diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
index cbf8304..ba92cdc 100644
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-build.yml
@@ -16,6 +16,16 @@ on:
       # This file defines the build itself: change the docker build command,
       # a --build-context or a --build-arg and the verification must re-run.
       - .github/workflows/docker-build.yml
+      # Neither of these is a build input; both feed the post-build check.
+      # The checker itself, so an edit to it is exercised by a build rather
+      # than first running on someone else's PR — and docker-compose.yml,
+      # which the checker DERIVES the checked directory from: move the
+      # transcript mount without touching a Dockerfile and nothing would
+      # rebuild, so nothing would re-derive. Listed here, on the ~2 minute
+      # classic build, and deliberately NOT in nix-base.yml, where it would
+      # set off an hour-long two-arch build for the same answer.
+      - dev/check-image-mount-parents
+      - docker-compose.yml
   pull_request:
     branches: [main]
     paths:
@@ -31,6 +41,16 @@ on:
       # This file defines the build itself: change the docker build command,
       # a --build-context or a --build-arg and the verification must re-run.
       - .github/workflows/docker-build.yml
+      # Neither of these is a build input; both feed the post-build check.
+      # The checker itself, so an edit to it is exercised by a build rather
+      # than first running on someone else's PR — and docker-compose.yml,
+      # which the checker DERIVES the checked directory from: move the
+      # transcript mount without touching a Dockerfile and nothing would
+      # rebuild, so nothing would re-derive. Listed here, on the ~2 minute
+      # classic build, and deliberately NOT in nix-base.yml, where it would
+      # set off an hour-long two-arch build for the same answer.
+      - dev/check-image-mount-parents
+      - docker-compose.yml
 
 jobs:
   build:
@@ -45,3 +65,11 @@ jobs:
             --build-arg DEV_CONTAINER_WORKSPACE=/workspaces/src \
             -t devcontainer-ci:test \
             .
+
+      # The image half of #106: tests/test-volume-chown-guard.sh can only read
+      # the Dockerfile text, so the fact that the built image really ships
+      # ~/.claude/projects writable by the container user is checkable only
+      # here. The checker derives both the directory and the user from
+      # docker-compose.yml and runs the mkdir the #106 report ran.
+      - name: Transcript bind parent ships writable
+        run: dev/check-image-mount-parents devcontainer-ci:test
diff --git a/.github/workflows/nix-base.yml b/.github/workflows/nix-base.yml
index c3f3a5d..170b466 100644
--- a/.github/workflows/nix-base.yml
+++ b/.github/workflows/nix-base.yml
@@ -46,6 +46,9 @@ on:
       # COPY without any COPY source changing.
       - .dockerignore
       - .github/workflows/nix-base.yml
+      # Not a build input: the post-build check. Listed so an edit to it is
+      # exercised by a build rather than first running on someone else's PR.
+      - dev/check-image-mount-parents
   pull_request:
     paths:
       - nix/base/**
@@ -62,6 +65,9 @@ on:
       # COPY without any COPY source changing.
       - .dockerignore
       - .github/workflows/nix-base.yml
+      # Not a build input: the post-build check. Listed so an edit to it is
+      # exercised by a build rather than first running on someone else's PR.
+      - dev/check-image-mount-parents
   workflow_dispatch:
 
 env:
@@ -120,6 +126,14 @@ jobs:
             -t nix-base-tail:ci .
           docker run --rm nix-base-tail:ci sh -c 'claude --version && test -x /usr/local/bin/setup-env'
 
+      # The image half of #106, per arch: the nix route pre-creates
+      # ~/.claude/projects in the tail build (the base ships the sibling home
+      # dirs but not this one), and only a built image can confirm it landed
+      # writable. Same checker as docker-build.yml; it derives the directory
+      # and the user from docker-compose.yml.
+      - name: Transcript bind parent ships writable
+        run: dev/check-image-mount-parents nix-base-tail:ci
+
       - name: Log in to ghcr.io
         if: github.event_name != 'pull_request'
         uses: docker/login-action@v4
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index ecc86dc..1ac6a67 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -15,7 +15,7 @@ repos:
         args: [--severity=warning]
         types: [file]
         files: >-
-          ^dev/(devcontainer|devcontainer-completions|init|new-worktree|setup-worktree|cleanup-worktree|check-gitignore-agents|hooks/post-checkout)$
+          ^dev/(devcontainer|devcontainer-completions|init|new-worktree|setup-worktree|cleanup-worktree|check-gitignore-agents|check-image-mount-parents|hooks/post-checkout)$
 
