook/react-vite": "10.6.3",
 		"@testing-library/react": "16.3.3",
 		"@types/react": "19.3.0",
 		"typescript": "5.9.3",
-		"vite": "8.3.0",
-		"vitest": "5.0.0"
+		"vite": "8.3.5",
+		"vitest": "5.0.5"
 	}
 }

packages/ui/package.json

@@ -27,18 +27,18 @@
 		"@wealthledger/tokens": "0.3.0"
 	},
 	"peerDependencies": {
-		"@mantine/core": "9.6.1",
-		"@mantine/hooks": "9.6.1",
-		"react": "19.3.0",
-		"react-dom": "19.3.0"
+		"@mantine/core": "9.7.3",
+		"@mantine/hooks": "9.7.3",
+		"react": "19.3.1",
+		"react-dom": "19.3.1"
 	},
 	"devDependencies": {
-		"@storybook/react-vite": "10.6.0",
+		"@storybook/react-vite": "10.6.3",
 		"@testing-library/react": "16.3.3",
 		"@types/react": "19.3.0",
-		"storybook": "10.6.0",
+		"storybook": "10.6.3",
 		"typescript": "5.9.3",
-		"vite": "8.3.0",
-		"vitest": "5.0.0"
+		"vite": "8.3.5",
+		"vitest": "5.0.5"
 	}
 }

src/app/routes/AppRoutes/AppRoutes.test.tsx

@@ -190,6 +190,30 @@ describe("AppRoutes", () => {
 		expect(document.title).toBe("Карты — WealthLedger");
 	});
 
+	it("offers a retry instead of the login form while the server is unreachable, then restores the route", async () => {
+		let isOutage = true;
+		server.use(
+			http.post("*/api/v1/auth/refresh", () =>
+				isOutage
+					? new HttpResponse(null, { status: 502 })
+					: HttpResponse.json({
+							accessToken: "test-token",
+							user: { email: "user@example.com", id: "user-1" },
+						}),
+			),
+		);
+		renderRoutes("/accounts");
+
+		expect(await screen.findByRole("alert")).toHaveTextContent("Не удалось подключиться");
+		expect(screen.queryByRole("heading", { name: "Вход" })).not.toBeInTheDocument();
+		isOutage = false;
+		fireEvent.click(screen.getByRole("button", { name: "Повторить" }));
+
+		expect(
+			await screen.findByRole("heading", { level: 2, name: "Нет инвестиционных счетов" }),
+		).toBeVisible();
+	});
+
 	it("lazy-loads the protected shell for an authenticated accounts route", async () => {
 		server.use(
 			http.post("*/api/v1/auth/refresh", () =>

src/app/routes/RouteErrorBoundary/RouteErrorBoundary.tsx

@@ -10,7 +10,6 @@ import { useAuth } from "@/features/auth";
 
 type BoundaryProps = PropsWithChildren<{
 	authenticated: boolean;
-	routeKey: string;
 }>;
 
 type RouteErrorFallbackProps = {
@@ -26,12 +25,6 @@ class Boundary extends Component<BoundaryProps, State> {
 
 	override state: State = { hasError: false };
 
-	override componentDidUpdate(previousProps: BoundaryProps) {
-		if (previousProps.routeKey !== this.props.routeKey && this.state.hasError) {
-			this.setState({ hasError: false });
-		}
-	}
-
 	override render() {
 		return this.state.hasError
 			? <RouteErrorFallback authenticated={this.props.authenticated} />
@@ -70,10 +63,7 @@ const RouteErrorBoundary: FC<PropsWithChildren> = (props) => {
 	const { user } = useAuth();
 
 	return (
-		<Boundary
-			authenticated={Boolean(user)}
-			routeKey={`${pathname}${search}:${key}`}
-		>
+		<Boundary authenticated={Boolean(user)} key={`${pathname}${search}:${key}`}>
 			{children}
 		</Boundary>
 	);

