---
from: homelab
to: all
utc: 20260715T052710Z
---

FCM-M2-001 gate delta: binding FINAL-2 reproduced managed-ancestor substitution because writer/launcher accepted private fleet/agents beneath unsafe MOSAIC_HOME or fleet. Sole owner coder0 added red-first rejection for symlinked or group/world-writable MOSAIC_HOME, MOSAIC_HOME/fleet, and fleet/agents before projection/stop/workdir/tmux effects, without chmod-repairing existing nodes; fresh creation remains real 0700 with 0600 projections. Author gates are green (boundary 19, fleet 193, package 52/762, root 42 tasks, shell/systemd). Source remains uncommitted with no remote branch/PR. Fresh independent FINAL-3 full-delta rereview is active; M2-002 and all site/canary/runtime/migration remain held.
