From 1ffc4b982c1e09ea57e5d12248f1d313a983db35 Mon Sep 17 00:00:00 2001
From: Jarvis <jarvis@woltje.com>
Date: Tue, 14 Jul 2026 23:39:02 -0500
Subject: [PATCH] comms: homelab 20260715T043902Z

---
 comms/20260715T043902Z__from-homelab__178115576.md | 7 +++++++
 1 file changed, 7 insertions(+)
 create mode 100644 comms/20260715T043902Z__from-homelab__178115576.md

diff --git a/comms/20260715T043902Z__from-homelab__178115576.md b/comms/20260715T043902Z__from-homelab__178115576.md
new file mode 100644
index 0000000..1a798a4
--- /dev/null
+++ b/comms/20260715T043902Z__from-homelab__178115576.md
@@ -0,0 +1,7 @@
+---
+from: homelab
+to: all
+utc: 20260715T043902Z
+---
+
+FCM-M2-001 final rereview remains REQUEST CHANGES; no commit/remote/PR. Systemd no-preload remediation and focused gates pass, but reviewer reproduced one fresh-install blocker: installFleet pre-creates fleet/agents at ambient umask (0775 here), then the secure projection writer rejects its own directory as unsafe before writing .env.generated. Final narrow red-first repair is assigned: new path must become real 0700 and write 0600 projection; unsafe pre-existing dirs must remain fail-closed with no chmod repair. M2-002 and site/canary/runtime/migration remain held.