src/app/routes/RouteGuards.tsx

@@ -1,4 +1,7 @@
+import { Button, Container } from "@mantine/core";
+import { StateView } from "@wealthledger/ui";
 import { type FC, type PropsWithChildren, useState } from "react";
+import { useTranslation } from "react-i18next";
 import { Navigate, useLocation } from "react-router";
 
 import { useAuth } from "@/features/auth";
@@ -7,12 +10,26 @@ import { RouteSkeleton } from "./RouteFallback";
 
 const Protected: FC<PropsWithChildren> = (props) => {
 	const { children } = props;
-	const { ready, signedOut, user } = useAuth();
+	const { ready, retry, signedOut, unavailable, user } = useAuth();
+	const { t } = useTranslation();
 	const location = useLocation();
 	const [wasAuthenticated, setWasAuthenticated] = useState(false);
 	if (user && !wasAuthenticated) setWasAuthenticated(true);
 	if (!ready) return <RouteSkeleton variant="shell" />;
 
+	// The server was unreachable (e.g. mid-deploy), so the session is unproven, not gone.
+	if (!user && unavailable)
+		return (
+			<Container py="xl" size={560}>
+				<StateView
+					action={<Button onClick={retry}>{t("auth.retry")}</Button>}
+					error
+					text={t("auth.unavailableText")}
+					title={t("auth.unavailableTitle")}
+				/>
+			</Container>
+		);
+
 	const loginState = signedOut && wasAuthenticated
 		? undefined
 		: { returnTo: `${location.pathname}${location.search}` };

src/features/auth/model/auth-context.ts

@@ -7,7 +7,12 @@ type AuthContextValue = {
 	logout: () => Promise<void>;
 	ready: boolean;
 	register: (email: string, password: string) => Promise<void>;
+	retry: () => void;
 	signedOut: boolean;
+	/**
+	Refresh failed with a network error or 5xx; the refresh cookie may still be valid.
+	*/
+	unavailable: boolean;
 	user: undefined | User;
 };
 

src/features/auth/model/auth.test.tsx

@@ -92,8 +92,10 @@ describe("AuthProvider", () => {
 		);
 	});
 
-	it("settles unauthenticated and clears cached data when cold-start refresh has a transport error", async () => {
-		server.use(http.post("*/api/v1/auth/refresh", () => HttpResponse.error()));
+	it("settles unauthenticated and clears cached data when cold-start refresh is rejected with 401", async () => {
+		server.use(http.post("*/api/v1/auth/refresh", () =>
+			HttpResponse.json({ code: "UNAUTHORIZED" }, { status: 401 }),
+		));
 		const queryClient = createTestQueryClient();
 		queryClient.setQueryData(["cached-query"], { value: "stale" });
 		queryClient.setQueryData(bankCardsKey, [{ id: "bank-card-1" }]);
@@ -103,12 +105,54 @@ describe("AuthProvider", () => {
 		await waitFor(() => expect(result.current.ready).toBe(true));
 
 		expect(result.current.user).toBeUndefined();
+		expect(result.current.unavailable).toBe(false);
 		expect(await requestAuthorization()).toBeNull();
 		expect(queryClient.getQueryData(["cached-query"])).toBeUndefined();
 		expect(queryClient.getQueryData(bankCardsKey)).toBeUndefined();
 	});
 