   # These pins are the source of truth for CI (the pre-commit job is the only
   # CI lint gate). Keep ruff/yamllint/hadolint in sync with the in-container
diff --git a/CLAUDE.md b/CLAUDE.md
index a736924..9a01cd4 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -267,13 +267,65 @@ taxonomy and reads as `test:`.
   prevents is bounded because the glob, not the workflow, enumerates suites).
 - Container-side root logic lives in `lib/*.sh` and is INJECTED per run via
   `dc exec ... sh -c "$script" <argv0> <args...>` — a runtime input: no
-  rebuild, no fingerprint entry unless it is also COPYed
-  (`tests/test-volume-chown-guard.sh` pins the volume-perms driver line).
+  rebuild, no fingerprint entry unless it is also COPYed (test:
+  `tests/test-volume-chown-guard.sh` pins the volume-perms driver line).
 - `setup()` runs on EVERY cold start (gated only on `is_running`), so its
   steps must be idempotent and cheap. The named-volume chown is guarded by one
   owner+group stat, sound because `chown -R` is post-order: an interrupted
   walk leaves the mount point root-owned and retries next start
-  (`tests/test-volume-chown-guard.sh`).
+  (test: `tests/test-volume-chown-guard.sh`).
+- Mount-point ownership repair is dispatched on the compose mount TYPE: a
+  `volume` gets the guarded recursive chown plus its ancestors, a `bind` gets
+  ancestors ONLY, anything else gets nothing. The dispatcher never routes a
+  bind INTO the recursive branch, and the ANCESTOR WALK never chowns a bind
+  mount point nor anything under one — it can reach both,
+  which `docker-compose.yml` really does arrange (`DEV_MAIN_GIT` nests inside
+  `DEV_MAIN_TREE`, both bound at their host paths) — though only when the HOST
+  checkout sits under the container home prefix, which is not exotic: this
+  repo's own main checkout is `/home/vscode/repos/github/devcontainer`.
+  Everything at or below a bind mount point is the host side. Binds cannot
+  simply be excluded from the walk instead: the daemon creates a bind target's
+  missing parents as root exactly as it does a volume's, and that is what left
+  `~/.claude/projects` unwritable (#106)
+  (test: `tests/test-volume-chown-guard.sh`).
+- Those two sentences are about the DISPATCHER and the ANCESTOR WALK. Neither
+  says a bind is never recursed into, because it is: `chown -R` rooted at a
+  volume has no mount awareness and descends through any bind nested under
+  that volume — the transcript bind inside `claude-home`, i.e. the #106
+  topology itself (`unguarded`: predates the ancestor-walk work and is latent
+  only incidentally — both images pre-create `~/.claude` user-owned and
+  `setup_claude` re-chowns the top every up, so the guard's precondition (a
+  volume root not already user-owned) is not normally met. Closing it means
+  replacing `chown -R` with a pruned `find`, which also rewrites the
+  post-order rationale the cold-start guard rests on — filed as #115 with the
+  options. `-xdev` is the tempting variant and is worse: it stops at every
+  filesystem boundary, changing behaviour for reasons unrelated to this
+  invariant. The suite pins the current, unsafe behaviour rather than
+  asserting the safe one).
+- The chown driver reads mount points from `dc config`, so the compose query in
+  `mount_point_targets` decides what the lib ever sees; the query itself needs
+  docker, but the python snippet inside it is lifted out and run against a
+  synthetic config document (test: `tests/test-volume-chown-guard.sh`).
+- BOTH image routes pre-create the transcript bind's parent
+  (`~/.claude/projects`) and chown it to the compose `user:`, so a FRESH
+  `claude-home` volume seeds it user-owned and the daemon never creates it as
+  root. This covers what the ancestor walk cannot — the walk runs in `setup()`,
+  so an entry path that never calls `dev/devcontainer` (VS Code "Reopen in
+  Container", #43) would get #106 back — but only for a fresh volume: an
+  existing one still needs the walk, a `clean` or a `reset`. The nix route
+  carries it in the tail build, not `nix/base/flake.nix`, because a fix in the
+  base reaches nobody until a republish AND a repin (#83)
+  (`ci:` docker-build.yml and nix-base.yml run `dev/check-image-mount-parents`,
+  which derives directory and owner from `docker-compose.yml` and runs #106's
+  own `mkdir` probe against the built image; `test:
+  tests/test-volume-chown-guard.sh` holds only what keeps that check reachable
+  — both workflows invoke it, it is executable, it does not hardcode what it
+  derives, and `docker-compose.yml` is a trigger path of docker-build.yml, or a
+  compose-side move of the mount rebuilds nothing. The suite deliberately does
+  not re-derive the fact from Dockerfile text: it did, and that parser had four
+  measured fail-opens. Where a `ci:` check can observe the artefact, a hermetic
+  restatement of the same fact is not a second guard but a second thing to get
+  wrong).
 - Lock discipline: per-worktree lock on fd 9, repo-scoped build lock on fd 8;
   any helper backgrounded inside the locked region must be spawned with
   `9>&-` or it holds the worktree lock forever (`test:
diff --git a/Dockerfile b/Dockerfile
index 673ad55..0eb1bb7 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -88,7 +88,15 @@ RUN printf '. /usr/local/lib/devcontainer/claude-code-token-env.sh\n' \
 # No baked .credentials.json symlink: setup-claude seeds a private per-container
 # token into the claude-home volume from the :ro host profile store
 # (docs/adr/0001-devcontainer-private-token-isolation.md). Just create the dirs.
-RUN mkdir -p /home/vscode/.cache /home/vscode/.ssh /home/vscode/.claude \
+#
+# .claude/projects is here for a second reason: compose mounts the transcript
+# bind at .claude/projects/<key>, so the daemon creates the parent as root if
+# the image does not ship it (#106). lib/volume-perms.sh repairs that after the
+# fact, but only from setup(); shipping it here covers entry paths that never
+# run dev/devcontainer at all. A FRESH claude-home volume seeds from this path
+# — an existing one holding a root-owned projects/ still needs the walk, a
+# clean or a reset.
+RUN mkdir -p /home/vscode/.cache /home/vscode/.ssh /home/vscode/.claude/projects \
     && chown -R vscode:vscode /home/vscode/.cache /home/vscode/.ssh /home/vscode/.claude \
     && chmod 700 /home/vscode/.ssh
 
diff --git a/dev/check-image-mount-parents b/dev/check-image-mount-parents
new file mode 100755
index 0000000..9d0429f
--- /dev/null
+++ b/dev/check-image-mount-parents
@@ -0,0 +1,97 @@
+#!/usr/bin/env bash
+# CI check: the parent of the transcript bind must ship in a built image owned
+# by the container user, so the daemon never has to create it as root (#106).
+#
+# Why this is not in tests/: it needs a built image, so it cannot live in the
+# hermetic suite (tests/run-all globs tests/*.sh and would run it with no
+# docker). tests/test-volume-chown-guard.sh section 10 reads the Dockerfile
+# TEXT — that a mkdir exists and a later chown covers it — which is a proxy.
+# This runs the actual failing operation against the actual image, so it is the
+# `ci:` half of that invariant rather than a second textual restatement.
+#
+# The probe is the one from the #106 report: mkdir as the container user inside
+# the directory. A stat comparison would pass on a dir owned by a same-named
+# user with no write bit; only the mkdir answers the question that was asked.
+#
+# Both the directory and the user are DERIVED from docker-compose.yml — the
+# transcript mount's target and the service's `user:` — so nothing here is a
+# third encoding of either, and moving the mount moves this check with it.
+#
+# Usage: dev/check-image-mount-parents <image-ref>
+set -euo pipefail
+
+image="${1:-}"
+if [ -z "$image" ] || [ "$image" = "-h" ] || [ "$image" = "--help" ]; then
+    echo "usage: check-image-mount-parents <image-ref>" >&2
+    [ -n "$image" ] || exit 2
+    exit 0
+fi
+
+base="$(cd "$(dirname "$(readlink -f "$0")")/.." && pwd)"
+compose="$base/docker-compose.yml"
+[ -f "$compose" ] || {
+    echo "error: no docker-compose.yml at $compose" >&2
+    exit 1
+}
+
+# The transcript mount is the one whose target interpolates
+# DEV_CONTAINER_PROJECT_KEY: that variable is what makes the target a
+# per-project subdirectory, so its parent is the directory the daemon creates.
+target="$(awk '/^[[:space:]]*target:[[:space:]]/ && /DEV_CONTAINER_PROJECT_KEY/ {print $2}' "$compose")"
+if [ "$(printf '%s' "$target" | grep -c . || true)" != 1 ]; then
+    echo "error: expected exactly one compose target interpolating" \
+        "DEV_CONTAINER_PROJECT_KEY, got: ${target:-<none>}" >&2
+    exit 1
+fi
+parent="${target%%\$\{*}"
+parent="${parent%/}"
+case "$parent" in
+    /*/?*) ;;
+    *)
+        echo "error: derived a nonsense parent directory from $compose: '$parent'" >&2
+        exit 1
+        ;;
+esac
+
+user="$(awk '/^[[:space:]]*user:[[:space:]]/ {print $2; exit}' "$compose")"
+[ -n "$user" ] || {
+    echo "error: no 'user:' in $compose — cannot tell who must own $parent" >&2
+    exit 1
+}
+
+echo "checking $image: $parent must be writable by '$user' (derived from $(basename "$compose"))"
+
+# Pre-flight so infrastructure failures are not reported as the #106 diagnosis.
+# A missing image, or a `--user` docker cannot resolve, exits non-zero from the
+# probe below exactly as an unwritable directory does, and pointing a CI reader
+# at the wrong file is the whole cost of a check like this being wrong.
+docker image inspect "$image" >/dev/null 2>&1 || {
+    echo "::error::no such image: $image (this is a CI wiring problem, not a" \
+        "#106 regression — the build step above did not produce this tag)" >&2
+    exit 1
+}
+if ! docker run --rm --user "$user" "$image" true 2>/dev/null; then
+    echo "::error::cannot run $image as '$user' at all — the image has no such" \
+        "user, or no working entrypoint. A CI wiring problem, not a #106" \
+        "regression." >&2
+    exit 1
+fi
+
+docker run --rm "$image" sh -c "stat -c '%n %U:%G %a' '$parent'" || {
+    echo "::error::$image does not ship $parent at all. Compose mounts the" \
+        "transcript bind inside it, so the daemon will create it as root and" \
+        "the container user will not be able to create sibling project keys" \
+        "(#106)." >&2
+    exit 1
+}
+
+if ! docker run --rm --user "$user" "$image" \
+    sh -c "mkdir '$parent/.mount-parent-probe' && rmdir '$parent/.mount-parent-probe'"; then
+    echo "::error::$parent is not writable by '$user' in $image. That is the" \
+        "#106 failure: Claude cannot create a project key it was not given," \
+        "including its memory directory. Fix the mkdir/chown in the" \
+        "Dockerfile for this route." >&2
+    exit 1
+fi
+
+echo "ok: $parent ships writable by '$user'"
diff --git a/dev/devcontainer b/dev/devcontainer
index 97bcfa3..15ff181 100755
--- a/dev/devcontainer
+++ b/dev/devcontainer
@@ -778,25 +778,35 @@ require_tty() {
 # this line would silently run without the host mounts.
 generate_host_mounts_override
 
