From 03d7d848b381257e63151fc75552ba6b49e74131 Mon Sep 17 00:00:00 2001
From: dlovell <dlovell@gmail.com>
Date: Tue, 4 Aug 2026 16:58:13 +0000
Subject: [PATCH 1/6] fix(devcontainer): repair bind mount points'
 daemon-created parents
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`~/.claude/projects` came up root:root 755 inside the container, so the
container user could not create anything in it — including the per-project
memory directory Claude expects at ~/.claude/projects/<key>/memory/.

`named_volume_targets` filtered the merged compose config to `type == "volume"`,
so the transcript bind at ~/.claude/projects/<key> never reached the chown
driver. Its parent is precisely a directory the DAEMON creates as root to host
that mount point — the case lib/volume-perms.sh already documents for volumes,
identical for a bind; only the type filter excluded it. The compensating
`chown vscode:vscode /home/vscode/.claude` in setup_claude() does not reach it
either, and its "Top-level is enough" comment was simply wrong: the contents in
question are not created by setup-claude, they are created by the daemon.

Binds cannot just be handed to the existing function: it does a guarded
`chown -R`, which for a bind walks onto the HOST side and rewrites ownership of
real files — the opposite of the invariant the lib states. So the ancestor walk
is split out of dev_chown_volume_targets into dev_chown_ancestors, and a
dev_chown_mount_points dispatcher routes `volume` -> guarded recursion +
ancestors, `bind` -> ancestors only, anything else -> nothing (the recursive
branch is the destructive one, so an untaught mount type must not reach it).

The ancestor walk additionally refuses to chown any path that is itself a bind
mount point. That is not a hypothetical: docker-compose.yml mounts DEV_MAIN_TREE
and DEV_MAIN_GIT at their HOST paths and <tree>/.git nests inside <tree>, so on
a host whose checkout lives under the container home prefix (a host user named
`vscode`; Codespaces) the walk up from the .git bind would have reached the
worktree bind and rewritten ownership of the user's real repo directory. Bind
targets are collected in a first pass so the protection cannot depend on the
order compose emits mounts in.

Loop variables move off the shared `_vp_` prefix: these are POSIX sh globals, so
a caller and callee sharing a prefix would clobber the caller's iterator.

Scope, stated rather than assumed away: this covers the ancestor walk only. The
RECURSIVE branch is rooted at a volume and `chown -R` has no mount awareness, so
it still descends through a bind nested under that volume — the claude-home /
transcript-bind topology itself. That predates this change and is latent only
incidentally (the images pre-create ~/.claude user-owned and setup_claude
re-chowns the top every up, so the guard's precondition is not normally met).
Filed as #115 with options, recorded as an accepted `unguarded:` invariant, and
the suite pins the current unsafe behaviour rather than asserting the safe one —
that assertion is #115's red-to-green target.

Guards (ADR-0005), all mutation-tested with the mutations recorded in the test
header: the bind/volume dispatch, the bind-mount-point protection including the
nested-bind case, and the compose query itself — its python snippet is lifted
out of dev/devcontainer and run against a synthetic config document, so
narrowing the filter back to volumes fails hermetically instead of only in a
container. tests/test-volume-chown-guard.sh: 21 -> 41 assertions.

Note for existing containers: setup() is cold-start only, so a container already
running keeps the root-owned directory until its next recreate.

Closes #106
Refs #115

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MMRkcVZwXpwBqjMY4bSehH
---
 CLAUDE.md                        |  38 +++-
 dev/devcontainer                 |  36 ++--
 lib/host-bridge.sh               |  12 +-
 lib/volume-perms.sh              | 200 +++++++++++++++++---
 tests/test-volume-chown-guard.sh | 301 +++++++++++++++++++++++++++++--
 5 files changed, 534 insertions(+), 53 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 8c1de22..58c7706 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -231,13 +231,45 @@ taxonomy and reads as `test:`.
   prevents is bounded because the glob, not the workflow, enumerates suites).
 - Container-side root logic lives in `lib/*.sh` and is INJECTED per run via
   `dc exec ... sh -c "$script" <argv0> <args...>` — a runtime input: no
-  rebuild, no fingerprint entry unless it is also COPYed
-  (`tests/test-volume-chown-guard.sh` pins the volume-perms driver line).
+  rebuild, no fingerprint entry unless it is also COPYed (test:
+  `tests/test-volume-chown-guard.sh` pins the volume-perms driver line).
 - `setup()` runs on EVERY cold start (gated only on `is_running`), so its
   steps must be idempotent and cheap. The named-volume chown is guarded by one
   owner+group stat, sound because `chown -R` is post-order: an interrupted
   walk leaves the mount point root-owned and retries next start
-  (`tests/test-volume-chown-guard.sh`).
+  (test: `tests/test-volume-chown-guard.sh`).
+- Mount-point ownership repair is dispatched on the compose mount TYPE: a
+  `volume` gets the guarded recursive chown plus its ancestors, a `bind` gets
+  ancestors ONLY, anything else gets nothing. The dispatcher never routes a
+  bind INTO the recursive branch, and the ANCESTOR WALK never chowns a bind
+  mount point nor anything under one — it can reach both,
+  which `docker-compose.yml` really does arrange (`DEV_MAIN_GIT` nests inside
+  `DEV_MAIN_TREE`, both bound at their host paths) — though only when the HOST
+  checkout sits under the container home prefix, which is not exotic: this
+  repo's own main checkout is `/home/vscode/repos/github/devcontainer`.
+  Everything at or below a bind mount point is the host side. Binds cannot
+  simply be excluded from the walk instead: the daemon creates a bind target's
+  missing parents as root exactly as it does a volume's, and that is what left
+  `~/.claude/projects` unwritable (#106)
+  (test: `tests/test-volume-chown-guard.sh`).
+- Those two sentences are about the DISPATCHER and the ANCESTOR WALK. Neither
+  says a bind is never recursed into, because it is: `chown -R` rooted at a
+  volume has no mount awareness and descends through any bind nested under
+  that volume — the transcript bind inside `claude-home`, i.e. the #106
+  topology itself (`unguarded`: predates the ancestor-walk work and is latent
+  only incidentally — both images pre-create `~/.claude` user-owned and
+  `setup_claude` re-chowns the top every up, so the guard's precondition (a
+  volume root not already user-owned) is not normally met. Closing it means
+  replacing `chown -R` with a pruned `find`, which also rewrites the
+  post-order rationale the cold-start guard rests on — filed as #115 with the
+  options. `-xdev` is the tempting variant and is worse: it stops at every
+  filesystem boundary, changing behaviour for reasons unrelated to this
+  invariant. The suite pins the current, unsafe behaviour rather than
+  asserting the safe one).
+- The chown driver reads mount points from `dc config`, so the compose query in
+  `mount_point_targets` decides what the lib ever sees; the query itself needs
+  docker, but the python snippet inside it is lifted out and run against a
+  synthetic config document (test: `tests/test-volume-chown-guard.sh`).
 - Lock discipline: per-worktree lock on fd 9, repo-scoped build lock on fd 8;
   any helper backgrounded inside the locked region must be spawned with
   `9>&-` or it holds the worktree lock forever (`test:
diff --git a/dev/devcontainer b/dev/devcontainer
index 97bcfa3..15ff181 100755
--- a/dev/devcontainer
+++ b/dev/devcontainer
@@ -778,25 +778,35 @@ require_tty() {
 # this line would silently run without the host mounts.
 generate_host_mounts_override
 
-# Named-volume mount targets from the merged compose config — these come
-# up root-owned and need chowning before user-mode setup runs. Deriving
+# Mount targets from the merged compose config, as `<kind>:<target>` — these
+# come up root-owned and need chowning before user-mode setup runs. Deriving
 # from compose means projects only declare volumes in compose.override.yml.
-named_volume_targets() {
+#
+# Binds are emitted alongside volumes because only their ANCESTORS are repaired
+# (lib/volume-perms.sh never DISPATCHES a bind into its recursive branch, and
+# its ancestor walk never chowns a bind mount point or anything under one — but
+# see #115 below for what that does not cover). A bind nested under a named
+# volume — the
+# transcript bind at ~/.claude/projects/<key>, inside claude-home — makes the
+# daemon create the intervening directories as root, and nothing else repairs
+# them (#106). The recursion rooted at a volume is a separate matter: it still
+# descends through a bind nested under that volume (#115).
+mount_point_targets() {
     local cfg
     cfg="$(dc config --format=json)" || {
-        echo "error: 'docker compose config' failed — cannot derive named-volume mount targets" >&2
+        echo "error: 'docker compose config' failed — cannot derive mount targets" >&2
         return 1
     }
     printf '%s' "$cfg" | python3 -c '
 import json, sys
 cfg = json.load(sys.stdin)
 for v in cfg.get("services", {}).get("app", {}).get("volumes") or []:
-    if v.get("type") == "volume" and v.get("target"):
-        print(v["target"])
+    if v.get("type") in ("volume", "bind") and v.get("target"):
+        print(v["type"] + ":" + v["target"])
 '
 }
 
-# Chown the named-volume mount points to the container user. The logic lives in
+# Chown the mount points to the container user. The logic lives in
 # lib/volume-perms.sh (unit-tested by tests/test-volume-chown-guard.sh) and is
 # injected into the container as the `sh -c` script with the mount points as
 # positional args — it runs in the container, but nothing COPYs it into the
@@ -805,12 +815,12 @@ for v in cfg.get("services", {}).get("app", {}).get("volumes") or []:
 # Note this is called on EVERY cold start, not just the first (setup() is gated
 # only on `is_running`), which is why the recursive chown is guarded inside the
 # lib rather than run unconditionally.
-chown_named_volume_targets() {
+chown_mount_points() {
     local targets_out
-    # Command substitution, not a pipe: named_volume_targets fails loudly when
+    # Command substitution, not a pipe: mount_point_targets fails loudly when
     # `dc config` does, and `|| return 1` propagates that instead of letting the
     # downstream exit status mask it.
-    targets_out="$(named_volume_targets)" || return 1
+    targets_out="$(mount_point_targets)" || return 1
 
     local targets=() t
     while IFS= read -r t; do
@@ -821,18 +831,18 @@ chown_named_volume_targets() {
     local script
     script="$(cat "$DEV_BASE_DIR/lib/volume-perms.sh")" || return 1
     script="$script"'
-dev_chown_volume_targets vscode vscode /home/vscode "$@"'
+dev_chown_mount_points vscode vscode /home/vscode "$@"'
 
     # `sh -c <script> <argv0> <args...>`: the first operand after the script is
     # $0, so the mount points land in "$@" for the driver line above.
     dc exec -T -u root app sh -c "$script" volume-perms "${targets[@]}"
 }
 
-# First-run setup: chown root-owned named-volume mount points, set up the
+# First-run setup: chown root-owned mount points, set up the
 # host-path symlink for tools that persist absolute paths, then delegate
 # to the project's setup-env first-run.
 setup() {
-    chown_named_volume_targets
+    chown_mount_points
 
     if [ "$DEV_WORKSPACE" != "$DEV_CONTAINER_WORKSPACE" ] \
         && [ "$DEV_WORKSPACE" != "$DEV_MAIN_TREE" ]; then
diff --git a/lib/host-bridge.sh b/lib/host-bridge.sh
index 59517ab..91a63c3 100644
--- a/lib/host-bridge.sh
+++ b/lib/host-bridge.sh
@@ -390,8 +390,16 @@ setup_claude() {
     local container_project_key="$DEV_CONTAINER_PROJECT_KEY"
 
     # Named volume root comes up root-owned; fix so vscode can write. Top-level
-    # is enough — setup-claude creates the contents as vscode. (There is no
-    # longer a credentials/ bind mount to avoid recursing into.)
+    # only, deliberately: setup-claude creates the contents as vscode, and a
+    # recursive chown here would cross into the transcript bind mounted at
+    # .claude/projects/<key> and rewrite ownership on the host side.
+    #
+    # It is NOT sufficient on its own. `.claude/projects` is created by the
+    # DAEMON as root to host that bind, so nothing below this line repairs it —
+    # that is dev_chown_mount_points' ancestor walk (lib/volume-perms.sh),
+    # which runs in setup() earlier in this same locked region (#106). setup()
+    # is cold-start only, so a container already running when that fix landed
+    # keeps the root-owned dir until its next recreate.
     dc exec -u root app chown vscode:vscode /home/vscode/.claude
 
     dc exec \
diff --git a/lib/volume-perms.sh b/lib/volume-perms.sh
index 6aaf5dd..95ee991 100644
--- a/lib/volume-perms.sh
+++ b/lib/volume-perms.sh
@@ -1,5 +1,5 @@
 # shellcheck shell=sh
-# Ownership repair for named-volume mount points, factored out of setup() in
+# Ownership repair for container mount points, factored out of setup() in
 # dev/devcontainer so it can be unit-tested without docker
 # (tests/test-volume-chown-guard.sh). Runs INSIDE the container as root: the
 # caller reads this file on the host and injects it into `dc exec ... sh -c`,
@@ -12,6 +12,23 @@
 # don't exist in the image (e.g. /home/vscode/.cache/uv) has those parents
 # created by the daemon, also root-owned.
 #
+# BINDS ARE IN SCOPE FOR THE ANCESTOR WALK ONLY. The daemon creates a bind
+# target's missing parents as root exactly as it does a volume's, and nothing
+# else ever repairs them: that is what left ~/.claude/projects root-owned and
+# unwritable, since the transcript bind mounts at ~/.claude/projects/<key>
+# inside the claude-home volume (#106). Everything at or below a bind mount
+# point is the HOST side, so a bind is never recursed INTO and the ancestor
+# walk never chowns a bind mount point — see _vp_never_chown.
+#
+# What that does NOT cover, and this is deliberate and recorded (#115): the
+# recursive branch below is rooted at a VOLUME and `chown -R` has no mount
+# awareness, so it still descends through a bind nested UNDER that volume —
+# exactly the claude-home / transcript-bind topology above. That predates the
+# ancestor-walk work and is latent only because the guard's precondition (a
+# volume root not already user-owned) is not normally met. Do not read
+# _vp_never_chown as protecting the recursion; it is consulted by
+# dev_chown_ancestors alone.
+#
 # THE GUARD (why the recursion is conditional):
 #   setup() is named "first-run" but is gated only on `is_running`, so it re-runs
 #   on every cold start — after a host reboot, a `devcontainer down`, or a
@@ -58,36 +75,175 @@ dev_volume_chown_needed() {
     return 0
 }
 