-	it("keeps the original protected 401 when serialized refresh has a transport error", async () => {
+	it.each([
+		["a transport error", () => HttpResponse.error()],
+		["a 502 from the proxy", () => new HttpResponse(null, { status: 502 })],
+		["a 503 problem", () => HttpResponse.json({ code: "INTERNAL_SERVER_ERROR" }, { status: 503 })],
+	])("settles as unavailable and keeps cached data when cold-start refresh gets %s", async (_name, failure) => {
+		server.use(http.post("*/api/v1/auth/refresh", failure));
+		const queryClient = createTestQueryClient();
+		queryClient.setQueryData(["cached-query"], { value: "kept" });
+		const wrapper: FC<PropsWithChildren> = createAuthWrapper(queryClient);
+		const { result } = renderHook(() => useAuth(), { wrapper });
+
+		await waitFor(() => expect(result.current.ready).toBe(true));
+
+		expect(result.current.user).toBeUndefined();
+		expect(result.current.unavailable).toBe(true);
+		expect(queryClient.getQueryData(["cached-query"])).toEqual({ value: "kept" });
+	});
+
+	it("restores the session when retry succeeds after an outage", async () => {
+		let isOutage = true;
+		server.use(http.post("*/api/v1/auth/refresh", () =>
+			isOutage
+				? new HttpResponse(null, { status: 502 })
+				: HttpResponse.json({
+						accessToken: "restored-token",
+						user: { email: "user@example.com", id: "user-1" },
+					}),
+		));
+		const queryClient = createTestQueryClient();
+		const wrapper: FC<PropsWithChildren> = createAuthWrapper(queryClient);
+		const { result } = renderHook(() => useAuth(), { wrapper });
+
+		await waitFor(() => expect(result.current.unavailable).toBe(true));
+		isOutage = false;
+		act(() => result.current.retry());
+
+		await waitFor(() => expect(result.current.user?.id).toBe("user-1"));
+		expect(result.current.unavailable).toBe(false);
+		expect(await requestAuthorization()).toBe("Bearer restored-token");
+	});
+
+	it("keeps the original protected 401 and the session when serialized refresh has a transport error", async () => {
 		let refreshCalls = 0;
 		server.use(
 			http.post("*/api/v1/auth/refresh", () => {
@@ -137,10 +181,11 @@ describe("AuthProvider", () => {
 		const response = await apiClient.GET("/api/v1/brokerage-accounts");
 
 		expect(response.response.status).toBe(401);
-		await waitFor(() => expect(result.current.user).toBeUndefined());
-		expect(await requestAuthorization()).toBeNull();
-		expect(queryClient.getQueryData(["cached-query"])).toBeUndefined();
-		expect(queryClient.getQueryData(bankCardsKey)).toBeUndefined();
+		// An unreachable server does not prove the session ended; the next 401 refreshes again.
+		await waitFor(() => expect(result.current.unavailable).toBe(true));
+		expect(result.current.user?.id).toBe("user-1");
+		expect(queryClient.getQueryData(["cached-query"])).toEqual({ value: "stale" });
+		expect(queryClient.getQueryData(bankCardsKey)).toEqual([{ id: "bank-card-1" }]);
 	});
 
 	it("clears connection status and financial cache independently on logout", async () => {

src/features/auth/model/auth.vm.ts

@@ -5,6 +5,9 @@ import { apiClient, configureAuthClient, type paths } from "@/shared/api";
 
 import { type User } from "./auth-context";
 
+// A 5xx or network error means the server is unreachable, not that the session ended.
+const HTTP_SERVER_ERROR = 500;
+
 type Authentication
 	= paths["/api/v1/auth/login"]["post"]["responses"][200]["content"]["application/json"];
 
@@ -32,6 +35,8 @@ function useAuthProviderVm() {
 	const accessTokenRef = useRef<string | undefined>(undefined);
 	const [ready, setReady] = useState(false);
 	const [signedOut, setSignedOut] = useState(false);
+	const [unavailable, setUnavailable] = useState(false);
+	const unavailableRef = useRef(false);
 
 	const generationRef = useRef(0);
 	const userRef = useRef<undefined | User>(undefined);
@@ -49,12 +54,18 @@ function useAuthProviderVm() {
 		return next;
 	}, []);
 