-# Named-volume mount targets from the merged compose config — these come
-# up root-owned and need chowning before user-mode setup runs. Deriving
+# Mount targets from the merged compose config, as `<kind>:<target>` — these
+# come up root-owned and need chowning before user-mode setup runs. Deriving
 # from compose means projects only declare volumes in compose.override.yml.
-named_volume_targets() {
+#
+# Binds are emitted alongside volumes because only their ANCESTORS are repaired
+# (lib/volume-perms.sh never DISPATCHES a bind into its recursive branch, and
+# its ancestor walk never chowns a bind mount point or anything under one — but
+# see #115 below for what that does not cover). A bind nested under a named
+# volume — the
+# transcript bind at ~/.claude/projects/<key>, inside claude-home — makes the
+# daemon create the intervening directories as root, and nothing else repairs
+# them (#106). The recursion rooted at a volume is a separate matter: it still
+# descends through a bind nested under that volume (#115).
+mount_point_targets() {
     local cfg
     cfg="$(dc config --format=json)" || {
-        echo "error: 'docker compose config' failed — cannot derive named-volume mount targets" >&2
+        echo "error: 'docker compose config' failed — cannot derive mount targets" >&2
         return 1
     }
     printf '%s' "$cfg" | python3 -c '
 import json, sys
 cfg = json.load(sys.stdin)
 for v in cfg.get("services", {}).get("app", {}).get("volumes") or []:
-    if v.get("type") == "volume" and v.get("target"):
-        print(v["target"])
+    if v.get("type") in ("volume", "bind") and v.get("target"):
+        print(v["type"] + ":" + v["target"])
 '
 }
 
-# Chown the named-volume mount points to the container user. The logic lives in
+# Chown the mount points to the container user. The logic lives in
 # lib/volume-perms.sh (unit-tested by tests/test-volume-chown-guard.sh) and is
 # injected into the container as the `sh -c` script with the mount points as
 # positional args — it runs in the container, but nothing COPYs it into the
@@ -805,12 +815,12 @@ for v in cfg.get("services", {}).get("app", {}).get("volumes") or []:
 # Note this is called on EVERY cold start, not just the first (setup() is gated
 # only on `is_running`), which is why the recursive chown is guarded inside the
 # lib rather than run unconditionally.
-chown_named_volume_targets() {
+chown_mount_points() {
     local targets_out
-    # Command substitution, not a pipe: named_volume_targets fails loudly when
+    # Command substitution, not a pipe: mount_point_targets fails loudly when
     # `dc config` does, and `|| return 1` propagates that instead of letting the
     # downstream exit status mask it.
-    targets_out="$(named_volume_targets)" || return 1
+    targets_out="$(mount_point_targets)" || return 1
 
     local targets=() t
     while IFS= read -r t; do
@@ -821,18 +831,18 @@ chown_named_volume_targets() {
     local script
     script="$(cat "$DEV_BASE_DIR/lib/volume-perms.sh")" || return 1
     script="$script"'
-dev_chown_volume_targets vscode vscode /home/vscode "$@"'
+dev_chown_mount_points vscode vscode /home/vscode "$@"'
 
     # `sh -c <script> <argv0> <args...>`: the first operand after the script is
     # $0, so the mount points land in "$@" for the driver line above.
     dc exec -T -u root app sh -c "$script" volume-perms "${targets[@]}"
 }
 
-# First-run setup: chown root-owned named-volume mount points, set up the
+# First-run setup: chown root-owned mount points, set up the
 # host-path symlink for tools that persist absolute paths, then delegate
 # to the project's setup-env first-run.
 setup() {
-    chown_named_volume_targets
+    chown_mount_points
 
     if [ "$DEV_WORKSPACE" != "$DEV_CONTAINER_WORKSPACE" ] \
         && [ "$DEV_WORKSPACE" != "$DEV_MAIN_TREE" ]; then
diff --git a/lib/host-bridge.sh b/lib/host-bridge.sh
index b0af595..8daf4f9 100644
--- a/lib/host-bridge.sh
+++ b/lib/host-bridge.sh
@@ -568,8 +568,16 @@ setup_claude() {
     local container_project_key="$DEV_CONTAINER_PROJECT_KEY"
 
     # Named volume root comes up root-owned; fix so vscode can write. Top-level
-    # is enough — setup-claude creates the contents as vscode. (There is no
-    # longer a credentials/ bind mount to avoid recursing into.)
+    # only, deliberately: setup-claude creates the contents as vscode, and a
+    # recursive chown here would cross into the transcript bind mounted at
+    # .claude/projects/<key> and rewrite ownership on the host side.
+    #
+    # It is NOT sufficient on its own. `.claude/projects` is created by the
+    # DAEMON as root to host that bind, so nothing below this line repairs it —
+    # that is dev_chown_mount_points' ancestor walk (lib/volume-perms.sh),
+    # which runs in setup() earlier in this same locked region (#106). setup()
+    # is cold-start only, so a container already running when that fix landed
+    # keeps the root-owned dir until its next recreate.
     dc exec -u root app chown vscode:vscode /home/vscode/.claude
 
     dc exec \
diff --git a/lib/volume-perms.sh b/lib/volume-perms.sh
index 6aaf5dd..95ee991 100644
--- a/lib/volume-perms.sh
+++ b/lib/volume-perms.sh
@@ -1,5 +1,5 @@
 # shellcheck shell=sh
-# Ownership repair for named-volume mount points, factored out of setup() in
+# Ownership repair for container mount points, factored out of setup() in
 # dev/devcontainer so it can be unit-tested without docker
 # (tests/test-volume-chown-guard.sh). Runs INSIDE the container as root: the
 # caller reads this file on the host and injects it into `dc exec ... sh -c`,
@@ -12,6 +12,23 @@
 # don't exist in the image (e.g. /home/vscode/.cache/uv) has those parents
 # created by the daemon, also root-owned.
 #
+# BINDS ARE IN SCOPE FOR THE ANCESTOR WALK ONLY. The daemon creates a bind
+# target's missing parents as root exactly as it does a volume's, and nothing
+# else ever repairs them: that is what left ~/.claude/projects root-owned and
+# unwritable, since the transcript bind mounts at ~/.claude/projects/<key>
+# inside the claude-home volume (#106). Everything at or below a bind mount
+# point is the HOST side, so a bind is never recursed INTO and the ancestor
+# walk never chowns a bind mount point — see _vp_never_chown.
+#
+# What that does NOT cover, and this is deliberate and recorded (#115): the
+# recursive branch below is rooted at a VOLUME and `chown -R` has no mount
+# awareness, so it still descends through a bind nested UNDER that volume —
+# exactly the claude-home / transcript-bind topology above. That predates the
+# ancestor-walk work and is latent only because the guard's precondition (a
+# volume root not already user-owned) is not normally met. Do not read
+# _vp_never_chown as protecting the recursion; it is consulted by
+# dev_chown_ancestors alone.
+#
 # THE GUARD (why the recursion is conditional):
 #   setup() is named "first-run" but is gated only on `is_running`, so it re-runs
 #   on every cold start — after a host reboot, a `devcontainer down`, or a
@@ -58,36 +75,175 @@ dev_volume_chown_needed() {
     return 0
 }
 
