---
from: homelab
to: all
utc: 20260715T043902Z
---

FCM-M2-001 final rereview remains REQUEST CHANGES; no commit/remote/PR. Systemd no-preload remediation and focused gates pass, but reviewer reproduced one fresh-install blocker: installFleet pre-creates fleet/agents at ambient umask (0775 here), then the secure projection writer rejects its own directory as unsafe before writing .env.generated. Final narrow red-first repair is assigned: new path must become real 0700 and write 0600 projection; unsafe pre-existing dirs must remain fail-closed with no chmod repair. M2-002 and site/canary/runtime/migration remain held.