+	const markUnavailable = useCallback((isUnavailable: boolean) => {
+		unavailableRef.current = isUnavailable;
+		setUnavailable(isUnavailable);
+	}, []);
+
 	const applyAuthentication = useCallback(
 		(authentication: Authentication) => {
 			const changedIdentity
 				= userRef.current && userRef.current.id !== authentication.user.id;
 
 			setSignedOut(false);
+			markUnavailable(false);
 			accessTokenRef.current = authentication.accessToken;
 
 			if (changedIdentity) {
@@ -67,16 +78,17 @@ function useAuthProviderVm() {
 			userRef.current = authentication.user;
 			setUser(authentication.user);
 		},
-		[queryClient],
+		[markUnavailable, queryClient],
 	);
 
 	const clearSession = useCallback(() => {
+		markUnavailable(false);
 		generationRef.current += 1;
 		userRef.current = undefined;
 		setUser(undefined);
 		accessTokenRef.current = undefined;
 		queryClient.clear();
-	}, [queryClient]);
+	}, [markUnavailable, queryClient]);
 
 	const refresh = useCallback((): Promise<boolean> => {
 		if (refreshPromiseRef.current) return refreshPromiseRef.current;
@@ -86,11 +98,12 @@ function useAuthProviderVm() {
 			if (started !== generationRef.current) return false;
 
 			try {
-				const { data } = await apiClient.POST("/api/v1/auth/refresh");
+				const { data, response } = await apiClient.POST("/api/v1/auth/refresh");
 				if (started !== generationRef.current) return false;
 
 				if (!data) {
-					clearSession();
+					if (response.status >= HTTP_SERVER_ERROR) markUnavailable(true);
+					else clearSession();
 
 					return false;
 				}
@@ -100,7 +113,7 @@ function useAuthProviderVm() {
 				return true;
 			}
 			catch {
-				if (started === generationRef.current) clearSession();
+				if (started === generationRef.current) markUnavailable(true);
 
 				return false;
 			}
@@ -112,7 +125,7 @@ function useAuthProviderVm() {
 		refreshPromiseRef.current = pending;
 
 		return pending;
-	}, [applyAuthentication, clearSession, serialize]);
+	}, [applyAuthentication, clearSession, markUnavailable, serialize]);
 
 	useEffect(() => {
 		void refresh().finally(() => setReady(true));
@@ -146,6 +159,7 @@ function useAuthProviderVm() {
 			clear: clearSession,
 			generation: () => generationRef.current,
 			refresh,
+			unavailable: () => unavailableRef.current,
 		});
 	});
 	useEffect(() => () => configureAuthClient(), []);
@@ -157,7 +171,9 @@ function useAuthProviderVm() {
 		ready,
 		register: (email: string, password: string) =>
 			authenticate("/api/v1/auth/register", email, password),
+		retry: () => void refresh(),
 		signedOut,
+		unavailable,
 		user,
 	};
 

src/pages/account-events/ui/AccountEventsPage/AccountEventsPage.filters.test.tsx

@@ -17,7 +17,7 @@ import {
 	useLocation,
 	useNavigate,
 } from "react-router";
-import { beforeEach, describe, expect, it, vi } from "vitest";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
 import { configureAuthClient } from "@/shared/api";
 import { defaultPeriod, formatDate, moscowDate } from "@/shared/lib";
@@ -72,7 +72,14 @@ function renderEvents(accountId: string, searches: string[]) {
 }
 
 describe("Upcoming event date filters", () => {
+	afterEach(() => {
+		vi.useRealTimers();
+	});
 	beforeEach(() => {
+		// Pin "today": the test picks today + 10 days, which must be inside the visible calendar grid.
+		// Real dates can push it beyond the grid (e.g. 2026-10-23 -> 2 November).
+		vi.useFakeTimers({ toFake: ["Date"] });
+		vi.setSystemTime(new Date("2026-08-10T09:00:00Z"));
 		configureAuthClient({
 			accessToken: () => "token",
 			clear: vi.fn(),
@@ -80,6 +87,8 @@ describe("Upcoming event date filters", () => {
 		});
 	});
 
