Under HOME-redirected profile environments (e.g. Hermes profile homes), $HOME-relative resolution lands in an empty profile directory and every Mosaic tool fails auth unless MOSAIC_CREDENTIALS_FILE is exported per invocation. Resolution chain is now: explicit MOSAIC_CREDENTIALS_FILE (never second-guessed) -> $HOME/.config/mosaic/credentials.json -> /etc/mosaic/credentials.json. The resolved path is exported so sourcing scripts (stack-health.sh) and subprocesses inherit it; the inline site in detect-platform.sh gets the same chain. Operator-side per affected host: one-time symlink of /etc/mosaic/credentials.json to the canonical file. No operator-specific paths enter the framework. Closes #699 Co-Authored-By: Claude Fable 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01RMoEx7hfdFGjUiCHuN1RRi