-# dev_chown_volume_targets <owner> <group> <home-prefix> <mount-point>... —
-# chown each mount point (recursively, guarded) and its <home-prefix>-scoped
-# ancestors to <owner>:<group>. Ancestors are walked upward only while still
-# strictly under <home-prefix>, so <home-prefix> itself and anything outside it
-# (notably the bind-mounted host workspace) are never touched.
+_vp_nl='
+'
+
+# Paths the ancestor walk must never chown, newline-delimited and
+# newline-terminated at both ends so a `case` glob tests membership exactly
+# (a path may contain spaces and glob metacharacters, so neither is usable as a
+# delimiter). A path may legally contain a newline too — but such a target is
+# already unrepresentable upstream, where chown_mount_points reads the compose
+# query's output line by line, so nothing reaches here that this could split.
+#
+# dev_chown_mount_points fills this with every BIND target, because an ancestor
+# can itself be a bind mount point — chowning it writes to the host side. This
+# is not hypothetical: docker-compose.yml mounts DEV_MAIN_TREE and DEV_MAIN_GIT
+# at their HOST paths, and DEV_MAIN_GIT (<tree>/.git) nests inside DEV_MAIN_TREE,
+# so on a host whose checkout lives under the container home prefix (a host user
+# named `vscode`; Codespaces) the walk up from the .git target reaches the
+# worktree bind and would rewrite ownership of the user's real repo directory.
+#
+# Empty when dev_chown_volume_targets is driven directly — that entry point is
+# unchanged, and with no bind targets declared there is nothing to protect.
+_vp_never_chown=""
+
+# _vp_is_protected <path> — true when <path> is on the host side of a bind
+# recorded by dev_chown_mount_points: either a bind mount point itself, or a
+# path UNDER one. The expansions in the patterns are quoted, so a path
+# containing glob metacharacters is compared literally rather than matched.
+#
+# The under-a-bind case is not redundant. An exact-match-only test protects the
+# mount point but not the directories inside it, and the ancestor walk reaches
+# those whenever one bind nests two or more levels under another — e.g. binds at
+# /home/vscode/data and /home/vscode/data/secrets/keys leave the walk chowning
+# /home/vscode/data/secrets, which is host-side. docker-compose.yml itself only
+# nests one level deep (<tree>/.git directly under <tree>), but host-mounts.txt
+# accepts arbitrary <host>:<container> pairs with no depth restriction
+# (lib/host-mounts.sh), so the deeper shape is reachable in a user's config.
+_vp_is_protected() {
+    [ -n "$_vp_never_chown" ] || return 1
+
+    case "$_vp_never_chown" in
+        *"$_vp_nl$1$_vp_nl"*) return 0 ;;
+    esac
+
+    # Walk the set entry by entry, testing whether <path> lies under any of
+    # them. _vpx_-prefixed so this cannot clobber the ancestor walk's iterator.
+    _vpx_rest="${_vp_never_chown#"$_vp_nl"}"
+    while [ -n "$_vpx_rest" ]; do
+        # Termination precondition: every entry is newline-TERMINATED. Without
+        # a trailing newline the `#*nl` strip removes nothing and this loops
+        # forever — confirmed under dash. Unreachable via the only writer
+        # (dev_chown_mount_points always appends one), but this runs as root
+        # inside `dc exec` on every cold start, so a future writer that drops
+        # the terminator would turn a wrong answer into a startup HANG.
+        case "$_vpx_rest" in
+            *"$_vp_nl"*) ;;
+            *) break ;;
+        esac
+        _vpx_e="${_vpx_rest%%"$_vp_nl"*}"
+        _vpx_rest="${_vpx_rest#*"$_vp_nl"}"
+        [ -n "$_vpx_e" ] || continue
+        case "$1" in
+            "$_vpx_e"/*) return 0 ;;
+        esac
+    done
+
+    return 1
+}
+
+# dev_chown_ancestors <owner> <group> <home-prefix> <path>... — chown each
+# path's <home-prefix>-scoped ancestors to <owner>:<group>. Ancestors are walked
+# upward only while still strictly under <home-prefix>, so <home-prefix> itself
+# and anything outside it (notably the bind-mounted host workspace) are never
+# touched, and any ancestor that is itself a bind mount point is skipped while
+# the walk continues past it — its own parents are still container-side.
+#
+# The paths themselves are NOT chowned and nothing recurses. That is what makes
+# this safe to point at a bind mount point.
 #
 # chown failures are tolerated: the mount point may be on a read-only or
 # ownership-fixed filesystem, and a hard failure here would abort a cold start
 # that user-mode setup may well survive.
-dev_chown_volume_targets() {
-    _vp_user="$1"
-    _vp_group="$2"
-    _vp_home="$3"
+dev_chown_ancestors() {
+    _vpa_user="$1"
+    _vpa_group="$2"
+    _vpa_home="$3"
     shift 3
 
-    for _vp_d in "$@"; do
-        [ -n "$_vp_d" ] || continue
-
-        if dev_volume_chown_needed "$_vp_d" "$_vp_user" "$_vp_group"; then
-            chown -R "$_vp_user:$_vp_group" "$_vp_d" 2>/dev/null || true
-        fi
+    for _vpa_d in "$@"; do
+        [ -n "$_vpa_d" ] || continue
 
-        _vp_p="$(dirname "$_vp_d")"
-        while [ "$_vp_p" != "/" ] && [ "$_vp_p" != "." ]; do
-            case "$_vp_p" in
-                "$_vp_home"/*) ;;
+        _vpa_p="$(dirname "$_vpa_d")"
+        while [ "$_vpa_p" != "/" ] && [ "$_vpa_p" != "." ]; do
+            case "$_vpa_p" in
+                "$_vpa_home"/*) ;;
                 *) break ;;
             esac
-            chown "$_vp_user:$_vp_group" "$_vp_p" 2>/dev/null || true
-            _vp_p="$(dirname "$_vp_p")"
+            if ! _vp_is_protected "$_vpa_p"; then
+                chown "$_vpa_user:$_vpa_group" "$_vpa_p" 2>/dev/null || true
+            fi
+            _vpa_p="$(dirname "$_vpa_p")"
         done
     done
 }
+
+# dev_chown_volume_targets <owner> <group> <home-prefix> <mount-point>... —
+# chown each mount point (recursively, guarded) and its <home-prefix>-scoped
+# ancestors to <owner>:<group>.
+#
+# Loop variables are _vpt_-prefixed, not _vpa_: these are shell globals (POSIX
+# sh has no `local`), so sharing a prefix with dev_chown_ancestors would let the
+# callee clobber this loop's iterator mid-walk.
+dev_chown_volume_targets() {
+    _vpt_user="$1"
+    _vpt_group="$2"
+    _vpt_home="$3"
+    shift 3
+
+    for _vpt_d in "$@"; do
+        [ -n "$_vpt_d" ] || continue
+
+        if dev_volume_chown_needed "$_vpt_d" "$_vpt_user" "$_vpt_group"; then
+            chown -R "$_vpt_user:$_vpt_group" "$_vpt_d" 2>/dev/null || true
+        fi
+
+        dev_chown_ancestors "$_vpt_user" "$_vpt_group" "$_vpt_home" "$_vpt_d"
+    done
+}
+
+# dev_chown_mount_points <owner> <group> <home-prefix> <kind>:<mount-point>... —
+# dispatch by compose mount type. `volume` gets the guarded recursive chown plus
+# its ancestors; `bind` gets ancestors ONLY.
+#
+# An unknown kind is skipped rather than guessed at: the recursive branch is the
+# destructive one, so a compose mount type this lib has not been taught about
+# (tmpfs, npipe, cluster) must not fall into it.
+dev_chown_mount_points() {
+    _vpm_user="$1"
+    _vpm_group="$2"
+    _vpm_home="$3"
+    shift 3
+
+    # Bind targets are collected in a FIRST pass: the protection has to cover
+    # every bind before any walk runs, or the order of the argument list decides
+    # whether a host directory gets chowned.
+    _vp_never_chown="$_vp_nl"
+    for _vpm_a in "$@"; do
+        case "$_vpm_a" in
+            bind:?*) _vp_never_chown="$_vp_never_chown${_vpm_a#bind:}$_vp_nl" ;;
+        esac
+    done
+
+    for _vpm_a in "$@"; do
+        [ -n "$_vpm_a" ] || continue
+        _vpm_kind="${_vpm_a%%:*}"
+        _vpm_d="${_vpm_a#*:}"
+        [ -n "$_vpm_d" ] || continue
+
+        case "$_vpm_kind" in
+            volume)
+                dev_chown_volume_targets "$_vpm_user" "$_vpm_group" \
+                    "$_vpm_home" "$_vpm_d"
+                ;;
+            bind)
+                dev_chown_ancestors "$_vpm_user" "$_vpm_group" \
+                    "$_vpm_home" "$_vpm_d"
+                ;;
+        esac
+    done
+
+    # Scoped to this call: a later direct dev_chown_volume_targets must not
+    # inherit protections derived from a compose config it was not given.
+    _vp_never_chown=""
+}
diff --git a/tests/test-volume-chown-guard.sh b/tests/test-volume-chown-guard.sh
index 42238e4..ed11860 100755
--- a/tests/test-volume-chown-guard.sh
+++ b/tests/test-volume-chown-guard.sh
@@ -1,10 +1,10 @@
 #!/usr/bin/env bash
-# Tests for the guarded named-volume chown (lib/volume-perms.sh, driven by
-# chown_named_volume_targets in dev/devcontainer). Exercises the GUARD DECISION
-# in isolation — no docker, no root, no real volume — by sourcing the shipped lib
-# and stubbing `chown` on PATH so every invocation is recorded instead of
-# performed. `stat` is NOT stubbed: the ownership probe runs for real against
-# temp dirs the suite owns.
+# Tests for the guarded mount-point chown (lib/volume-perms.sh, driven by
+# chown_mount_points in dev/devcontainer). Exercises the GUARD DECISION and the
+# bind/volume DISPATCH in isolation — no docker, no root, no real volume — by
+# sourcing the shipped lib and stubbing `chown` on PATH so every invocation is
+# recorded instead of performed. `stat` is NOT stubbed: the ownership probe runs
+# for real against temp dirs the suite owns.
 #
 # Modelling the two states without root: the guard compares owner/group NAMES,
 # so a name that cannot match any real owner ("$MISMATCH_OWNER") models a fresh
@@ -20,7 +20,75 @@
 #   4. ancestor walking stops at the home prefix and never leaves it
 #   5. `chown -R` is post-order, the invariant the guard rests on: an interrupted
 #      run leaves the mount point unchowned, so it can't be read as completed
-#   6. the dev/devcontainer driver line still matches the lib's function
+#   6. bind/volume dispatch: a bind gets its daemon-created ancestors repaired
+#      but is never DISPATCHED into the recursive branch, a volume still gets
+#      both, an unknown kind gets nothing
+#   7. the ANCESTOR WALK never lands a chown on a bind mount point or on
+#      anything under one, including when one bind nests inside another
+#      (DEV_MAIN_GIT inside DEV_MAIN_TREE, and the deeper host-mounts.txt
+#      shape) — those paths are the host side of the mount. The RECURSIVE
+#      branch is not covered by any of that and the suite says so: a bind
+#      nested under a volume is still reached, pinned as current behaviour
+#      (#115)
+#   8. the compose query emits kind-qualified volume AND bind targets, checked
+#      by running dev/devcontainer's own python snippet against a document
+#   9. the dev/devcontainer driver line still matches the lib's function
+#
+# Verified (ADR-0005 §2), seven mutations. Counts and assertion names below are
+# transcribed from the runs — see the METHOD note at the end, because three
+# earlier versions of this record were wrong.
+#   1. mount_point_targets' filter reverted to the pre-#106 `type == "volume"`
+#      — 3 red: "the compose query emits BIND targets too (the #106 fix)", the
+#      kind-set anti-vacuity assertion (the generic extraction finds no
+#      `in (...)` tuple at all), and the kind-set comparison. Item 8 is the
+#      only thing that sees the compose query; everything else drives the lib.
+#   2. the `_vp_is_protected` check dropped from dev_chown_ancestors — 6 red,
+#      all in item 7.
+#   3. the `bind)` dispatch arm routed to dev_chown_volume_targets — 1 red,
+#      "a bind target is never recursed into". NOT the deep-nesting assertions:
+#      they are line-anchored on `<owner> <path>` and this mutation logs
+#      `-R <owner> <path>`, a different whole line. Coverage for this mutation
+#      is exactly one assertion, which is worth knowing before relying on it.
+#   4. the `_vp_never_chown=""` reset deleted, leaking the exclusion set into a
+#      later direct dev_chown_volume_targets call — 1 red, "a direct
+#      volume-targets call does not inherit protections". That assertion was
+#      FAIL-OPEN as first written (assert_contains with a needle that is a
+#      PREFIX of the recursive line): it passed with the leak live and the
+#      suite stayed at 41/0. Found in review, not by me.
+#   5. the under-a-bind arm of _vp_is_protected removed, leaving exact-match
+#      only — 1 red, "a directory INSIDE a bind is not chowned (not just the
+#      mount point)".
+#   6. the ancestor walk changed to `break` at a protected bind instead of
+#      skipping past it — 1 red, "the walk continues PAST a protected bind to
+#      the dirs above it". That assertion was ALSO fail-open until this round:
+#      it read the log of a call where the protected bind was itself an
+#      argument, so its own walk chowned everything above it and the assertion
+#      passed either way. It now drives dev_chown_ancestors directly with a
+#      hand-filled exclusion set. (Skip and break are outcome-equivalent for
+#      every input reachable through dev_chown_mount_points, so this pins a
+#      documented behaviour rather than fixing a live bug.)
+#   7. the whole `bind)` dispatch arm deleted — 3 red, including the kind-set
+#      comparison, which is what proves that guard derives both sides rather
+#      than restating a vocabulary.
+#
+# METHOD: measure each mutation in a FRESH copy of the tree, and transcribe the
+# numbers from the run rather than reasoning about them. Three earlier versions
+# of this record were wrong — counts inflated, and one mutation credited with
+# reds belonging to another.
+#
+# What is established: hand-measured counts taken from a single scratch copy
+# reused across mutations disagreed with counts re-measured one-copy-per-
+# mutation, and the latter reproduce. What is NOT established is why the reused
+# copy drifted: an earlier draft of this note blamed `git checkout` failing to
+# restore in a `cp -a` copy of a linked worktree, and that does not reproduce —
+# the copy's gitdir resolves and the restore works. Something else in that loop
+# accumulated state. The prescription stands on the reproducibility of the
+# fresh-copy numbers, not on the diagnosis.
+#
+# tests/mutation-coverage automates this (fresh copy per mutation, plus it
+# flags a mutation that changed nothing). It is not in this tree — it ships on
+# the branch behind PR #124.
+#   (mutation runs 2026-08-04)
 set -euo pipefail
 