+	afterEach(() => vi.useRealTimers());
+
 	it("keeps reads and sync disabled without an account scope", async () => {
 		const requests: string[] = [];
 		server.use(
@@ -229,6 +238,10 @@ describe("Upcoming event date filters", () => {
 	it.each(["account-1", "all"])(
 		"applies dates only on submit, restores URL dates, and resets from empty results for %s",
 		async (accountId) => {
+			// Pin "today" mid-month so "today + 10 days" stays in the calendar's
+			// visible month regardless of the real date.
+			vi.useFakeTimers({ toFake: ["Date"] });
+			vi.setSystemTime(new Date("2026-10-15T12:00:00+03:00"));
 			const [defaultFrom, defaultTo] = defaultPeriod();
 			const searches: string[] = [];
 			server.use(

src/pages/stock/ui/StockPage/StockPage.test.tsx

@@ -413,7 +413,9 @@ describe("stock page", () => {
 		expect(await screen.findByText("Продажа")).toBeVisible();
 		expect(screen.getByText("2 шт.")).toBeVisible();
 		expect(screen.getByText("Цена: 100 ₽")).toBeVisible();
-		expect(screen.getByText(/02.01.2022, 10:00 UTC/)).toBeVisible();
+		const snapshotTime = new Intl.DateTimeFormat("ru-RU", { dateStyle: "short", timeStyle: "short" });
+		const operationTime = snapshotTime.format(new Date("2022-01-02T10:00:00Z"));
+		expect(screen.getByText(operationTime, { exact: false })).toBeVisible();
 		expect(
 			requests.some(
 				url =>

src/pages/stocks/ui/StocksPage/StocksPage.test.tsx

@@ -93,7 +93,9 @@ describe("stock search", () => {
 		expect(
 			await screen.findByRole("link", { name: /Сбербанк/ }),
 		).toHaveAttribute("href", "/stocks/e6123145-9665-43e0-8413-cd61b8aa9b13");
-		expect(screen.getByText("Список получен 10.10.2026, 10:00")).toBeVisible();
+		const snapshotTime = new Intl.DateTimeFormat("ru-RU", { dateStyle: "short", timeStyle: "short" });
+		const fetchedAt = snapshotTime.format(new Date("2026-10-10T10:00:00Z"));
+		expect(screen.getByText(`Список получен ${fetchedAt}`)).toBeVisible();
 		expect(screen.getByText("Лот: 10 шт.")).toBeVisible();
 		expect(screen.getByText("ISIN: RU0009029540")).toBeVisible();
 		expect(screen.getAllByText("Мосбиржа")[0]).toBeVisible();

src/shared/api/client.test.ts

@@ -67,6 +67,25 @@ describe("apiClient authentication", () => {
 		expect(clear).toHaveBeenCalledOnce();
 	});
 
+	it("keeps the session when refresh failed because the server was unreachable", async () => {
+		const clear = vi.fn();
+		server.use(
+			http.get("*/api/v1/brokerage-accounts", () =>
+				HttpResponse.json({ code: "UNAUTHORIZED" }, { status: 401 }),
+			),
+		);
+		configureAuthClient({
+			accessToken: () => "expired",
+			clear,
+			refresh: () => Promise.resolve(false),
+			unavailable: () => true,
+		});
+
+		await apiClient.GET("/api/v1/brokerage-accounts");
+
+		expect(clear).not.toHaveBeenCalled();
+	});
+
 	it("does not attach Bearer auth to authentication endpoints", async () => {
 		let authorization: null | string
 

src/shared/api/client.ts

@@ -32,6 +32,10 @@ type AuthHandlers = {
 	clear: () => void;
 	generation?: () => number;
 	refresh: () => Promise<boolean>;
+	/**
+	True after a refresh failed transiently (network/5xx): the session is not proven gone.
+	*/
+	unavailable?: () => boolean;
 };
 
