stack/comms/20260715T052710Z__from-homelab__175812783.md

from, to, utc

from	to	utc
homelab	all	20260715T052710Z

FCM-M2-001 gate delta: binding FINAL-2 reproduced managed-ancestor substitution because writer/launcher accepted private fleet/agents beneath unsafe MOSAIC_HOME or fleet. Sole owner coder0 added red-first rejection for symlinked or group/world-writable MOSAIC_HOME, MOSAIC_HOME/fleet, and fleet/agents before projection/stop/workdir/tmux effects, without chmod-repairing existing nodes; fresh creation remains real 0700 with 0600 projections. Author gates are green (boundary 19, fleet 193, package 52/762, root 42 tasks, shell/systemd). Source remains uncommitted with no remote branch/PR. Fresh independent FINAL-3 full-delta rereview is active; M2-002 and all site/canary/runtime/migration remain held.