-# dev_chown_volume_targets <owner> <group> <home-prefix> <mount-point>... —
-# chown each mount point (recursively, guarded) and its <home-prefix>-scoped
-# ancestors to <owner>:<group>. Ancestors are walked upward only while still
-# strictly under <home-prefix>, so <home-prefix> itself and anything outside it
-# (notably the bind-mounted host workspace) are never touched.
+_vp_nl='
+'
+
+# Paths the ancestor walk must never chown, newline-delimited and
+# newline-terminated at both ends so a `case` glob tests membership exactly
+# (a path may contain spaces and glob metacharacters, so neither is usable as a
+# delimiter). A path may legally contain a newline too — but such a target is
+# already unrepresentable upstream, where chown_mount_points reads the compose
+# query's output line by line, so nothing reaches here that this could split.
+#
+# dev_chown_mount_points fills this with every BIND target, because an ancestor
+# can itself be a bind mount point — chowning it writes to the host side. This
+# is not hypothetical: docker-compose.yml mounts DEV_MAIN_TREE and DEV_MAIN_GIT
+# at their HOST paths, and DEV_MAIN_GIT (<tree>/.git) nests inside DEV_MAIN_TREE,
+# so on a host whose checkout lives under the container home prefix (a host user
+# named `vscode`; Codespaces) the walk up from the .git target reaches the
+# worktree bind and would rewrite ownership of the user's real repo directory.
+#
+# Empty when dev_chown_volume_targets is driven directly — that entry point is
+# unchanged, and with no bind targets declared there is nothing to protect.
+_vp_never_chown=""
+
+# _vp_is_protected <path> — true when <path> is on the host side of a bind
+# recorded by dev_chown_mount_points: either a bind mount point itself, or a
+# path UNDER one. The expansions in the patterns are quoted, so a path
+# containing glob metacharacters is compared literally rather than matched.
+#
+# The under-a-bind case is not redundant. An exact-match-only test protects the
+# mount point but not the directories inside it, and the ancestor walk reaches
+# those whenever one bind nests two or more levels under another — e.g. binds at
+# /home/vscode/data and /home/vscode/data/secrets/keys leave the walk chowning
+# /home/vscode/data/secrets, which is host-side. docker-compose.yml itself only
+# nests one level deep (<tree>/.git directly under <tree>), but host-mounts.txt
+# accepts arbitrary <host>:<container> pairs with no depth restriction
+# (lib/host-mounts.sh), so the deeper shape is reachable in a user's config.
+_vp_is_protected() {
+    [ -n "$_vp_never_chown" ] || return 1
+
+    case "$_vp_never_chown" in
+        *"$_vp_nl$1$_vp_nl"*) return 0 ;;
+    esac
+
+    # Walk the set entry by entry, testing whether <path> lies under any of
+    # them. _vpx_-prefixed so this cannot clobber the ancestor walk's iterator.
+    _vpx_rest="${_vp_never_chown#"$_vp_nl"}"
+    while [ -n "$_vpx_rest" ]; do
+        # Termination precondition: every entry is newline-TERMINATED. Without
+        # a trailing newline the `#*nl` strip removes nothing and this loops
+        # forever — confirmed under dash. Unreachable via the only writer
+        # (dev_chown_mount_points always appends one), but this runs as root
+        # inside `dc exec` on every cold start, so a future writer that drops
+        # the terminator would turn a wrong answer into a startup HANG.
+        case "$_vpx_rest" in
+            *"$_vp_nl"*) ;;
+            *) break ;;
+        esac
+        _vpx_e="${_vpx_rest%%"$_vp_nl"*}"
+        _vpx_rest="${_vpx_rest#*"$_vp_nl"}"
+        [ -n "$_vpx_e" ] || continue
+        case "$1" in
+            "$_vpx_e"/*) return 0 ;;
+        esac
+    done
+
+    return 1
+}
+
+# dev_chown_ancestors <owner> <group> <home-prefix> <path>... — chown each
+# path's <home-prefix>-scoped ancestors to <owner>:<group>. Ancestors are walked
+# upward only while still strictly under <home-prefix>, so <home-prefix> itself
+# and anything outside it (notably the bind-mounted host workspace) are never
+# touched, and any ancestor that is itself a bind mount point is skipped while
+# the walk continues past it — its own parents are still container-side.
+#
+# The paths themselves are NOT chowned and nothing recurses. That is what makes
+# this safe to point at a bind mount point.
 #
 # chown failures are tolerated: the mount point may be on a read-only or
 # ownership-fixed filesystem, and a hard failure here would abort a cold start
 # that user-mode setup may well survive.
-dev_chown_volume_targets() {
-    _vp_user="$1"
-    _vp_group="$2"
-    _vp_home="$3"
+dev_chown_ancestors() {
+    _vpa_user="$1"
+    _vpa_group="$2"
+    _vpa_home="$3"
     shift 3
 
-    for _vp_d in "$@"; do
-        [ -n "$_vp_d" ] || continue
-
-        if dev_volume_chown_needed "$_vp_d" "$_vp_user" "$_vp_group"; then
-            chown -R "$_vp_user:$_vp_group" "$_vp_d" 2>/dev/null || true
-        fi
+    for _vpa_d in "$@"; do
+        [ -n "$_vpa_d" ] || continue
 