 . "$(dirname "$(readlink -f "$0")")/lib/harness.sh"
@@ -56,7 +124,7 @@ run() {
 
 log() { cat "$CHOWN_LOG"; }
 
-echo "=== named-volume chown guard tests ==="
+echo "=== mount-point chown guard tests ==="
 
 # ---- 1. the guard decision ----
 home="$tmp/home/vscode"
@@ -153,22 +221,229 @@ else
         "'$order_root/sub/file'" "${order_lines[0]}"
 fi
 
-# ---- 6. the dev/devcontainer driver line matches the lib ----
-# chown_named_volume_targets injects the lib into the container and appends this
+# ---- 6. bind vs volume dispatch: a bind is never recursed into ----
+# The daemon creates a mount target's missing parents as root for binds exactly
+# as for volumes (~/.claude/projects, hosting the transcript bind under the
+# claude-home volume), so those ancestors must be repaired. Recursing into the
+# target itself must NOT happen for a bind: the walk would cross into the host
+# side and rewrite ownership there.
+#
+# Both cases use MISMATCH_OWNER so the guard would ALLOW the recursion — the
+# bind case therefore proves dispatch, not a guard that happened to skip.
+run_mp() {
+    : >"$CHOWN_LOG"
+    dev_chown_mount_points "$@"
+}
+
+mp_home="$tmp/mp/vscode"
+mp_target="$mp_home/.claude/projects/-devcontainer-x"
+mkdir -p "$mp_target"
+
+run_mp "$MISMATCH_OWNER" "$MISMATCH_OWNER" "$mp_home" "bind:$mp_target"
+assert_not_contains "a bind target is never recursed into" "-R " "$(log)"
+# Line-anchored: this needle is a strict PREFIX of the bind-target line
+# ("… /projects" vs "… /projects/-devcontainer-x"), so assert_contains passes
+# on a mutant that chowns the target instead of its parent — verified. Third
+# instance of that trap in this file; the neighbours below are anchored for the
+# same reason.
+assert_true "a bind target's daemon-created parent is chowned" \
+    grep -qxF "$MISMATCH_OWNER:$MISMATCH_OWNER $mp_home/.claude/projects" "$CHOWN_LOG"
+assert_false "a bind target itself is not chowned" \
+    grep -qxF "$MISMATCH_OWNER:$MISMATCH_OWNER $mp_target" "$CHOWN_LOG"
+
+run_mp "$MISMATCH_OWNER" "$MISMATCH_OWNER" "$mp_home" "volume:$mp_target"
+assert_contains "a volume target still gets the recursive chown" \
+    "-R $MISMATCH_OWNER:$MISMATCH_OWNER $mp_target" "$(log)"
+# Line-anchored for the same reason as the direct-call assertion at the end of
+# item 7: the recursive line `-R <owner> <mp_target>` contains this needle as a
+# substring, so assert_contains here would pass with the ancestor walk removed.
+assert_true "a volume target's ancestors are still chowned" \
+    grep -qxF "$MISMATCH_OWNER:$MISMATCH_OWNER $mp_home/.claude/projects" "$CHOWN_LOG"
+
+# An unrecognised kind must fall through to nothing: the recursive branch is the
+# destructive one, so a mount type the lib has not been taught about (tmpfs,
+# npipe, cluster) must not reach it by default.
+run_mp "$MISMATCH_OWNER" "$MISMATCH_OWNER" "$mp_home" "tmpfs:$mp_target"
+assert_eq "an unknown mount kind is skipped entirely" "" "$(log)"
+
+# An entry with no kind separator at all is skipped for the same reason.
+run_mp "$MISMATCH_OWNER" "$MISMATCH_OWNER" "$mp_home" "$mp_target"
+assert_eq "an unqualified target (no <kind>: prefix) is skipped" "" "$(log)"
+
+# ---- 7. a bind mount point is never chowned, however it is reached ----
+# docker-compose.yml mounts DEV_MAIN_TREE and DEV_MAIN_GIT at their HOST paths,
+# and <tree>/.git nests inside <tree>. On a host whose checkout lives under the
+# container home prefix (a host user named `vscode`; Codespaces), walking up
+# from the .git bind reaches the worktree bind — which is the host side of a
+# mount, i.e. the user's real repo directory. It must be skipped, while the
+# walk continues past it to the container-side dirs above.
+tree="$mp_home/repos/proj"
+gitdir="$tree/.git"
+mkdir -p "$gitdir"
+
+run_mp "$MISMATCH_OWNER" "$MISMATCH_OWNER" "$mp_home" "bind:$tree" "bind:$gitdir"
+assert_false "a nested bind's parent bind is never chowned" \
+    grep -qxF "$MISMATCH_OWNER:$MISMATCH_OWNER $tree" "$CHOWN_LOG"
+
+# "Continues past" needs the protected bind to NOT be in the argument list —
+# otherwise its own walk chowns everything above it and the assertion passes
+# whether the walk skips or breaks. Verified: mutating the skip to a `break`
+# left the suite fully green before this was rewritten. So drive the walk
+# directly with a hand-filled exclusion set naming a bind that is not an
+# argument.
+: >"$CHOWN_LOG"
+# shellcheck disable=SC2154  # _vp_nl comes from the sourced lib above; building
+# the set with the lib's own delimiter is the point — a literal newline here
+# would stop tracking it if the lib ever changed delimiters.
+_vp_never_chown="$_vp_nl$tree$_vp_nl"
+dev_chown_ancestors "$MISMATCH_OWNER" "$MISMATCH_OWNER" "$mp_home" "$gitdir"
+_vp_never_chown=""
+assert_true "the walk continues PAST a protected bind to the dirs above it" \
+    grep -qxF "$MISMATCH_OWNER:$MISMATCH_OWNER $mp_home/repos" "$CHOWN_LOG"
+assert_false "...while still not chowning the protected bind itself" \
+    grep -qxF "$MISMATCH_OWNER:$MISMATCH_OWNER $tree" "$CHOWN_LOG"
+
+# Protection is order-independent: the bind targets are collected in a first
+# pass, so it holds whichever order compose emits them in.
+run_mp "$MISMATCH_OWNER" "$MISMATCH_OWNER" "$mp_home" "bind:$gitdir" "bind:$tree"
+assert_false "protection does not depend on argument order" \
+    grep -qxF "$MISMATCH_OWNER:$MISMATCH_OWNER $tree" "$CHOWN_LOG"
+# Paired positive: without it the negative above passes on an empty log, so a
+# run that chowned NOTHING would read as a protected one (the #95-#97 shape).
+assert_contains "reversed order still repairs the container-side ancestor" \
+    "$MISMATCH_OWNER:$MISMATCH_OWNER $mp_home/repos" "$(log)"
+
+# A bind nesting TWO levels under another bind: the intermediate directory is
+# inside the outer bind, so it is host-side even though it is not itself a mount
+# point. An exact-match-only protection would chown it. Not reachable from
+# docker-compose.yml (which nests one level, <tree>/.git under <tree>) but
+# reachable from host-mounts.txt, which takes arbitrary <host>:<container>.
+deep_outer="$mp_home/data"
+deep_inner="$deep_outer/secrets/keys"
+mkdir -p "$deep_inner"
+run_mp "$MISMATCH_OWNER" "$MISMATCH_OWNER" "$mp_home" \
+    "bind:$deep_outer" "bind:$deep_inner"
+assert_false "a directory INSIDE a bind is not chowned (not just the mount point)" \
+    grep -qxF "$MISMATCH_OWNER:$MISMATCH_OWNER $deep_outer/secrets" "$CHOWN_LOG"
+assert_false "the outer bind mount point is still not chowned" \
+    grep -qxF "$MISMATCH_OWNER:$MISMATCH_OWNER $deep_outer" "$CHOWN_LOG"
+
+# Same for a volume nested inside a bind (a venv volume under the worktree):
+# the volume is recursed into, its bind parent still is not.
+venv="$tree/.venv"
+mkdir -p "$venv"
+run_mp "$MISMATCH_OWNER" "$MISMATCH_OWNER" "$mp_home" "bind:$tree" "volume:$venv"
+assert_contains "a volume nested in a bind is still recursed into" \
+    "-R $MISMATCH_OWNER:$MISMATCH_OWNER $venv" "$(log)"
+assert_false "a volume's ancestor walk also skips the bind mount point" \
+    grep -qxF "$MISMATCH_OWNER:$MISMATCH_OWNER $tree" "$CHOWN_LOG"
+
+# The SHIPPED direction, pinned honestly: a bind nested UNDER a volume is still
+# reached by the recursion. `chown -R` has no mount awareness, and
+# _vp_never_chown is consulted by dev_chown_ancestors alone, so the recursive
+# branch descends through the bind — the claude-home / transcript-bind topology.
+# This asserts what the code DOES, not what it should do; #115 tracks the fix
+# and this assertion is its red-to-green target. Item 7's other cases cover the
+# opposite nesting (a volume under a bind), which is the safe one — without this
+# the suite would read as having covered both.
+#
+# What it actually observes, stated plainly: `chown` is STUBBED here, so this
+# witnesses the unpruned `chown -R` being INVOKED on a volume that contains a
+# bind — not the descent itself, which a stub cannot see. That invocation is the
+# observable proxy, and it is sufficient as a red-to-green target: both
+# candidate #115 fixes flip it (a pruned `find` emits no `-R` line at all).
+assert_contains "a volume containing a bind still gets the unpruned chown -R (#115)" \
+    "-R $MISMATCH_OWNER:$MISMATCH_OWNER $mp_home/.claude" "$(
+        : >"$CHOWN_LOG"
+        dev_chown_mount_points "$MISMATCH_OWNER" "$MISMATCH_OWNER" "$mp_home" \
+            "volume:$mp_home/.claude" "bind:$mp_target"
+        log
+    )"
+
+# The protection is scoped to the dispatching call: dev_chown_volume_targets is
+# still a usable entry point on its own and must not inherit a stale exclusion
+# set from a previous dev_chown_mount_points call.
+run "$MISMATCH_OWNER" "$MISMATCH_OWNER" "$mp_home" "$venv"
+# grep -qxF, NOT assert_contains: "$tree" is a PREFIX of "$venv", so a substring
+# check is satisfied by the recursive line `-R <owner> <tree>/.venv` and passes
+# even when the exclusion set leaks — the very leak this asserts against.
+# (Mutation: delete the `_vp_never_chown=""` reset and the substring form stays
+# green at 41/0. The line-anchored form goes red. Same trap the ancestor-walk
+# assertions above already avoid.)
+assert_true "a direct volume-targets call does not inherit protections" \
+    grep -qxF "$MISMATCH_OWNER:$MISMATCH_OWNER $tree" "$CHOWN_LOG"
+
+# ---- 8. the compose query emits kind-qualified volume AND bind targets ----
+# Derived, not restated: the python snippet is lifted out of mount_point_targets
+# in dev/devcontainer and run against a synthetic `docker compose config`
+# document, so a narrowed filter there fails HERE rather than only in a
+# container. `dc config` itself needs docker, which this suite does not have —
+# the snippet is the part that can be run hermetically.
+# `|| true` so an extraction that yields nothing reaches the anti-vacuity
+# assertion below. Without it a failing pipeline exits nonzero through this
+# substitution and `set -e` kills the suite AT THE ASSIGNMENT — the failure
+# channel becomes an undiagnosed abort, and the assertion written for exactly
+# that case never runs.
+query="$(awk "/python3 -c '\$/{f=1; next} f && /^'\$/{exit} f" "$DEV_BASE/dev/devcontainer" || true)"
+assert_true "the compose-query snippet was extracted from dev/devcontainer" \
+    test -n "$query"
+
+compose_json='{"services": {"app": {"volumes": [
+    {"type": "volume", "source": "claude-home", "target": "/home/vscode/.claude"},
+    {"type": "bind", "source": "/host/logs", "target": "/home/vscode/.claude/projects/-k"},
+    {"type": "tmpfs", "target": "/home/vscode/.claude/shell-snapshots"},
+    {"type": "volume", "source": "no-target"}
+]}}}'
+emitted="$(printf '%s' "$compose_json" | python3 -c "$query")"
+assert_contains "the compose query emits volume targets, kind-qualified" \
+    "volume:/home/vscode/.claude" "$emitted"
+assert_contains "the compose query emits BIND targets too (the #106 fix)" \
+    "bind:/home/vscode/.claude/projects/-k" "$emitted"
+assert_not_contains "the compose query skips mount kinds the lib cannot dispatch" \
+    "tmpfs:" "$emitted"
+assert_not_contains "the compose query skips a mount with no target" \
+    "no-target" "$emitted"
+
+# The mount kinds the query emits and the kinds the lib dispatches on are a
+# two-file coupling, so per the repo convention it gets a drift guard — and a
+# DERIVED one (ADR-0005): both sides are parsed out of their own source rather
+# than restated here. A kind emitted but not dispatched is silently skipped; a
+# kind dispatched but never emitted is dead code.
+# Both sides are parsed GENERICALLY — no vocabulary is written down here.
+# Enumerating the known kinds (volume|bind|tmpfs|npipe|cluster) made this a
+# third restatement: Compose's `image` mount type (v2.35+) was absent from it,
+# so a filter gaining "image" with no dispatcher arm would be invisible to both
+# extractions and the sets would stay equal. `|| true` so an extraction that
+# matches nothing reaches the anti-vacuity assertions below instead of aborting
+# the suite at the assignment.
+emitted_kinds="$(printf '%s\n' "$query" | grep -oE 'in \([^)]*\)' |
+    grep -oE '"[a-z]+"' | tr -d '"' | sort -u | tr '\n' ' ' || true)"
+dispatched_kinds="$(sed -n '/^dev_chown_mount_points()/,/^}/p' "$DEV_BASE/lib/volume-perms.sh" |
+    grep -oE '^[[:space:]]+[a-z]+\)$' |
+    tr -d ' )' | sort -u | tr '\n' ' ' || true)"
+assert_true "the compose query's kind set was parsed out of dev/devcontainer" \
+    test -n "$emitted_kinds"
+assert_true "the dispatcher's kind set was parsed out of lib/volume-perms.sh" \
+    test -n "$dispatched_kinds"
+assert_eq "every kind the query emits is a kind the lib dispatches on" \
+    "$emitted_kinds" "$dispatched_kinds"
+
+# ---- 9. the dev/devcontainer driver line matches the lib ----
+# chown_mount_points injects the lib into the container and appends this
 # exact line; a rename on either side would otherwise fail only at runtime.
-driver='dev_chown_volume_targets vscode vscode /home/vscode "$@"'
+driver='dev_chown_mount_points vscode vscode /home/vscode "$@"'
 assert_true "dev/devcontainer drives the lib's function with (vscode, vscode, /home/vscode, \$@)" \
     grep -qF "$driver" "$DEV_BASE/dev/devcontainer"
 