 type ReadAttempt = {
@@ -100,7 +104,8 @@ async function authenticatedFetch(request: Request): Promise<Response> {
 	if (!isCurrent()) throw new DOMException("Session changed", "AbortError");
 
 	if (!(await sessionState.handlers.refresh())) {
-		if (isCurrent()) sessionState.handlers.clear();
+		if (isCurrent() && !sessionState.handlers.unavailable?.())
+			sessionState.handlers.clear();
 
 		return response;
 	}

src/shared/i18n/locales/ru.ts

@@ -53,6 +53,9 @@ const ru = {
 			passwordConfirmation: "Подтвердите пароль",
 			register: "Регистрация",
 			requestError: "Не удалось выполнить запрос. Попробуйте ещё раз.",
+			retry: "Повторить",
+			unavailableText: "Сервер временно недоступен. Ваш вход сохранён, попробуйте через минуту.",
+			unavailableTitle: "Не удалось подключиться",
 			validation: {
 				invalidEmail: "Некорректный email",
 				invalidPasswordLength: "Пароль: от 8 до 72 символов, только латинские буквы, цифры, спецсимволы и пробел",
@@ -417,7 +420,7 @@ const ru = {
 			next: "Далее",
 			noInstrument: "Без инструмента",
 			noMoney: "Без движения денег",
-			occurredAt: "{{date}} UTC",
+			occurredAt: "{{date}}",
 			open: "Открыть журнал",
 			operationType: {
 				buy: "Покупка",
@@ -629,7 +632,7 @@ const ru = {
 			position: "Моя позиция",
 			previous: "Назад",
 			price: "Цена",
-			priceAt: "Цена на {{date}} UTC",
+			priceAt: "Цена на {{date}}",
 			priceTable: "Цены в таблице",
 			priceTableHint: "Дневные закрытия · записей: {{count}} · сначала новые",
 			priceUnavailable: "Цена недоступна",
@@ -718,7 +721,7 @@ const ru = {
 				SHARE_TYPE_GDR: "Депозитарная расписка",
 				SHARE_TYPE_PREFERRED: "Привилегированная акция",
 			},
-			snapshotAt: "Позиция на {{date}} UTC",
+			snapshotAt: "Позиция на {{date}}",
 			trading: {
 				SECURITY_TRADING_STATUS_BREAK_IN_TRADING: "Перерыв в торгах",
 				SECURITY_TRADING_STATUS_CLOSING_AUCTION: "Аукцион закрытия",

src/shared/lib/display.test.ts

@@ -12,9 +12,16 @@ describe("shared display helpers", () => {
 		expect(formatDate("2027-09-10")).toBe("10.09.2027");
 		expect(formatDate("2024-02-29")).toBe("29.02.2024");
 		expect(formatDate("2027-09-10T00:30:00+03:00")).toBe("09.09.2027");
-		expect(formatSnapshotTime("2027-09-10T00:30:00+03:00")).toBe(
-			"09.09.2027, 21:30",
-		);
+	});
+	it("formats snapshot time in the browser time zone", () => {
+		const instant = "2027-09-10T00:30:00+03:00";
+
+		const expected = new Intl.DateTimeFormat("ru-RU", {
+			dateStyle: "short",
+			timeStyle: "short",
+		}).format(new Date(instant));
+
+		expect(formatSnapshotTime(instant)).toBe(expected);
 	});
 	it("formats decimal strings without financial arithmetic", () => {
 		expect(formatMoney({ currency: "RUB", value: "-1234567.89" })).toBe(

src/shared/lib/display.ts

@@ -61,10 +61,10 @@ function formatMoney(
 	return `${formatDecimal(decimal)} ${currency}`;
 }
 
+// Без timeZone Intl берёт часовой пояс браузера пользователя.
 const snapshotFormatter = new Intl.DateTimeFormat("ru-RU", {
 	dateStyle: "short",
 	timeStyle: "short",
-	timeZone: "UTC",
 });
 
 function formatSnapshotTime(value: string): string {