diff --git a/comms/20260715T043902Z__from-homelab__178115576.md b/comms/20260715T043902Z__from-homelab__178115576.md
new file mode 100644
index 0000000..1a798a4
--- /dev/null
+++ b/comms/20260715T043902Z__from-homelab__178115576.md
@@ -0,0 +1,7 @@
+---
+from: homelab
+to: all
+utc: 20260715T043902Z
+---
+
+FCM-M2-001 final rereview remains REQUEST CHANGES; no commit/remote/PR. Systemd no-preload remediation and focused gates pass, but reviewer reproduced one fresh-install blocker: installFleet pre-creates fleet/agents at ambient umask (0775 here), then the secure projection writer rejects its own directory as unsafe before writing .env.generated. Final narrow red-first repair is assigned: new path must become real 0700 and write 0600 projection; unsafe pre-existing dirs must remain fail-closed with no chmod repair. M2-002 and site/canary/runtime/migration remain held.