 # The injected script must be valid POSIX sh and must pick the mount points out
 # of "$@" — the `sh -c <script> <argv0> <args...>` convention the caller relies
-# on. Composed here the same way chown_named_volume_targets composes it.
+# on. Composed here the same way chown_mount_points composes it.
 script="$(cat "$DEV_BASE/lib/volume-perms.sh")
 $driver"
 assert_true "injected script parses as POSIX sh" sh -n -c "$script"
 
 : >"$CHOWN_LOG"
-sh -c "$script" volume-perms "/home/vscode/.cache/uv"
+sh -c "$script" volume-perms "volume:/home/vscode/.cache/uv"
 # assert_contains, not assert_eq: the guard probes the REAL /home/vscode/.cache/uv,
 # so on a machine where that path exists with a non-vscode owner a chown -R line
 # is also (correctly) logged. Only the unconditional ancestor chown is

From 0f21a58eb92d72ad5641d57e777b46dc29109436 Mon Sep 17 00:00:00 2001
From: t <t@t>
Date: Mon, 10 Aug 2026 15:43:56 -0400
Subject: [PATCH 2/6] fix(image): ship ~/.claude/projects so the daemon never
 creates it as root
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The ancestor walk added in this PR repairs the transcript bind's parent
after the daemon has created it root-owned. It only runs from setup(),
so an entry path that never calls dev/devcontainer — VS Code "Reopen in
Container" (#43), a bare `docker compose up` — still gets #106 back.

Pre-creating the directory in both image routes removes the failure
instead of repairing it: a fresh claude-home volume seeds from the image
path, so it comes up vscode-owned and the daemon has nothing left to
create under it.

The nix route carries this in the tail build rather than in
nix/base/flake.nix, where the sibling home dirs are pre-created: a fix
in the base reaches nobody until a republish AND a BASE_IMAGE repin
(#83), while the tail build runs for every project image. Its chown is
explicit because the remap chown above it is guarded on
USER_UID != 1000 and does not run at the default UID.

Guard: tests/test-volume-chown-guard.sh gains section 10 (47 -> 54
assertions). The directory is derived from docker-compose.yml as the
parent of the one target interpolating DEV_CONTAINER_PROJECT_KEY, not
restated. The mkdir/chown ordering is checked, not just their presence:
both Dockerfiles chown -R /home/vscode during the UID remap above these
lines, so a position-blind check would read that as coverage and stay
green on an image shipping the dir root-owned.

Verified (ADR-0005 §2), four mutations, fresh tree copy each:
  8.  /projects dropped from the root Dockerfile's mkdir -> 2 red
  9.  the nix tail RUN deleted -> 2 red
  10. that RUN's `&& chown` dropped, mkdir left -> 1 red (the ordering)
  11. the compose target moved to .claude/transcripts/<key>, both
      Dockerfiles untouched -> 4 red, naming the new path

bash tests/run-all -> 0 failures; pre-commit (shellcheck, hadolint) clean.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J8Q8kBDc2TtCF7ZzSwD3iX
---
 CLAUDE.md                        |  14 +++++
 Dockerfile                       |  12 +++-
 nix/base/Dockerfile.nix-default  |  14 +++++
 tests/test-volume-chown-guard.sh | 101 ++++++++++++++++++++++++++++++-
 4 files changed, 138 insertions(+), 3 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 58c7706..7b0ed58 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -270,6 +270,20 @@ taxonomy and reads as `test:`.
   `mount_point_targets` decides what the lib ever sees; the query itself needs
   docker, but the python snippet inside it is lifted out and run against a
   synthetic config document (test: `tests/test-volume-chown-guard.sh`).
+- BOTH image routes pre-create the transcript bind's parent
+  (`~/.claude/projects`) and chown it AFTER creating it, so a fresh
+  `claude-home` volume seeds it user-owned and the daemon never creates it as
+  root. This is belt to the ancestor walk's braces, and it covers what the walk
+  cannot: the walk runs in `setup()`, so an entry path that never calls
+  `dev/devcontainer` — VS Code "Reopen in Container" (#43), a bare `docker
+  compose up` — gets the root-owned directory and the #106 failure back. The
+  ordering is load-bearing: both Dockerfiles `chown -R /home/vscode` during the
+  UID remap, ABOVE these lines, where the directory does not exist yet. The nix
+  route carries it in the tail build rather than `nix/base/flake.nix` on
+  purpose — the base pre-creates the other home dirs, but a fix there reaches
+  nobody until a republish AND a `BASE_IMAGE` repin (#83), while the tail
+  rebuilds per project (test: `tests/test-volume-chown-guard.sh`, which derives
+  the directory from the compose target rather than restating it).
 - Lock discipline: per-worktree lock on fd 9, repo-scoped build lock on fd 8;
   any helper backgrounded inside the locked region must be spawned with
   `9>&-` or it holds the worktree lock forever (`test:
diff --git a/Dockerfile b/Dockerfile
index 673ad55..a546b0c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -88,7 +88,17 @@ RUN printf '. /usr/local/lib/devcontainer/claude-code-token-env.sh\n' \
 # No baked .credentials.json symlink: setup-claude seeds a private per-container
 # token into the claude-home volume from the :ro host profile store
 # (docs/adr/0001-devcontainer-private-token-isolation.md). Just create the dirs.
-RUN mkdir -p /home/vscode/.cache /home/vscode/.ssh /home/vscode/.claude \
+#
+# .claude/projects is here for a second reason: it is the parent of the
+# transcript bind (docker-compose.yml mounts the host log dir at
+# .claude/projects/<key>), so the daemon creates it as root if the image does
+# not ship it — the #106 defect. The ancestor walk in lib/volume-perms.sh
+# repairs that after the fact; creating it here means it is never wrong in the
+# first place, including on entry paths that never run `dev/devcontainer setup`
+# (VS Code "Reopen in Container", a bare `docker compose up`). A fresh
+# claude-home volume seeds from this path, so the volume inherits the dir
+# vscode-owned and the daemon has nothing left to create.
+RUN mkdir -p /home/vscode/.cache /home/vscode/.ssh /home/vscode/.claude/projects \
     && chown -R vscode:vscode /home/vscode/.cache /home/vscode/.ssh /home/vscode/.claude \
     && chmod 700 /home/vscode/.ssh
 
diff --git a/nix/base/Dockerfile.nix-default b/nix/base/Dockerfile.nix-default
index 6e0ae3e..a98862d 100644
--- a/nix/base/Dockerfile.nix-default
+++ b/nix/base/Dockerfile.nix-default
@@ -44,6 +44,20 @@ RUN if [ "$USER_GID" != "1000" ]; then groupmod -g "$USER_GID" vscode; fi \
         chown -R "$USER_UID:$USER_GID" /home/vscode; \
     fi
 
