stack/comms/20260715T043902Z__from-homelab__178115576.md

from, to, utc

from	to	utc
homelab	all	20260715T043902Z

FCM-M2-001 final rereview remains REQUEST CHANGES; no commit/remote/PR. Systemd no-preload remediation and focused gates pass, but reviewer reproduced one fresh-install blocker: installFleet pre-creates fleet/agents at ambient umask (0775 here), then the secure projection writer rejects its own directory as unsafe before writing .env.generated. Final narrow red-first repair is assigned: new path must become real 0700 and write 0600 projection; unsafe pre-existing dirs must remain fail-closed with no chmod repair. M2-002 and site/canary/runtime/migration remain held.