-        _vp_p="$(dirname "$_vp_d")"
-        while [ "$_vp_p" != "/" ] && [ "$_vp_p" != "." ]; do
-            case "$_vp_p" in
-                "$_vp_home"/*) ;;
+        _vpa_p="$(dirname "$_vpa_d")"
+        while [ "$_vpa_p" != "/" ] && [ "$_vpa_p" != "." ]; do
+            case "$_vpa_p" in
+                "$_vpa_home"/*) ;;
                 *) break ;;
             esac
-            chown "$_vp_user:$_vp_group" "$_vp_p" 2>/dev/null || true
-            _vp_p="$(dirname "$_vp_p")"
+            if ! _vp_is_protected "$_vpa_p"; then
+                chown "$_vpa_user:$_vpa_group" "$_vpa_p" 2>/dev/null || true
+            fi
+            _vpa_p="$(dirname "$_vpa_p")"
         done
     done
 }
+
+# dev_chown_volume_targets <owner> <group> <home-prefix> <mount-point>... —
+# chown each mount point (recursively, guarded) and its <home-prefix>-scoped
+# ancestors to <owner>:<group>.
+#
+# Loop variables are _vpt_-prefixed, not _vpa_: these are shell globals (POSIX
+# sh has no `local`), so sharing a prefix with dev_chown_ancestors would let the
+# callee clobber this loop's iterator mid-walk.
+dev_chown_volume_targets() {
+    _vpt_user="$1"
+    _vpt_group="$2"
+    _vpt_home="$3"
+    shift 3
+
+    for _vpt_d in "$@"; do
+        [ -n "$_vpt_d" ] || continue
+
+        if dev_volume_chown_needed "$_vpt_d" "$_vpt_user" "$_vpt_group"; then
+            chown -R "$_vpt_user:$_vpt_group" "$_vpt_d" 2>/dev/null || true
+        fi
+
+        dev_chown_ancestors "$_vpt_user" "$_vpt_group" "$_vpt_home" "$_vpt_d"
+    done
+}
+
+# dev_chown_mount_points <owner> <group> <home-prefix> <kind>:<mount-point>... —
+# dispatch by compose mount type. `volume` gets the guarded recursive chown plus
+# its ancestors; `bind` gets ancestors ONLY.
+#
+# An unknown kind is skipped rather than guessed at: the recursive branch is the
+# destructive one, so a compose mount type this lib has not been taught about
+# (tmpfs, npipe, cluster) must not fall into it.
+dev_chown_mount_points() {
+    _vpm_user="$1"
+    _vpm_group="$2"
+    _vpm_home="$3"
+    shift 3
+
+    # Bind targets are collected in a FIRST pass: the protection has to cover
+    # every bind before any walk runs, or the order of the argument list decides
+    # whether a host directory gets chowned.
+    _vp_never_chown="$_vp_nl"
+    for _vpm_a in "$@"; do
+        case "$_vpm_a" in
+            bind:?*) _vp_never_chown="$_vp_never_chown${_vpm_a#bind:}$_vp_nl" ;;
+        esac
+    done
+
+    for _vpm_a in "$@"; do
+        [ -n "$_vpm_a" ] || continue
+        _vpm_kind="${_vpm_a%%:*}"
+        _vpm_d="${_vpm_a#*:}"
+        [ -n "$_vpm_d" ] || continue
+
+        case "$_vpm_kind" in
+            volume)
+                dev_chown_volume_targets "$_vpm_user" "$_vpm_group" \
+                    "$_vpm_home" "$_vpm_d"
+                ;;
+            bind)
+                dev_chown_ancestors "$_vpm_user" "$_vpm_group" \
+                    "$_vpm_home" "$_vpm_d"
+                ;;
+        esac
+    done
+
+    # Scoped to this call: a later direct dev_chown_volume_targets must not
+    # inherit protections derived from a compose config it was not given.
+    _vp_never_chown=""
+}
diff --git a/nix/base/Dockerfile.nix-default b/nix/base/Dockerfile.nix-default
index 6e0ae3e..806d857 100644
--- a/nix/base/Dockerfile.nix-default
+++ b/nix/base/Dockerfile.nix-default
@@ -44,6 +44,17 @@ RUN if [ "$USER_GID" != "1000" ]; then groupmod -g "$USER_GID" vscode; fi \
         chown -R "$USER_UID:$USER_GID" /home/vscode; \
     fi
 
+# The transcript bind's parent, mirroring the root Dockerfile's mkdir (#106).
+# Here rather than in nix/base/flake.nix, where the sibling home dirs are
+# pre-created: a fix in the base reaches nobody until a republish AND a
+# BASE_IMAGE repin (#83), while the tail rebuilds per project.
+#
+# Chowned explicitly because the remap above is guarded on USER_UID != 1000, so
+# at the default UID it does not run. By NAME, since the remap has already
+# renumbered vscode and the name is the identity compose runs as (`user:`).
+RUN mkdir -p /home/vscode/.claude/projects \
+    && chown vscode:vscode /home/vscode/.claude/projects
+
 # Shared helpers an overlay can source. Copied before install-system runs so a
 # build-time install-system.sh can source it too (e.g. nix-seed.sh). Inert for
 # overlays that don't use it.
diff --git a/tests/test-volume-chown-guard.sh b/tests/test-volume-chown-guard.sh
index 42238e4..b089e11 100755
--- a/tests/test-volume-chown-guard.sh
+++ b/tests/test-volume-chown-guard.sh
@@ -1,10 +1,10 @@
 #!/usr/bin/env bash
-# Tests for the guarded named-volume chown (lib/volume-perms.sh, driven by
-# chown_named_volume_targets in dev/devcontainer). Exercises the GUARD DECISION
-# in isolation — no docker, no root, no real volume — by sourcing the shipped lib
-# and stubbing `chown` on PATH so every invocation is recorded instead of
-# performed. `stat` is NOT stubbed: the ownership probe runs for real against
-# temp dirs the suite owns.
+# Tests for the guarded mount-point chown (lib/volume-perms.sh, driven by
+# chown_mount_points in dev/devcontainer). Exercises the GUARD DECISION and the
+# bind/volume DISPATCH in isolation — no docker, no root, no real volume — by
+# sourcing the shipped lib and stubbing `chown` on PATH so every invocation is
+# recorded instead of performed. `stat` is NOT stubbed: the ownership probe runs
+# for real against temp dirs the suite owns.
 #
 # Modelling the two states without root: the guard compares owner/group NAMES,
 # so a name that cannot match any real owner ("$MISMATCH_OWNER") models a fresh
@@ -20,7 +20,97 @@
 #   4. ancestor walking stops at the home prefix and never leaves it
 #   5. `chown -R` is post-order, the invariant the guard rests on: an interrupted
 #      run leaves the mount point unchowned, so it can't be read as completed
-#   6. the dev/devcontainer driver line still matches the lib's function
+#   6. bind/volume dispatch: a bind gets its daemon-created ancestors repaired
+#      but is never DISPATCHED into the recursive branch, a volume still gets
+#      both, an unknown kind gets nothing
+#   7. the ANCESTOR WALK never lands a chown on a bind mount point or on
+#      anything under one, including when one bind nests inside another
+#      (DEV_MAIN_GIT inside DEV_MAIN_TREE, and the deeper host-mounts.txt
+#      shape) — those paths are the host side of the mount. The RECURSIVE
+#      branch is not covered by any of that and the suite says so: a bind
+#      nested under a volume is still reached, pinned as current behaviour
+#      (#115)
+#   8. the compose query emits kind-qualified volume AND bind targets, checked
+#      by running dev/devcontainer's own python snippet against a document
+#   9. the dev/devcontainer driver line still matches the lib's function
+#  10. the image half of #106 is WIRED AND REACHABLE: both build workflows
+#      invoke dev/check-image-mount-parents, it is executable, it derives the
+#      directory rather than restating it, and docker-build.yml triggers on
+#      docker-compose.yml — the file the checker derives FROM, and no build
+#      input, so nothing else would list it. The fact itself (an image ships
+#      the directory writable) needs a daemon and is typed `ci:`; this suite
+#      holds only what keeps that check running.
+#
+# Verified (ADR-0005 §2), twelve mutations. Counts and assertion names below are
+# transcribed from the runs — see the METHOD note at the end, because three
+# earlier versions of this record were wrong.
+#   1. mount_point_targets' filter reverted to the pre-#106 `type == "volume"`
+#      — 3 red: "the compose query emits BIND targets too (the #106 fix)", the
+#      kind-set anti-vacuity assertion (the generic extraction finds no
+#      `in (...)` tuple at all), and the kind-set comparison. Item 8 is the
+#      only thing that sees the compose query; everything else drives the lib.
+#   2. the `_vp_is_protected` check dropped from dev_chown_ancestors — 6 red,
+#      all in item 7.
+#   3. the `bind)` dispatch arm routed to dev_chown_volume_targets — 1 red,
+#      "a bind target is never recursed into". NOT the deep-nesting assertions:
+#      they are line-anchored on `<owner> <path>` and this mutation logs
+#      `-R <owner> <path>`, a different whole line. Coverage for this mutation
+#      is exactly one assertion, which is worth knowing before relying on it.
+#   4. the `_vp_never_chown=""` reset deleted, leaking the exclusion set into a
+#      later direct dev_chown_volume_targets call — 1 red, "a direct
+#      volume-targets call does not inherit protections". That assertion was
+#      FAIL-OPEN as first written (assert_contains with a needle that is a
+#      PREFIX of the recursive line): it passed with the leak live and the
+#      suite stayed at 41/0. Found in review, not by me.
+#   5. the under-a-bind arm of _vp_is_protected removed, leaving exact-match
+#      only — 1 red, "a directory INSIDE a bind is not chowned (not just the
+#      mount point)".
+#   6. the ancestor walk changed to `break` at a protected bind instead of
+#      skipping past it — 1 red, "the walk continues PAST a protected bind to
+#      the dirs above it". That assertion was ALSO fail-open until this round:
+#      it read the log of a call where the protected bind was itself an
+#      argument, so its own walk chowned everything above it and the assertion
+#      passed either way. It now drives dev_chown_ancestors directly with a
+#      hand-filled exclusion set. (Skip and break are outcome-equivalent for
+#      every input reachable through dev_chown_mount_points, so this pins a
+#      documented behaviour rather than fixing a live bug.)
+#   7. the whole `bind)` dispatch arm deleted — 3 red, including the kind-set
+#      comparison, which is what proves that guard derives both sides rather
+#      than restating a vocabulary.
+#   8. the checker's `run:` step deleted from docker-build.yml — 1 red. The
+#      workflows are asserted separately, so one route cannot hide behind the
+#      other still running it.
+#   9. the same, plus a trailing comment on the trigger-path entry so the
+#      checker's name still appears in the file — 1 red. This was the
+#      assertion's fail-open form (an unanchored grep matched the paths line),
+#      and the paths entry that made it satisfiable was added by this change.
+#  10. the checker's derivation replaced by its literal — 1 red. It still
+#      passes against today's images, which is why a literal would go unnoticed
+#      until the mount moved.
+#  11. the checker made non-executable — 1 red (#129's shape).
+#  12. `- docker-compose.yml` dropped from docker-build.yml's trigger paths —
+#      2 red, one per event list: nothing rebuilds on a compose-side move of
+#      the mount, so the checker never re-derives.
+#
+# METHOD: measure each mutation in a FRESH copy of the tree, and transcribe the
+# numbers from the run rather than reasoning about them. Three earlier versions
+# of this record were wrong — counts inflated, and one mutation credited with
+# reds belonging to another.
+#
+# What is established: hand-measured counts taken from a single scratch copy
+# reused across mutations disagreed with counts re-measured one-copy-per-
+# mutation, and the latter reproduce. What is NOT established is why the reused
+# copy drifted: an earlier draft of this note blamed `git checkout` failing to
+# restore in a `cp -a` copy of a linked worktree, and that does not reproduce —
+# the copy's gitdir resolves and the restore works. Something else in that loop
+# accumulated state. The prescription stands on the reproducibility of the
+# fresh-copy numbers, not on the diagnosis.
+#
+# tests/mutation-coverage automates this (fresh copy per mutation, plus it
+# flags a mutation that changed nothing). It is not in this tree — it ships on
+# the branch behind PR #124.
+#   (mutation runs 2026-08-04; items 8-12 on 2026-08-11, fresh copy each,
+#    re-measured after the Dockerfile-text parser was deleted)
 set -euo pipefail
 