+# The transcript bind's parent, mirroring the root Dockerfile's mkdir. The Nix
+# base pre-creates the home dirs (nix/base/flake.nix fakeRootCommands) but not
+# this one, and adding it there would reach nobody until a republish AND a
+# BASE_IMAGE repin — so it lives in the tail build, which every nix-route image
+# rebuilds anyway. Without it the daemon creates .claude/projects as root to
+# host the bind that compose mounts at .claude/projects/<key> (#106).
+#
+# Explicitly chowned rather than left to the remap above: that chown is guarded
+# on USER_UID != 1000, so at the default UID it does not run and this dir would
+# stay root-owned. One empty dir, so this is not the fat-layer case the guard
+# exists to avoid.
+RUN mkdir -p /home/vscode/.claude/projects \
+    && chown "$USER_UID:$USER_GID" /home/vscode/.claude/projects
+
 # Shared helpers an overlay can source. Copied before install-system runs so a
 # build-time install-system.sh can source it too (e.g. nix-seed.sh). Inert for
 # overlays that don't use it.
diff --git a/tests/test-volume-chown-guard.sh b/tests/test-volume-chown-guard.sh
index ed11860..afc40c3 100755
--- a/tests/test-volume-chown-guard.sh
+++ b/tests/test-volume-chown-guard.sh
@@ -33,8 +33,13 @@
 #   8. the compose query emits kind-qualified volume AND bind targets, checked
 #      by running dev/devcontainer's own python snippet against a document
 #   9. the dev/devcontainer driver line still matches the lib's function
+#  10. both image routes ship the transcript bind's parent, created AND then
+#      chowned, so the daemon never has to create it as root — the half of
+#      #106 the ancestor walk cannot cover, because an entry path that skips
+#      setup() (VS Code "Reopen in Container") never runs the walk at all. The
+#      directory is derived from docker-compose.yml, not written down here.
 #
-# Verified (ADR-0005 §2), seven mutations. Counts and assertion names below are
+# Verified (ADR-0005 §2), eleven mutations. Counts and assertion names below are
 # transcribed from the runs — see the METHOD note at the end, because three
 # earlier versions of this record were wrong.
 #   1. mount_point_targets' filter reverted to the pre-#106 `type == "volume"`
@@ -70,6 +75,22 @@
 #   7. the whole `bind)` dispatch arm deleted — 3 red, including the kind-set
 #      comparison, which is what proves that guard derives both sides rather
 #      than restating a vocabulary.
+#   8. `/projects` dropped from the root Dockerfile's mkdir, back to the
+#      pre-#106 `mkdir -p ... /home/vscode/.claude` — 2 red, both in item 10.
+#      Two rather than one because the chown probe reports nothing once the
+#      mkdir is gone: there is no creation for a later chown to cover.
+#   9. the nix tail build's RUN deleted entirely — 2 red, the same pair for
+#      that route. The routes are checked independently, so neither mutation
+#      is masked by the other file being correct.
+#  10. that RUN's `&& chown` dropped, leaving only the mkdir — 1 red, "chowns
+#      it AFTER creating it". This is the one that pays for the ordering logic
+#      in `precreated`: both Dockerfiles chown -R /home/vscode ABOVE these
+#      lines, so a coverage test that ignored position would read that remap
+#      as ownership and stay green on an image shipping the dir root-owned.
+#  11. the compose target moved to .claude/transcripts/<key> with both
+#      Dockerfiles left alone — 4 red, and the failure names print
+#      `/home/vscode/.claude/transcripts`, which is what shows the expectation
+#      is read out of compose rather than restated in the assertions.
 #
 # METHOD: measure each mutation in a FRESH copy of the tree, and transcribe the
 # numbers from the run rather than reasoning about them. Three earlier versions
@@ -88,7 +109,7 @@
 # tests/mutation-coverage automates this (fresh copy per mutation, plus it
 # flags a mutation that changed nothing). It is not in this tree — it ships on
 # the branch behind PR #124.
-#   (mutation runs 2026-08-04)
+#   (mutation runs 2026-08-04; items 8-11 on 2026-08-10, fresh copy each)
 set -euo pipefail
 
 . "$(dirname "$(readlink -f "$0")")/lib/harness.sh"
@@ -451,4 +472,80 @@ sh -c "$script" volume-perms "volume:/home/vscode/.cache/uv"
 assert_contains "injected script: mount points arrive in \"\$@\" and resolve under /home/vscode" \
     "vscode:vscode /home/vscode/.cache" "$(log)"
 
+# ---- 10. both image routes pre-create the transcript bind's parent ----
+# The ancestor walk repairs that directory after the daemon has created it as
+# root; shipping it in the image means it is never root-owned to begin with,
+# which is the only thing that covers an entry path that never runs setup()
+# (VS Code "Reopen in Container", a bare `docker compose up`). Two images build
+# that path, so this is a three-file coupling — compose plus both Dockerfiles.
+#
+# DERIVED, not restated (ADR-0005): the directory is read out of
+# docker-compose.yml as the parent of the one mount target that interpolates
+# DEV_CONTAINER_PROJECT_KEY — that variable is what makes the target a
+# per-project subdirectory — so moving or renaming the transcript mount moves
+# this guard with it instead of leaving it asserting a stale literal.
+echo "--- transcript bind parent pre-created in both image routes ---"
+
+bind_target="$(awk '/^[[:space:]]*target:[[:space:]]/ && /DEV_CONTAINER_PROJECT_KEY/ {print $2}' \
+    "$DEV_BASE/docker-compose.yml")"
+assert_eq "exactly one compose target interpolates DEV_CONTAINER_PROJECT_KEY" \
+    1 "$(printf '%s' "$bind_target" | grep -c . || true)"
+# Cut at the interpolation and drop the trailing slash: the key is the leaf, so
+# what remains is the parent the daemon would otherwise create.
+bind_parent="${bind_target%%\$\{*}"
+bind_parent="${bind_parent%/}"
+assert_true "the transcript bind's parent derives to a path under /home/vscode" \
+    bash -c '[[ "$1" == /home/vscode/?* ]]' _ "$bind_parent"
+
+# precreated <dockerfile> <path> — prints `mkdir` when some mkdir creates
+# <path>, and `chown` when a LATER command gives it to the container user,
+# directly or by -R on an ancestor. Ordering is load-bearing and is why this
+# does not just grep for two words: BOTH Dockerfiles chown -R /home/vscode
+# ABOVE these lines (the UID remap), and a chown that runs before the mkdir
+# cannot own a directory that does not exist yet. Reading it as coverage would
+# leave the guard passing on an image whose dir ships root-owned — precisely
+# the state being guarded against.
+precreated() {
+    python3 - "$1" "$2" <<'PY'
+import re, sys
+
+# Join continuations first, as tests/lib/dockerfile.sh does, so a wrapped RUN
+# is one string. Commands are cut at &&, || and ; so one RUN's argv cannot bleed
+# into the next command's.
+text = open(sys.argv[1]).read().replace("\\\n", " ")
+path = sys.argv[2]
+
+def operands(cmd):
+    return [w.strip('"\'') for w in cmd.split()[1:] if not w.startswith("-")]
+
+mkdir_at = next((m.start() for m in re.finditer(r"mkdir[^&|;\n]*", text)
+                 if path in operands(m.group(0))), None)
+if mkdir_at is None:
+    sys.exit(0)
+print("mkdir")
+
+for m in re.finditer(r"chown[^&|;\n]*", text):
+    if m.start() < mkdir_at:
+        continue
+    words = m.group(0).split()
+    recursive = any(w.startswith("-") and "R" in w for w in words)
+    for target in (t.rstrip("/") for t in operands(m.group(0))[1:]):
+        if target == path or (recursive and (path + "/").startswith(target + "/")):
+            print("chown")
+            sys.exit(0)
+PY
+}
+
+for dockerfile in "$DEV_BASE/Dockerfile" "$DEV_BASE/nix/base/Dockerfile.nix-default"; do
+    route="${dockerfile#"$DEV_BASE/"}"
+    coverage="$(precreated "$dockerfile" "$bind_parent")"
+    assert_contains "$route creates $bind_parent" "mkdir" "$coverage"
+    assert_contains "$route chowns it AFTER creating it" "chown" "$coverage"
+done
+
+# Anti-vacuity: a parser that answered "mkdir" for anything would pass both
+# routes above while checking nothing.
+assert_eq "the parser reports nothing for a path no Dockerfile creates" \
+    "" "$(precreated "$DEV_BASE/Dockerfile" "$bind_parent-absent")"
+
 finish

From 148334083f51ddba062bf4e894b6d0a985c7ad5a Mon Sep 17 00:00:00 2001
From: t <t@t>
Date: Mon, 10 Aug 2026 16:11:28 -0400
Subject: [PATCH 3/6] ci: check the built images ship ~/.claude/projects
 writable
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Section 10 of tests/test-volume-chown-guard.sh reads Dockerfile TEXT: a
mkdir exists, a later chown covers it. That is a proxy. The fact it
stands in for — the BUILT image ships the directory writable by the
container user — needs a daemon, so per ADR-0005 it is typed `ci:` and
gets a real check rather than a second textual restatement.

dev/check-image-mount-parents derives the directory (the transcript
mount's target) and the owner (the service's `user:`) from
docker-compose.yml, then runs #106's own probe — mkdir inside it as that
user — against a built image. A stat comparison would pass on a
same-named owner with no write bit; only the mkdir answers the question
the bug asked. Wired into both build jobs: docker-build.yml on the
classic image, nix-base.yml on the tail image, per arch.

Verified against real images built locally:
  - current tree                     -> ok, exit 0
  - /projects dropped from the mkdir -> "does not ship ... at all", exit 1
  - dir created after the chown, so
    it ships root-owned                -> mkdir EACCES, exit 1, naming #106

The last case is the one a stat-only check could have gotten wrong and
the textual guard cannot see at all.

The hermetic suite keeps what it can hold of this half: both workflows
must invoke the checker (a checker no job runs is the #83 shape), the
checker must be executable (#129's shape), and it must not hardcode the
path it derives. 54 -> 58 assertions.

Verified (ADR-0005 §2), three more mutations, fresh copy each:
  12. the step deleted from docker-build.yml -> 1 red (the two workflows
      are asserted separately, so one route cannot hide behind the other)
  13. the derivation replaced by the literal it derives -> 1 red. Worth
      noting this mutation does NOT break the checker against today's
      images, which is why a literal there would go unnoticed until the
      mount moved
  14. the checker made non-executable -> 1 red

Also listed in the workflows' trigger paths, so an edit to the checker is
exercised by a build instead of first running on someone else's PR, and
added to the extensionless-shellcheck list.

bash tests/run-all -> 0 failures; pre-commit run --all-files -> all pass.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J8Q8kBDc2TtCF7ZzSwD3iX
---
 .github/workflows/docker-build.yml | 14 ++++++
 .github/workflows/nix-base.yml     | 14 ++++++
 .pre-commit-config.yaml            |  2 +-
 CLAUDE.md                          | 10 +++-
 dev/check-image-mount-parents      | 80 ++++++++++++++++++++++++++++++
 tests/test-volume-chown-guard.sh   | 38 +++++++++++++-
 6 files changed, 153 insertions(+), 5 deletions(-)
 create mode 100755 dev/check-image-mount-parents

diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
index ef960a5..bcafb4a 100644
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-build.yml
@@ -13,6 +13,9 @@ on:
       # Filters the repo-root build context, so it can break a COPY without
       # any COPY source changing.
       - .dockerignore
+      # Not a build input: the post-build check. Listed so an edit to it is
+      # exercised by a build rather than first running on someone else's PR.
+      - dev/check-image-mount-parents
   pull_request:
     branches: [main]
     paths:
@@ -25,6 +28,9 @@ on:
       # Filters the repo-root build context, so it can break a COPY without
       # any COPY source changing.
       - .dockerignore
+      # Not a build input: the post-build check. Listed so an edit to it is
+      # exercised by a build rather than first running on someone else's PR.
+      - dev/check-image-mount-parents
 
 jobs:
   build:
@@ -39,3 +45,11 @@ jobs:
             --build-arg DEV_CONTAINER_WORKSPACE=/workspaces/src \
             -t devcontainer-ci:test \
             .
+
+      # The image half of #106: tests/test-volume-chown-guard.sh can only read
+      # the Dockerfile text, so the fact that the built image really ships
+      # ~/.claude/projects writable by the container user is checkable only
+      # here. The checker derives both the directory and the user from
+      # docker-compose.yml and runs the mkdir the #106 report ran.
+      - name: Transcript bind parent ships writable
+        run: dev/check-image-mount-parents devcontainer-ci:test
diff --git a/.github/workflows/nix-base.yml b/.github/workflows/nix-base.yml
index c3f3a5d..170b466 100644
--- a/.github/workflows/nix-base.yml
+++ b/.github/workflows/nix-base.yml
@@ -46,6 +46,9 @@ on:
       # COPY without any COPY source changing.
       - .dockerignore
       - .github/workflows/nix-base.yml
+      # Not a build input: the post-build check. Listed so an edit to it is
+      # exercised by a build rather than first running on someone else's PR.
+      - dev/check-image-mount-parents
   pull_request:
     paths:
       - nix/base/**
@@ -62,6 +65,9 @@ on:
       # COPY without any COPY source changing.
       - .dockerignore
       - .github/workflows/nix-base.yml
+      # Not a build input: the post-build check. Listed so an edit to it is
+      # exercised by a build rather than first running on someone else's PR.
+      - dev/check-image-mount-parents
   workflow_dispatch:
 
 env:
@@ -120,6 +126,14 @@ jobs:
             -t nix-base-tail:ci .
           docker run --rm nix-base-tail:ci sh -c 'claude --version && test -x /usr/local/bin/setup-env'
 
+      # The image half of #106, per arch: the nix route pre-creates
+      # ~/.claude/projects in the tail build (the base ships the sibling home
+      # dirs but not this one), and only a built image can confirm it landed
+      # writable. Same checker as docker-build.yml; it derives the directory
+      # and the user from docker-compose.yml.
+      - name: Transcript bind parent ships writable
+        run: dev/check-image-mount-parents nix-base-tail:ci
+
       - name: Log in to ghcr.io
         if: github.event_name != 'pull_request'
         uses: docker/login-action@v4
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index ecc86dc..1ac6a67 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -15,7 +15,7 @@ repos:
         args: [--severity=warning]
         types: [file]
         files: >-
-          ^dev/(devcontainer|devcontainer-completions|init|new-worktree|setup-worktree|cleanup-worktree|check-gitignore-agents|hooks/post-checkout)$
+          ^dev/(devcontainer|devcontainer-completions|init|new-worktree|setup-worktree|cleanup-worktree|check-gitignore-agents|check-image-mount-parents|hooks/post-checkout)$
 
   # These pins are the source of truth for CI (the pre-commit job is the only
   # CI lint gate). Keep ruff/yamllint/hadolint in sync with the in-container
diff --git a/CLAUDE.md b/CLAUDE.md
index 7b0ed58..01b5f8e 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -282,8 +282,14 @@ taxonomy and reads as `test:`.
   route carries it in the tail build rather than `nix/base/flake.nix` on
   purpose — the base pre-creates the other home dirs, but a fix there reaches
   nobody until a republish AND a `BASE_IMAGE` repin (#83), while the tail
-  rebuilds per project (test: `tests/test-volume-chown-guard.sh`, which derives
-  the directory from the compose target rather than restating it).
+  rebuilds per project (`test: tests/test-volume-chown-guard.sh` reads the
+  Dockerfile text — that a `mkdir` exists and a LATER `chown` covers it, which
+  is a proxy for what the image ships; `ci:` docker-build.yml and nix-base.yml
+  both run `dev/check-image-mount-parents`, which derives the directory and the
+  owner from `docker-compose.yml` and runs #106's own `mkdir` probe as that user
+  against the built image — the fact needs a daemon, so the hermetic suite holds
+  only the workflow↔tool coupling and the checker's refusal to hardcode the
+  path).
 - Lock discipline: per-worktree lock on fd 9, repo-scoped build lock on fd 8;
   any helper backgrounded inside the locked region must be spawned with
   `9>&-` or it holds the worktree lock forever (`test:
diff --git a/dev/check-image-mount-parents b/dev/check-image-mount-parents
new file mode 100755
index 0000000..ddaab72
--- /dev/null
+++ b/dev/check-image-mount-parents
@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+# CI check: the parent of the transcript bind must ship in a built image owned
+# by the container user, so the daemon never has to create it as root (#106).
+#
+# Why this is not in tests/: it needs a built image, so it cannot live in the
+# hermetic suite (tests/run-all globs tests/*.sh and would run it with no
+# docker). tests/test-volume-chown-guard.sh section 10 reads the Dockerfile
+# TEXT — that a mkdir exists and a later chown covers it — which is a proxy.
+# This runs the actual failing operation against the actual image, so it is the
+# `ci:` half of that invariant rather than a second textual restatement.
+#
+# The probe is the one from the #106 report: mkdir as the container user inside
+# the directory. A stat comparison would pass on a dir owned by a same-named
+# user with no write bit; only the mkdir answers the question that was asked.
+#
+# Both the directory and the user are DERIVED from docker-compose.yml — the
+# transcript mount's target and the service's `user:` — so nothing here is a
+# third encoding of either, and moving the mount moves this check with it.
+#
+# Usage: dev/check-image-mount-parents <image-ref>
+set -euo pipefail
+
+image="${1:-}"
+if [ -z "$image" ] || [ "$image" = "-h" ] || [ "$image" = "--help" ]; then
+    echo "usage: check-image-mount-parents <image-ref>" >&2
+    [ -n "$image" ] || exit 2
+    exit 0
+fi
+
+base="$(cd "$(dirname "$(readlink -f "$0")")/.." && pwd)"
+compose="$base/docker-compose.yml"
+[ -f "$compose" ] || {
+    echo "error: no docker-compose.yml at $compose" >&2
+    exit 1
+}
+
+# The transcript mount is the one whose target interpolates
+# DEV_CONTAINER_PROJECT_KEY: that variable is what makes the target a
+# per-project subdirectory, so its parent is the directory the daemon creates.
+target="$(awk '/^[[:space:]]*target:[[:space:]]/ && /DEV_CONTAINER_PROJECT_KEY/ {print $2}' "$compose")"
+if [ "$(printf '%s' "$target" | grep -c . || true)" != 1 ]; then
+    echo "error: expected exactly one compose target interpolating" \
+        "DEV_CONTAINER_PROJECT_KEY, got: ${target:-<none>}" >&2
+    exit 1
+fi
+parent="${target%%\$\{*}"
+parent="${parent%/}"
+case "$parent" in
+    /*/?*) ;;
+    *)
+        echo "error: derived a nonsense parent directory from $compose: '$parent'" >&2
+        exit 1
+        ;;
+esac
+
+user="$(awk '/^[[:space:]]*user:[[:space:]]/ {print $2; exit}' "$compose")"
+[ -n "$user" ] || {
+    echo "error: no 'user:' in $compose — cannot tell who must own $parent" >&2
+    exit 1
+}
+
+echo "checking $image: $parent must be writable by '$user' (derived from $(basename "$compose"))"
+docker run --rm "$image" sh -c "stat -c '%n %U:%G %a' '$parent'" || {
+    echo "::error::$image does not ship $parent at all. Compose mounts the" \
+        "transcript bind inside it, so the daemon will create it as root and" \
+        "the container user will not be able to create sibling project keys" \
+        "(#106)." >&2
+    exit 1
+}
+
+if ! docker run --rm --user "$user" "$image" \
+    sh -c "mkdir '$parent/.mount-parent-probe' && rmdir '$parent/.mount-parent-probe'"; then
+    echo "::error::$parent is not writable by '$user' in $image. That is the" \
+        "#106 failure: Claude cannot create a project key it was not given," \
+        "including its memory directory. Fix the mkdir/chown in the" \
+        "Dockerfile for this route." >&2
+    exit 1
+fi
+
+echo "ok: $parent ships writable by '$user'"
diff --git a/tests/test-volume-chown-guard.sh b/tests/test-volume-chown-guard.sh
index afc40c3..99c68ac 100755
--- a/tests/test-volume-chown-guard.sh
+++ b/tests/test-volume-chown-guard.sh
@@ -38,8 +38,13 @@
 #      #106 the ancestor walk cannot cover, because an entry path that skips
 #      setup() (VS Code "Reopen in Container") never runs the walk at all. The
 #      directory is derived from docker-compose.yml, not written down here.
+#      This reads Dockerfile TEXT, a proxy: whether the BUILT image ships the
+#      directory writable needs a daemon and is typed `ci:`
+#      (dev/check-image-mount-parents). What this suite holds of that half is
+#      the workflow<->tool coupling — both build workflows must invoke the
+#      checker, and the checker must derive the path rather than restate it.
 #
-# Verified (ADR-0005 §2), eleven mutations. Counts and assertion names below are
+# Verified (ADR-0005 §2), fourteen mutations. Counts and assertion names below are
 # transcribed from the runs — see the METHOD note at the end, because three
 # earlier versions of this record were wrong.
 #   1. mount_point_targets' filter reverted to the pre-#106 `type == "volume"`
@@ -91,6 +96,17 @@
 #      Dockerfiles left alone — 4 red, and the failure names print
 #      `/home/vscode/.claude/transcripts`, which is what shows the expectation
 #      is read out of compose rather than restated in the assertions.
+#  12. the checker's step deleted from docker-build.yml — 1 red. The two
+#      workflows are asserted separately, so silently dropping the check from
+#      one route cannot hide behind the other still running it.
+#  13. the checker's derivation replaced by the hardcoded literal it derives —
+#      1 red, "does not hardcode the directory it checks". Note what this
+#      mutation does NOT break: the checker still passes against today's
+#      images, which is exactly why a literal there would go unnoticed until
+#      the mount moved.
+#  14. the checker made non-executable — 1 red. `run: dev/check-image-mount-parents`
+#      execs it directly, so a lost mode bit is a CI failure with a confusing
+#      message; this is the #129 shape, caught hermetically.
 #
 # METHOD: measure each mutation in a FRESH copy of the tree, and transcribe the
 # numbers from the run rather than reasoning about them. Three earlier versions
@@ -109,7 +125,7 @@
 # tests/mutation-coverage automates this (fresh copy per mutation, plus it
 # flags a mutation that changed nothing). It is not in this tree — it ships on
 # the branch behind PR #124.
-#   (mutation runs 2026-08-04; items 8-11 on 2026-08-10, fresh copy each)
+#   (mutation runs 2026-08-04; items 8-14 on 2026-08-10, fresh copy each)
 set -euo pipefail
 
 . "$(dirname "$(readlink -f "$0")")/lib/harness.sh"
@@ -548,4 +564,22 @@ done
 assert_eq "the parser reports nothing for a path no Dockerfile creates" \
     "" "$(precreated "$DEV_BASE/Dockerfile" "$bind_parent-absent")"
 
+# Everything above reads Dockerfile TEXT, which is a proxy for what the built
+# image ships. The fact itself needs a daemon, so it is typed `ci:` and lives in
+# dev/check-image-mount-parents, invoked by both build workflows. That
+# workflow<->tool coupling is what this suite can hold: a checker no job runs is
+# not a guard, which is the #83 shape (a step nobody owned, duly undone).
+checker="$DEV_BASE/dev/check-image-mount-parents"
+assert_true "the ci: half exists and is executable" test -x "$checker"
+for workflow in docker-build.yml nix-base.yml; do
+    assert_true "$workflow runs dev/check-image-mount-parents on the image it built" \
+        grep -q 'dev/check-image-mount-parents ' "$DEV_BASE/.github/workflows/$workflow"
+done
+# The checker must DERIVE the directory as this suite does, not restate it: a
+# hardcoded literal there is a fourth encoding that goes stale silently, since
+# nothing would fail until the mount moved AND someone noticed the check was
+# asserting the old path.
+assert_false "the checker does not hardcode the directory it checks" \
+    grep -qF "$bind_parent" "$checker"
+
 finish

From a9a1e0c52bb716f38394c84d33329160ec433a5e Mon Sep 17 00:00:00 2001
From: t <t@t>
Date: Mon, 10 Aug 2026 17:28:39 -0400
Subject: [PATCH 4/6] fix(test): close four fail-opens the review found in the
 new guard
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

An independent review of the two preceding commits found that section 10
of tests/test-volume-chown-guard.sh could be satisfied while the image
was broken, four ways. All four reproduced at 58 passed, 0 failed before
being closed:

  - a COMMENT naming the mkdir and chown, with the nix tail's RUN
    deleted. `precreated` read comment lines as code. This is the #97
    shape the ledger records verbatim — textual containment satisfied by
    a comment naming the path — recurring inside a guard written just
    after reading that entry. It is also the likeliest future edit: the
    file's own comment calls flake.nix "the obvious home" for it.
  - `chown root:root` on the right path at the right position. The check
    accepted any chown and never looked at operand 0.
  - a LATER `RUN chown root:root <path>` with the correct block left
    intact. Only the last writer of ownership is what ships.
  - the checker's `run:` step deleted from docker-build.yml while its
    trigger-path entry gained a trailing comment. The unanchored grep
    matched the paths entry — and that entry was added by the previous
    commit, so this PR built the hole itself.

Fixes, all deriving rather than restating: comment lines are stripped
before continuations are joined (as the builder does); the walk keeps
looking so the LAST covering chown decides; its owner operand is
compared against the compose service `user:`; the workflow assertion is
anchored on a `run:` line.

nix/base/Dockerfile.nix-default now chowns by NAME (vscode:vscode) rather
than "$USER_UID:$USER_GID". The remap above has already renumbered
vscode, so it is equivalent — and it states the identity compose runs as,
which is what lets the guard compare against docker-compose.yml instead
of accepting any chown.

Also from the review:

  - the coverage claim in CLAUDE.md and Dockerfile said the image half
    makes this "never wrong in the first place". It does so for a FRESH
    claude-home volume only: an existing volume holding a root-owned
    projects/ is untouched by a rebuild and still needs the walk, a
    clean or a reset. Qualified in both places. Verified against a real
    daemon: pre-existing volume + new image still reproduces #106.
  - "the daemon has nothing left to create" was literally false — it
    still creates the <key> mount point root-owned inside the volume.
    Nothing needs to write there (the bind shadows it at runtime), so
    the claim is now scoped to what the user actually needs.
  - dev/check-image-mount-parents reported infrastructure failures as
    the #106 diagnosis: a missing image or an unresolvable --user exits
    non-zero exactly as an unwritable directory does. Both now
    pre-flighted and named as CI wiring problems.