 . "$(dirname "$(readlink -f "$0")")/lib/harness.sh"
@@ -56,7 +146,7 @@ run() {
 
 log() { cat "$CHOWN_LOG"; }
 
-echo "=== named-volume chown guard tests ==="
+echo "=== mount-point chown guard tests ==="
 
 # ---- 1. the guard decision ----
 home="$tmp/home/vscode"
@@ -153,22 +243,229 @@ else
         "'$order_root/sub/file'" "${order_lines[0]}"
 fi
 
-# ---- 6. the dev/devcontainer driver line matches the lib ----
-# chown_named_volume_targets injects the lib into the container and appends this
+# ---- 6. bind vs volume dispatch: a bind is never recursed into ----
+# The daemon creates a mount target's missing parents as root for binds exactly
+# as for volumes (~/.claude/projects, hosting the transcript bind under the
+# claude-home volume), so those ancestors must be repaired. Recursing into the
+# target itself must NOT happen for a bind: the walk would cross into the host
+# side and rewrite ownership there.
+#
+# Both cases use MISMATCH_OWNER so the guard would ALLOW the recursion — the
+# bind case therefore proves dispatch, not a guard that happened to skip.
+run_mp() {
+    : >"$CHOWN_LOG"
+    dev_chown_mount_points "$@"
+}
+
+mp_home="$tmp/mp/vscode"
+mp_target="$mp_home/.claude/projects/-devcontainer-x"
+mkdir -p "$mp_target"
+
+run_mp "$MISMATCH_OWNER" "$MISMATCH_OWNER" "$mp_home" "bind:$mp_target"
+assert_not_contains "a bind target is never recursed into" "-R " "$(log)"
+# Line-anchored: this needle is a strict PREFIX of the bind-target line
+# ("… /projects" vs "… /projects/-devcontainer-x"), so assert_contains passes
+# on a mutant that chowns the target instead of its parent — verified. Third
+# instance of that trap in this file; the neighbours below are anchored for the
+# same reason.
+assert_true "a bind target's daemon-created parent is chowned" \
+    grep -qxF "$MISMATCH_OWNER:$MISMATCH_OWNER $mp_home/.claude/projects" "$CHOWN_LOG"
+assert_false "a bind target itself is not chowned" \
+    grep -qxF "$MISMATCH_OWNER:$MISMATCH_OWNER $mp_target" "$CHOWN_LOG"
+
+run_mp "$MISMATCH_OWNER" "$MISMATCH_OWNER" "$mp_home" "volume:$mp_target"
+assert_contains "a volume target still gets the recursive chown" \
+    "-R $MISMATCH_OWNER:$MISMATCH_OWNER $mp_target" "$(log)"
+# Line-anchored for the same reason as the direct-call assertion at the end of
+# item 7: the recursive line `-R <owner> <mp_target>` contains this needle as a
+# substring, so assert_contains here would pass with the ancestor walk removed.
+assert_true "a volume target's ancestors are still chowned" \
+    grep -qxF "$MISMATCH_OWNER:$MISMATCH_OWNER $mp_home/.claude/projects" "$CHOWN_LOG"
+
+# An unrecognised kind must fall through to nothing: the recursive branch is the
+# destructive one, so a mount type the lib has not been taught about (tmpfs,
+# npipe, cluster) must not reach it by default.
+run_mp "$MISMATCH_OWNER" "$MISMATCH_OWNER" "$mp_home" "tmpfs:$mp_target"
+assert_eq "an unknown mount kind is skipped entirely" "" "$(log)"
+
+# An entry with no kind separator at all is skipped for the same reason.
+run_mp "$MISMATCH_OWNER" "$MISMATCH_OWNER" "$mp_home" "$mp_target"
+assert_eq "an unqualified target (no <kind>: prefix) is skipped" "" "$(log)"
+
+# ---- 7. a bind mount point is never chowned, however it is reached ----
+# docker-compose.yml mounts DEV_MAIN_TREE and DEV_MAIN_GIT at their HOST paths,
+# and <tree>/.git nests inside <tree>. On a host whose checkout lives under the
+# container home prefix (a host user named `vscode`; Codespaces), walking up
+# from the .git bind reaches the worktree bind — which is the host side of a
+# mount, i.e. the user's real repo directory. It must be skipped, while the
+# walk continues past it to the container-side dirs above.
+tree="$mp_home/repos/proj"
+gitdir="$tree/.git"
+mkdir -p "$gitdir"
+
+run_mp "$MISMATCH_OWNER" "$MISMATCH_OWNER" "$mp_home" "bind:$tree" "bind:$gitdir"
+assert_false "a nested bind's parent bind is never chowned" \
+    grep -qxF "$MISMATCH_OWNER:$MISMATCH_OWNER $tree" "$CHOWN_LOG"
+
+# "Continues past" needs the protected bind to NOT be in the argument list —
+# otherwise its own walk chowns everything above it and the assertion passes
+# whether the walk skips or breaks. Verified: mutating the skip to a `break`
+# left the suite fully green before this was rewritten. So drive the walk
+# directly with a hand-filled exclusion set naming a bind that is not an
+# argument.
+: >"$CHOWN_LOG"
+# shellcheck disable=SC2154  # _vp_nl comes from the sourced lib above; building
+# the set with the lib's own delimiter is the point — a literal newline here
+# would stop tracking it if the lib ever changed delimiters.
+_vp_never_chown="$_vp_nl$tree$_vp_nl"
+dev_chown_ancestors "$MISMATCH_OWNER" "$MISMATCH_OWNER" "$mp_home" "$gitdir"
+_vp_never_chown=""
+assert_true "the walk continues PAST a protected bind to the dirs above it" \
+    grep -qxF "$MISMATCH_OWNER:$MISMATCH_OWNER $mp_home/repos" "$CHOWN_LOG"
+assert_false "...while still not chowning the protected bind itself" \
+    grep -qxF "$MISMATCH_OWNER:$MISMATCH_OWNER $tree" "$CHOWN_LOG"
+
+# Protection is order-independent: the bind targets are collected in a first
+# pass, so it holds whichever order compose emits them in.
+run_mp "$MISMATCH_OWNER" "$MISMATCH_OWNER" "$mp_home" "bind:$gitdir" "bind:$tree"
+assert_false "protection does not depend on argument order" \
+    grep -qxF "$MISMATCH_OWNER:$MISMATCH_OWNER $tree" "$CHOWN_LOG"
+# Paired positive: without it the negative above passes on an empty log, so a
+# run that chowned NOTHING would read as a protected one (the #95-#97 shape).
+assert_contains "reversed order still repairs the container-side ancestor" \
+    "$MISMATCH_OWNER:$MISMATCH_OWNER $mp_home/repos" "$(log)"
+
+# A bind nesting TWO levels under another bind: the intermediate directory is
+# inside the outer bind, so it is host-side even though it is not itself a mount
+# point. An exact-match-only protection would chown it. Not reachable from
+# docker-compose.yml (which nests one level, <tree>/.git under <tree>) but
+# reachable from host-mounts.txt, which takes arbitrary <host>:<container>.
+deep_outer="$mp_home/data"
+deep_inner="$deep_outer/secrets/keys"
+mkdir -p "$deep_inner"
+run_mp "$MISMATCH_OWNER" "$MISMATCH_OWNER" "$mp_home" \
+    "bind:$deep_outer" "bind:$deep_inner"
+assert_false "a directory INSIDE a bind is not chowned (not just the mount point)" \
+    grep -qxF "$MISMATCH_OWNER:$MISMATCH_OWNER $deep_outer/secrets" "$CHOWN_LOG"
+assert_false "the outer bind mount point is still not chowned" \
+    grep -qxF "$MISMATCH_OWNER:$MISMATCH_OWNER $deep_outer" "$CHOWN_LOG"
+