Guard: 58 -> 59 assertions (the derived compose user). Mutations 15-18
recorded with their measured counts; 8-14 re-measured after the parser
changed, counts unchanged.

bash tests/run-all -> 0 failures; pre-commit run --all-files -> all pass.
Checker re-verified against a freshly built classic image (exit 0) and
against a bogus tag (exit 1, named as wiring, not #106).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J8Q8kBDc2TtCF7ZzSwD3iX
---
 CLAUDE.md                        |  16 +++--
 Dockerfile                       |  15 +++--
 dev/check-image-mount-parents    |  17 +++++
 nix/base/Dockerfile.nix-default  |   8 ++-
 tests/test-volume-chown-guard.sh | 110 ++++++++++++++++++++++++-------
 5 files changed, 130 insertions(+), 36 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 01b5f8e..233adf1 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -271,12 +271,16 @@ taxonomy and reads as `test:`.
   docker, but the python snippet inside it is lifted out and run against a
   synthetic config document (test: `tests/test-volume-chown-guard.sh`).
 - BOTH image routes pre-create the transcript bind's parent
-  (`~/.claude/projects`) and chown it AFTER creating it, so a fresh
-  `claude-home` volume seeds it user-owned and the daemon never creates it as
-  root. This is belt to the ancestor walk's braces, and it covers what the walk
-  cannot: the walk runs in `setup()`, so an entry path that never calls
-  `dev/devcontainer` — VS Code "Reopen in Container" (#43), a bare `docker
-  compose up` — gets the root-owned directory and the #106 failure back. The
+  (`~/.claude/projects`) and chown it to the compose `user:` AFTER creating it,
+  so a fresh `claude-home` volume seeds it user-owned and the daemon never
+  creates it as root. This is belt to the ancestor walk's braces, and it covers
+  what the walk cannot: the walk runs in `setup()`, so an entry path that never
+  calls `dev/devcontainer` — VS Code "Reopen in Container" (#43), a bare `docker
+  compose up` — gets the root-owned directory and the #106 failure back. It
+  covers that for a FRESH volume only: a `claude-home` that already holds a
+  root-owned `projects/` is untouched by a rebuild and still needs the walk (or
+  a `clean`/`reset`), so this narrows who can hit #106, it does not retire the
+  walk. The
   ordering is load-bearing: both Dockerfiles `chown -R /home/vscode` during the
   UID remap, ABOVE these lines, where the directory does not exist yet. The nix
   route carries it in the tail build rather than `nix/base/flake.nix` on
diff --git a/Dockerfile b/Dockerfile
index a546b0c..641e4ae 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -93,11 +93,16 @@ RUN printf '. /usr/local/lib/devcontainer/claude-code-token-env.sh\n' \
 # transcript bind (docker-compose.yml mounts the host log dir at
 # .claude/projects/<key>), so the daemon creates it as root if the image does
 # not ship it — the #106 defect. The ancestor walk in lib/volume-perms.sh
-# repairs that after the fact; creating it here means it is never wrong in the
-# first place, including on entry paths that never run `dev/devcontainer setup`
-# (VS Code "Reopen in Container", a bare `docker compose up`). A fresh
-# claude-home volume seeds from this path, so the volume inherits the dir
-# vscode-owned and the daemon has nothing left to create.
+# repairs that after the fact; creating it here means a FRESH claude-home
+# volume is never wrong in the first place, including on entry paths that never
+# run `dev/devcontainer setup` (VS Code "Reopen in Container", a bare `docker
+# compose up`). Only fresh: an existing volume already holding a root-owned
+# projects/ is unaffected by a rebuild and still needs the walk, a `clean` or a
+# `reset`.
+#
+# The daemon still creates the <key> mount point itself inside the volume, and
+# still as root — but nothing needs to write THAT: it is shadowed by the bind
+# at runtime, and what #106 was about is creating siblings next to it.
 RUN mkdir -p /home/vscode/.cache /home/vscode/.ssh /home/vscode/.claude/projects \
     && chown -R vscode:vscode /home/vscode/.cache /home/vscode/.ssh /home/vscode/.claude \
     && chmod 700 /home/vscode/.ssh
diff --git a/dev/check-image-mount-parents b/dev/check-image-mount-parents
index ddaab72..9d0429f 100755
--- a/dev/check-image-mount-parents
+++ b/dev/check-image-mount-parents
@@ -60,6 +60,23 @@ user="$(awk '/^[[:space:]]*user:[[:space:]]/ {print $2; exit}' "$compose")"
 }
 
 echo "checking $image: $parent must be writable by '$user' (derived from $(basename "$compose"))"
+
+# Pre-flight so infrastructure failures are not reported as the #106 diagnosis.
+# A missing image, or a `--user` docker cannot resolve, exits non-zero from the
+# probe below exactly as an unwritable directory does, and pointing a CI reader
+# at the wrong file is the whole cost of a check like this being wrong.
+docker image inspect "$image" >/dev/null 2>&1 || {
+    echo "::error::no such image: $image (this is a CI wiring problem, not a" \
+        "#106 regression — the build step above did not produce this tag)" >&2
+    exit 1
+}
+if ! docker run --rm --user "$user" "$image" true 2>/dev/null; then
+    echo "::error::cannot run $image as '$user' at all — the image has no such" \
+        "user, or no working entrypoint. A CI wiring problem, not a #106" \
+        "regression." >&2
+    exit 1
+fi
+
 docker run --rm "$image" sh -c "stat -c '%n %U:%G %a' '$parent'" || {
     echo "::error::$image does not ship $parent at all. Compose mounts the" \
         "transcript bind inside it, so the daemon will create it as root and" \
diff --git a/nix/base/Dockerfile.nix-default b/nix/base/Dockerfile.nix-default
index a98862d..a026a8b 100644
--- a/nix/base/Dockerfile.nix-default
+++ b/nix/base/Dockerfile.nix-default
@@ -55,8 +55,14 @@ RUN if [ "$USER_GID" != "1000" ]; then groupmod -g "$USER_GID" vscode; fi \
 # on USER_UID != 1000, so at the default UID it does not run and this dir would
 # stay root-owned. One empty dir, so this is not the fat-layer case the guard
 # exists to avoid.
+#
+# By NAME, not "$USER_UID:$USER_GID": the remap above has already renumbered
+# vscode, so the name resolves to whatever UID this build asked for, and it
+# states the same identity compose runs the container as (`user: vscode`) —
+# which is what lets the guard compare the owner here against the compose file
+# instead of accepting any chown at all.
 RUN mkdir -p /home/vscode/.claude/projects \
-    && chown "$USER_UID:$USER_GID" /home/vscode/.claude/projects
+    && chown vscode:vscode /home/vscode/.claude/projects
 
 # Shared helpers an overlay can source. Copied before install-system runs so a
 # build-time install-system.sh can source it too (e.g. nix-seed.sh). Inert for
diff --git a/tests/test-volume-chown-guard.sh b/tests/test-volume-chown-guard.sh
index 99c68ac..990474e 100755
--- a/tests/test-volume-chown-guard.sh
+++ b/tests/test-volume-chown-guard.sh
@@ -44,7 +44,7 @@
 #      the workflow<->tool coupling — both build workflows must invoke the
 #      checker, and the checker must derive the path rather than restate it.
 #
-# Verified (ADR-0005 §2), fourteen mutations. Counts and assertion names below are
+# Verified (ADR-0005 §2), eighteen mutations. Counts and assertion names below are
 # transcribed from the runs — see the METHOD note at the end, because three
 # earlier versions of this record were wrong.
 #   1. mount_point_targets' filter reverted to the pre-#106 `type == "volume"`
@@ -108,6 +108,33 @@
 #      execs it directly, so a lost mode bit is a CI failure with a confusing
 #      message; this is the #129 shape, caught hermetically.
 #
+# Items 15-18 are the FOUR FAIL-OPENS an independent review of item 10 found,
+# each reproduced here (58/0 green while the image was broken) before being
+# closed, then re-measured. Item 10 as first written could be satisfied by a
+# comment, by a chown to the wrong owner, and by a workflow that ran the
+# checker nowhere — three restatements of the same lesson this file already
+# carried twice, which is the argument for reviewing a guard rather than
+# trusting that its author read it carefully.
+#  15. the nix tail's RUN replaced by a COMMENT naming the same mkdir and
+#      chown (the likeliest future edit — the file's own comment calls
+#      flake.nix "the obvious home" for it) — was GREEN at 58/0 with the
+#      directory shipped by nobody; now 2 red. `precreated` read comment lines
+#      as code: the #97 shape ("a comment naming the path satisfied textual
+#      containment while the file went genuinely unhashed"), recurring inside
+#      a guard written by someone who had just read that ledger entry.
+#  16. the nix chown's owner changed to `root:root`, same path, same position
+#      — was GREEN at 58/0; now 1 red. The check accepted any chown and never
+#      looked at operand 0.
+#  17. a LATER `RUN chown root:root <path>` appended to the root Dockerfile,
+#      leaving the correct block untouched — was GREEN at 58/0; now 1 red.
+#      Only the last writer of ownership is what the image ships, so the walk
+#      keeps looking rather than returning at the first match.
+#  18. the checker's `run:` step deleted from docker-build.yml while its
+#      trigger-path entry gained a trailing comment — was GREEN at 58/0,
+#      because the unanchored grep matched the paths entry. Now 1 red: the
+#      assertion is anchored on a `run:` line. The trigger-path entry added in
+#      the same commit is what made the old grep satisfiable without the step.
+#
 # METHOD: measure each mutation in a FRESH copy of the tree, and transcribe the
 # numbers from the run rather than reasoning about them. Three earlier versions
 # of this record were wrong — counts inflated, and one mutation credited with
@@ -125,7 +152,8 @@
 # tests/mutation-coverage automates this (fresh copy per mutation, plus it
 # flags a mutation that changed nothing). It is not in this tree — it ships on
 # the branch behind PR #124.
-#   (mutation runs 2026-08-04; items 8-14 on 2026-08-10, fresh copy each)
+#   (mutation runs 2026-08-04; items 8-18 on 2026-08-10, fresh copy each;
+#    8-14 re-measured after 15-18 changed the parser, counts unchanged)
 set -euo pipefail
 
 . "$(dirname "$(readlink -f "$0")")/lib/harness.sh"
@@ -513,23 +541,36 @@ bind_parent="${bind_parent%/}"
 assert_true "the transcript bind's parent derives to a path under /home/vscode" \
     bash -c '[[ "$1" == /home/vscode/?* ]]' _ "$bind_parent"
 
-# precreated <dockerfile> <path> — prints `mkdir` when some mkdir creates
-# <path>, and `chown` when a LATER command gives it to the container user,
-# directly or by -R on an ancestor. Ordering is load-bearing and is why this
-# does not just grep for two words: BOTH Dockerfiles chown -R /home/vscode
-# ABOVE these lines (the UID remap), and a chown that runs before the mkdir
-# cannot own a directory that does not exist yet. Reading it as coverage would
-# leave the guard passing on an image whose dir ships root-owned — precisely
-# the state being guarded against.
+# precreated <dockerfile> <path> <owner> — prints `mkdir` when some mkdir
+# creates <path>, and `chown` when the LAST command to change its ownership
+# afterwards gives it to <owner>, directly or by -R on an ancestor.
+#
+# Three things it must get right, each one a measured fail-open when it did not
+# (mutations 15-17):
+#   - COMMENTS ARE NOT CODE. Dockerfile comment lines are dropped before
+#     continuations are joined, exactly as the builder does. Without this a
+#     comment naming the mkdir satisfied the assertion while the RUN was gone —
+#     the #97 shape the ledger records, recurring inside its own guard.
+#   - ORDER. BOTH Dockerfiles chown -R /home/vscode ABOVE these lines (the UID
+#     remap), where the directory does not exist yet, so a position-blind check
+#     would read that as coverage.
+#   - THE OWNER, AND THE LAST WRITER OF IT. `chown root:root` satisfies "a
+#     chown happened"; so does a correct chown followed by a later one that
+#     takes the directory away again. Only the final owner is what the image
+#     ships, and it is compared against the compose `user:` — derived, not a
+#     literal.
+# Nothing containing the substring "chown" may be printed on the failing paths:
+# the caller uses assert_contains, so a diagnostic like "chown-by:root" would
+# pass the very assertion it was meant to fail.
 precreated() {
-    python3 - "$1" "$2" <<'PY'
+    python3 - "$1" "$2" "$3" <<'PY'
 import re, sys
 
-# Join continuations first, as tests/lib/dockerfile.sh does, so a wrapped RUN
-# is one string. Commands are cut at &&, || and ; so one RUN's argv cannot bleed
-# into the next command's.
-text = open(sys.argv[1]).read().replace("\\\n", " ")
-path = sys.argv[2]
+# Comment lines first, then continuations: a `#` line inside a wrapped RUN is
+# not part of the command, and joining first would splice it into one.
+text = "\n".join(ln for ln in open(sys.argv[1]).read().split("\n")
+                 if not ln.lstrip().startswith("#")).replace("\\\n", " ")
+path, owner = sys.argv[2], sys.argv[3]
 
 def operands(cmd):
     return [w.strip('"\'') for w in cmd.split()[1:] if not w.startswith("-")]
@@ -540,29 +581,44 @@ if mkdir_at is None:
     sys.exit(0)
 print("mkdir")
 
+final = None
 for m in re.finditer(r"chown[^&|;\n]*", text):
     if m.start() < mkdir_at:
         continue
     words = m.group(0).split()
     recursive = any(w.startswith("-") and "R" in w for w in words)
-    for target in (t.rstrip("/") for t in operands(m.group(0))[1:]):
+    ops = operands(m.group(0))
+    if not ops:
+        continue
+    for target in (t.rstrip("/") for t in ops[1:]):
         if target == path or (recursive and (path + "/").startswith(target + "/")):
-            print("chown")
-            sys.exit(0)
+            final = ops[0]          # last writer wins, so keep looking
+# The group half is not checked: compose declares a user, not a group, so
+# deriving an expectation for it would mean inventing one here.
+if final is not None and final.split(":")[0] == owner:
+    print("chown")
 PY
 }
 