+# Same for a volume nested inside a bind (a venv volume under the worktree):
+# the volume is recursed into, its bind parent still is not.
+venv="$tree/.venv"
+mkdir -p "$venv"
+run_mp "$MISMATCH_OWNER" "$MISMATCH_OWNER" "$mp_home" "bind:$tree" "volume:$venv"
+assert_contains "a volume nested in a bind is still recursed into" \
+    "-R $MISMATCH_OWNER:$MISMATCH_OWNER $venv" "$(log)"
+assert_false "a volume's ancestor walk also skips the bind mount point" \
+    grep -qxF "$MISMATCH_OWNER:$MISMATCH_OWNER $tree" "$CHOWN_LOG"
+
+# The SHIPPED direction, pinned honestly: a bind nested UNDER a volume is still
+# reached by the recursion. `chown -R` has no mount awareness, and
+# _vp_never_chown is consulted by dev_chown_ancestors alone, so the recursive
+# branch descends through the bind — the claude-home / transcript-bind topology.
+# This asserts what the code DOES, not what it should do; #115 tracks the fix
+# and this assertion is its red-to-green target. Item 7's other cases cover the
+# opposite nesting (a volume under a bind), which is the safe one — without this
+# the suite would read as having covered both.
+#
+# What it actually observes, stated plainly: `chown` is STUBBED here, so this
+# witnesses the unpruned `chown -R` being INVOKED on a volume that contains a
+# bind — not the descent itself, which a stub cannot see. That invocation is the
+# observable proxy, and it is sufficient as a red-to-green target: both
+# candidate #115 fixes flip it (a pruned `find` emits no `-R` line at all).
+assert_contains "a volume containing a bind still gets the unpruned chown -R (#115)" \
+    "-R $MISMATCH_OWNER:$MISMATCH_OWNER $mp_home/.claude" "$(
+        : >"$CHOWN_LOG"
+        dev_chown_mount_points "$MISMATCH_OWNER" "$MISMATCH_OWNER" "$mp_home" \
+            "volume:$mp_home/.claude" "bind:$mp_target"
+        log
+    )"
+
+# The protection is scoped to the dispatching call: dev_chown_volume_targets is
+# still a usable entry point on its own and must not inherit a stale exclusion
+# set from a previous dev_chown_mount_points call.
+run "$MISMATCH_OWNER" "$MISMATCH_OWNER" "$mp_home" "$venv"
+# grep -qxF, NOT assert_contains: "$tree" is a PREFIX of "$venv", so a substring
+# check is satisfied by the recursive line `-R <owner> <tree>/.venv` and passes
+# even when the exclusion set leaks — the very leak this asserts against.
+# (Mutation: delete the `_vp_never_chown=""` reset and the substring form stays
+# green at 41/0. The line-anchored form goes red. Same trap the ancestor-walk
+# assertions above already avoid.)
+assert_true "a direct volume-targets call does not inherit protections" \
+    grep -qxF "$MISMATCH_OWNER:$MISMATCH_OWNER $tree" "$CHOWN_LOG"
+
+# ---- 8. the compose query emits kind-qualified volume AND bind targets ----
+# Derived, not restated: the python snippet is lifted out of mount_point_targets
+# in dev/devcontainer and run against a synthetic `docker compose config`
+# document, so a narrowed filter there fails HERE rather than only in a
+# container. `dc config` itself needs docker, which this suite does not have —
+# the snippet is the part that can be run hermetically.
+# `|| true` so an extraction that yields nothing reaches the anti-vacuity
+# assertion below. Without it a failing pipeline exits nonzero through this
+# substitution and `set -e` kills the suite AT THE ASSIGNMENT — the failure
+# channel becomes an undiagnosed abort, and the assertion written for exactly
+# that case never runs.
+query="$(awk "/python3 -c '\$/{f=1; next} f && /^'\$/{exit} f" "$DEV_BASE/dev/devcontainer" || true)"
+assert_true "the compose-query snippet was extracted from dev/devcontainer" \
+    test -n "$query"
+
+compose_json='{"services": {"app": {"volumes": [
+    {"type": "volume", "source": "claude-home", "target": "/home/vscode/.claude"},
+    {"type": "bind", "source": "/host/logs", "target": "/home/vscode/.claude/projects/-k"},
+    {"type": "tmpfs", "target": "/home/vscode/.claude/shell-snapshots"},
+    {"type": "volume", "source": "no-target"}
+]}}}'
+emitted="$(printf '%s' "$compose_json" | python3 -c "$query")"
+assert_contains "the compose query emits volume targets, kind-qualified" \
+    "volume:/home/vscode/.claude" "$emitted"
+assert_contains "the compose query emits BIND targets too (the #106 fix)" \
+    "bind:/home/vscode/.claude/projects/-k" "$emitted"
+assert_not_contains "the compose query skips mount kinds the lib cannot dispatch" \
+    "tmpfs:" "$emitted"
+assert_not_contains "the compose query skips a mount with no target" \
+    "no-target" "$emitted"
+
+# The mount kinds the query emits and the kinds the lib dispatches on are a
+# two-file coupling, so per the repo convention it gets a drift guard — and a
+# DERIVED one (ADR-0005): both sides are parsed out of their own source rather
+# than restated here. A kind emitted but not dispatched is silently skipped; a
+# kind dispatched but never emitted is dead code.
+# Both sides are parsed GENERICALLY — no vocabulary is written down here.
+# Enumerating the known kinds (volume|bind|tmpfs|npipe|cluster) made this a
+# third restatement: Compose's `image` mount type (v2.35+) was absent from it,
+# so a filter gaining "image" with no dispatcher arm would be invisible to both
+# extractions and the sets would stay equal. `|| true` so an extraction that
+# matches nothing reaches the anti-vacuity assertions below instead of aborting
+# the suite at the assignment.
+emitted_kinds="$(printf '%s\n' "$query" | grep -oE 'in \([^)]*\)' |
+    grep -oE '"[a-z]+"' | tr -d '"' | sort -u | tr '\n' ' ' || true)"
+dispatched_kinds="$(sed -n '/^dev_chown_mount_points()/,/^}/p' "$DEV_BASE/lib/volume-perms.sh" |
+    grep -oE '^[[:space:]]+[a-z]+\)$' |
+    tr -d ' )' | sort -u | tr '\n' ' ' || true)"
+assert_true "the compose query's kind set was parsed out of dev/devcontainer" \
+    test -n "$emitted_kinds"
+assert_true "the dispatcher's kind set was parsed out of lib/volume-perms.sh" \
+    test -n "$dispatched_kinds"
+assert_eq "every kind the query emits is a kind the lib dispatches on" \
+    "$emitted_kinds" "$dispatched_kinds"
+
+# ---- 9. the dev/devcontainer driver line matches the lib ----
+# chown_mount_points injects the lib into the container and appends this
 # exact line; a rename on either side would otherwise fail only at runtime.
-driver='dev_chown_volume_targets vscode vscode /home/vscode "$@"'
+driver='dev_chown_mount_points vscode vscode /home/vscode "$@"'
 assert_true "dev/devcontainer drives the lib's function with (vscode, vscode, /home/vscode, \$@)" \
     grep -qF "$driver" "$DEV_BASE/dev/devcontainer"
 
 # The injected script must be valid POSIX sh and must pick the mount points out
 # of "$@" — the `sh -c <script> <argv0> <args...>` convention the caller relies
-# on. Composed here the same way chown_named_volume_targets composes it.
+# on. Composed here the same way chown_mount_points composes it.
 script="$(cat "$DEV_BASE/lib/volume-perms.sh")
 $driver"
 assert_true "injected script parses as POSIX sh" sh -n -c "$script"
 
 : >"$CHOWN_LOG"
-sh -c "$script" volume-perms "/home/vscode/.cache/uv"
+sh -c "$script" volume-perms "volume:/home/vscode/.cache/uv"
 # assert_contains, not assert_eq: the guard probes the REAL /home/vscode/.cache/uv,
 # so on a machine where that path exists with a non-vscode owner a chown -R line
 # is also (correctly) logged. Only the unconditional ancestor chown is
@@ -176,4 +473,54 @@ sh -c "$script" volume-perms "/home/vscode/.cache/uv"
 assert_contains "injected script: mount points arrive in \"\$@\" and resolve under /home/vscode" \
     "vscode:vscode /home/vscode/.cache" "$(log)"
 
+# ---- 10. the image half of #106 is checked against real images ----
+# Whether an IMAGE ships the directory writable needs a daemon, so that fact is
+# typed `ci:` and lives in dev/check-image-mount-parents. This suite does NOT
+# re-derive it from the Dockerfiles' text; it did, and that parser had four
+# fail-opens (see CLAUDE.md's invariant, and `git log` for the deletion).
+#
+# What is hermetic is the wiring that keeps the ci: check REACHABLE: both
+# workflows invoke it, it is executable, it does not hardcode what it derives,
+# and docker-build.yml triggers on the compose file it derives FROM.
+echo "--- the ci: half of #106 is wired and reachable ---"
+
+# Derived as the checker derives it: the transcript mount is the one whose
+# target interpolates DEV_CONTAINER_PROJECT_KEY, and its parent is the
+# directory the daemon would otherwise create as root.
+bind_target="$(awk '/^[[:space:]]*target:[[:space:]]/ && /DEV_CONTAINER_PROJECT_KEY/ {print $2}' \
+    "$DEV_BASE/docker-compose.yml")"
+assert_eq "exactly one compose target interpolates DEV_CONTAINER_PROJECT_KEY" \
+    1 "$(printf '%s' "$bind_target" | grep -c . || true)"
+bind_parent="${bind_target%%\$\{*}"
+bind_parent="${bind_parent%/}"
+assert_true "the transcript bind's parent derives to a path under /home/vscode" \
+    bash -c '[[ "$1" == /home/vscode/?* ]]' _ "$bind_parent"
+
+checker="$DEV_BASE/dev/check-image-mount-parents"
+assert_true "the ci: half exists and is executable" test -x "$checker"
+# Anchored on `run:`, not a bare mention: the checker's path is also a
+# trigger-path entry, so an unanchored grep is satisfied by a workflow that
+# merely lists it and runs it nowhere (mutation 9).
+for workflow in docker-build.yml nix-base.yml; do
+    assert_true "$workflow has a run: step invoking dev/check-image-mount-parents" \
+        grep -qE '^[[:space:]]*run:[[:space:]]+dev/check-image-mount-parents[[:space:]]' \
+        "$DEV_BASE/.github/workflows/$workflow"
+done
+# The checker must DERIVE the directory as this suite does, not restate it: a
+# hardcoded literal there is a fourth encoding that goes stale silently, since
+# nothing would fail until the mount moved AND someone noticed the check was
+# asserting the old path.
+assert_false "the checker does not hardcode the directory it checks" \
+    grep -qF "$bind_parent" "$checker"
+
+# docker-compose.yml is no build INPUT — nothing COPYs it — so the sibling
+# trigger-path guard has no reason to list it, and only a build re-run gets a
+# compose-side move of the mount back in front of the checker.
+for event in push pull_request; do
+    assert_true "docker-build.yml triggers on docker-compose.yml ($event)" \
+        bash -c '
+            sed -n "/^  $2:/,/^  [a-z_]*:/p" "$1" | grep -qE "^ +- docker-compose\.yml$"
+        ' _ "$DEV_BASE/.github/workflows/docker-build.yml" "$event"
+done
+
 finish