+# Who must own it is derived too: the compose service's `user:` is the identity
+# the container runs as, so it is the one that has to be able to write there.
+compose_user="$(awk '/^[[:space:]]*user:[[:space:]]/ {print $2; exit}' \
+    "$DEV_BASE/docker-compose.yml")"
+assert_nonempty "the compose service user was derived from docker-compose.yml" \
+    "$compose_user"
+
 for dockerfile in "$DEV_BASE/Dockerfile" "$DEV_BASE/nix/base/Dockerfile.nix-default"; do
     route="${dockerfile#"$DEV_BASE/"}"
-    coverage="$(precreated "$dockerfile" "$bind_parent")"
+    coverage="$(precreated "$dockerfile" "$bind_parent" "$compose_user")"
     assert_contains "$route creates $bind_parent" "mkdir" "$coverage"
-    assert_contains "$route chowns it AFTER creating it" "chown" "$coverage"
+    assert_contains "$route leaves it owned by '$compose_user' after creating it" \
+        "chown" "$coverage"
 done
 
 # Anti-vacuity: a parser that answered "mkdir" for anything would pass both
 # routes above while checking nothing.
 assert_eq "the parser reports nothing for a path no Dockerfile creates" \
-    "" "$(precreated "$DEV_BASE/Dockerfile" "$bind_parent-absent")"
+    "" "$(precreated "$DEV_BASE/Dockerfile" "$bind_parent-absent" "$compose_user")"
 
 # Everything above reads Dockerfile TEXT, which is a proxy for what the built
 # image ships. The fact itself needs a daemon, so it is typed `ci:` and lives in
@@ -571,9 +627,15 @@ assert_eq "the parser reports nothing for a path no Dockerfile creates" \
 # not a guard, which is the #83 shape (a step nobody owned, duly undone).
 checker="$DEV_BASE/dev/check-image-mount-parents"
 assert_true "the ci: half exists and is executable" test -x "$checker"
+# Anchored on a `run:` step, not a bare mention: the checker's own path is also
+# a TRIGGER-PATH entry in both workflows, so an unanchored grep is satisfied by
+# the file that merely lists it while the step that runs it is gone (mutation
+# 18 — the assertion whose entire job is "a checker no job runs is not a
+# guard", passing on a workflow that runs it nowhere).
 for workflow in docker-build.yml nix-base.yml; do
-    assert_true "$workflow runs dev/check-image-mount-parents on the image it built" \
-        grep -q 'dev/check-image-mount-parents ' "$DEV_BASE/.github/workflows/$workflow"
+    assert_true "$workflow has a run: step invoking dev/check-image-mount-parents" \
+        grep -qE '^[[:space:]]*run:[[:space:]]+dev/check-image-mount-parents[[:space:]]' \
+        "$DEV_BASE/.github/workflows/$workflow"
 done
 # The checker must DERIVE the directory as this suite does, not restate it: a
 # hardcoded literal there is a fourth encoding that goes stale silently, since

From f30d445e395658f77b5c7860a9327bf897199725 Mon Sep 17 00:00:00 2001
From: t <t@t>
Date: Tue, 11 Aug 2026 08:16:08 -0400
Subject: [PATCH 5/6] refactor(test): delete the Dockerfile-text parser, keep
 the ci: check
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Section 10 parsed both Dockerfiles for the mkdir/chown as a hermetic
proxy for what the built image ships. Once dev/check-image-mount-parents
existed, that proxy was re-deriving from source text a fact something
else measures directly on the artefact — and it was, by a wide margin,
the worst component of this change:

  - four measured fail-opens (a comment naming the commands satisfied
    it; chown root:root satisfied it; a later chown taking ownership
    back satisfied it; the workflow assertion was satisfied by a
    trigger-path entry)
  - all four found by review rather than by its author
  - all four in the proxy, none in the thing being proxied

Deleted: ~110 lines and seven mutation records, along with every defect
this change has had since the four-line Dockerfile edit.

The one thing it caught that the ci: check did not is a compose-side
move of the transcript mount, since docker-compose.yml is no build input
and nothing rebuilt on it. Closed by listing docker-compose.yml as a
trigger path of docker-build.yml — the ~2 minute classic build, where a
red blocks the PR as well as a red in the hour-long two-arch nix one
would, which is why it is deliberately NOT listed in nix-base.yml.

What the hermetic suite keeps is only what makes the ci: check
reachable: both workflows invoke it, it is executable, it does not
hardcode what it derives, and compose is a trigger path. 59 -> 55
assertions, twelve mutations instead of eighteen.

Verified (ADR-0005 §2), the five retained mutations re-measured in a
fresh copy each after the deletion:
   8. the run: step deleted from docker-build.yml -> 1 red
   9. the same, plus a trailing comment keeping the checker's name in
      the file (the old fail-open) -> 1 red
  10. the checker's derivation replaced by its literal -> 1 red
  11. the checker made non-executable -> 1 red
  12. docker-compose.yml removed from the trigger paths -> 2 red, one
      per event list

bash tests/run-all -> 0 failures; pre-commit run --all-files -> all pass.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J8Q8kBDc2TtCF7ZzSwD3iX
---
 .github/workflows/docker-build.yml |  22 ++-
 CLAUDE.md                          |  24 ++-
 tests/test-volume-chown-guard.sh   | 250 ++++++++++-------------------
 3 files changed, 119 insertions(+), 177 deletions(-)

diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
index d1fb9ae..ba92cdc 100644
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-build.yml
@@ -16,9 +16,16 @@ on:
       # This file defines the build itself: change the docker build command,
       # a --build-context or a --build-arg and the verification must re-run.
       - .github/workflows/docker-build.yml
-      # Not a build input: the post-build check. Listed so an edit to it is
-      # exercised by a build rather than first running on someone else's PR.
+      # Neither of these is a build input; both feed the post-build check.
+      # The checker itself, so an edit to it is exercised by a build rather
+      # than first running on someone else's PR — and docker-compose.yml,
+      # which the checker DERIVES the checked directory from: move the
+      # transcript mount without touching a Dockerfile and nothing would
+      # rebuild, so nothing would re-derive. Listed here, on the ~2 minute
+      # classic build, and deliberately NOT in nix-base.yml, where it would
+      # set off an hour-long two-arch build for the same answer.
       - dev/check-image-mount-parents
+      - docker-compose.yml
   pull_request:
     branches: [main]
     paths:
@@ -34,9 +41,16 @@ on:
       # This file defines the build itself: change the docker build command,
       # a --build-context or a --build-arg and the verification must re-run.
       - .github/workflows/docker-build.yml
-      # Not a build input: the post-build check. Listed so an edit to it is
-      # exercised by a build rather than first running on someone else's PR.
+      # Neither of these is a build input; both feed the post-build check.
+      # The checker itself, so an edit to it is exercised by a build rather
+      # than first running on someone else's PR — and docker-compose.yml,
+      # which the checker DERIVES the checked directory from: move the
+      # transcript mount without touching a Dockerfile and nothing would
+      # rebuild, so nothing would re-derive. Listed here, on the ~2 minute
+      # classic build, and deliberately NOT in nix-base.yml, where it would
+      # set off an hour-long two-arch build for the same answer.
       - dev/check-image-mount-parents
+      - docker-compose.yml
 
 jobs:
   build:
diff --git a/CLAUDE.md b/CLAUDE.md
index 9e2a9b7..a6b154d 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -322,14 +322,22 @@ taxonomy and reads as `test:`.
   route carries it in the tail build rather than `nix/base/flake.nix` on
   purpose — the base pre-creates the other home dirs, but a fix there reaches
   nobody until a republish AND a `BASE_IMAGE` repin (#83), while the tail
-  rebuilds per project (`test: tests/test-volume-chown-guard.sh` reads the
-  Dockerfile text — that a `mkdir` exists and a LATER `chown` covers it, which
-  is a proxy for what the image ships; `ci:` docker-build.yml and nix-base.yml
-  both run `dev/check-image-mount-parents`, which derives the directory and the
-  owner from `docker-compose.yml` and runs #106's own `mkdir` probe as that user
-  against the built image — the fact needs a daemon, so the hermetic suite holds
-  only the workflow↔tool coupling and the checker's refusal to hardcode the
-  path).
+  rebuilds per project (`ci:` docker-build.yml and nix-base.yml both run
+  `dev/check-image-mount-parents`, which derives the directory and the owner
+  from `docker-compose.yml` and runs #106's own `mkdir` probe as that user
+  against the built image; `test: tests/test-volume-chown-guard.sh` holds only
+  what keeps that check REACHABLE — both workflows invoke it, it is executable,
+  it does not hardcode what it derives, and `docker-compose.yml` is a trigger
+  path of docker-build.yml, since a compose-side move of the mount would
+  otherwise rebuild nothing and the checker would never re-derive. That trigger
+  entry is in the classic workflow only: it is a ~2 minute build, and a red
+  there blocks a PR as well as a red in the hour-long two-arch nix one would.
+  The suite deliberately does NOT re-derive the fact from the Dockerfiles'
+  text: it did, and that parser had four measured fail-opens (a comment naming
+  the commands, a chown to the wrong owner, a later chown taking ownership
+  back, and an unanchored workflow grep) — where a `ci:` check can observe the
+  artefact, a hermetic restatement of the same fact is not a second guard but a
+  second thing to get wrong).
 - Lock discipline: per-worktree lock on fd 9, repo-scoped build lock on fd 8;
   any helper backgrounded inside the locked region must be spawned with
   `9>&-` or it holds the worktree lock forever (`test:
diff --git a/tests/test-volume-chown-guard.sh b/tests/test-volume-chown-guard.sh
index 990474e..e36e294 100755
--- a/tests/test-volume-chown-guard.sh
+++ b/tests/test-volume-chown-guard.sh
@@ -33,18 +33,15 @@
 #   8. the compose query emits kind-qualified volume AND bind targets, checked
 #      by running dev/devcontainer's own python snippet against a document
 #   9. the dev/devcontainer driver line still matches the lib's function
-#  10. both image routes ship the transcript bind's parent, created AND then
-#      chowned, so the daemon never has to create it as root — the half of
-#      #106 the ancestor walk cannot cover, because an entry path that skips
-#      setup() (VS Code "Reopen in Container") never runs the walk at all. The
-#      directory is derived from docker-compose.yml, not written down here.
-#      This reads Dockerfile TEXT, a proxy: whether the BUILT image ships the
-#      directory writable needs a daemon and is typed `ci:`
-#      (dev/check-image-mount-parents). What this suite holds of that half is
-#      the workflow<->tool coupling — both build workflows must invoke the
-#      checker, and the checker must derive the path rather than restate it.
+#  10. the image half of #106 is WIRED AND REACHABLE: both build workflows
+#      invoke dev/check-image-mount-parents, it is executable, it derives the
+#      directory rather than restating it, and docker-build.yml triggers on
+#      docker-compose.yml — the file the checker derives FROM, and no build
+#      input, so nothing else would list it. The fact itself (an image ships
+#      the directory writable) needs a daemon and is typed `ci:`; this suite
+#      holds only what keeps that check running.
 #
-# Verified (ADR-0005 §2), eighteen mutations. Counts and assertion names below are
+# Verified (ADR-0005 §2), twelve mutations. Counts and assertion names below are
 # transcribed from the runs — see the METHOD note at the end, because three
 # earlier versions of this record were wrong.
 #   1. mount_point_targets' filter reverted to the pre-#106 `type == "volume"`
@@ -80,60 +77,38 @@
 #   7. the whole `bind)` dispatch arm deleted — 3 red, including the kind-set
 #      comparison, which is what proves that guard derives both sides rather
 #      than restating a vocabulary.
-#   8. `/projects` dropped from the root Dockerfile's mkdir, back to the
-#      pre-#106 `mkdir -p ... /home/vscode/.claude` — 2 red, both in item 10.
-#      Two rather than one because the chown probe reports nothing once the
-#      mkdir is gone: there is no creation for a later chown to cover.
-#   9. the nix tail build's RUN deleted entirely — 2 red, the same pair for
-#      that route. The routes are checked independently, so neither mutation
-#      is masked by the other file being correct.
-#  10. that RUN's `&& chown` dropped, leaving only the mkdir — 1 red, "chowns
-#      it AFTER creating it". This is the one that pays for the ordering logic
-#      in `precreated`: both Dockerfiles chown -R /home/vscode ABOVE these
-#      lines, so a coverage test that ignored position would read that remap
-#      as ownership and stay green on an image shipping the dir root-owned.
-#  11. the compose target moved to .claude/transcripts/<key> with both
-#      Dockerfiles left alone — 4 red, and the failure names print
-#      `/home/vscode/.claude/transcripts`, which is what shows the expectation
-#      is read out of compose rather than restated in the assertions.
-#  12. the checker's step deleted from docker-build.yml — 1 red. The two
-#      workflows are asserted separately, so silently dropping the check from
-#      one route cannot hide behind the other still running it.
-#  13. the checker's derivation replaced by the hardcoded literal it derives —
-#      1 red, "does not hardcode the directory it checks". Note what this
-#      mutation does NOT break: the checker still passes against today's
-#      images, which is exactly why a literal there would go unnoticed until
-#      the mount moved.
-#  14. the checker made non-executable — 1 red. `run: dev/check-image-mount-parents`
+#   8. the checker's `run:` step deleted from docker-build.yml — 1 red. The
+#      two workflows are asserted separately, so dropping the check from one
+#      route cannot hide behind the other still running it.
+#   9. the same deletion, plus a trailing comment on the trigger-path entry so
+#      the checker's name still appears in the file — 1 red. This is the
+#      fail-open version of that assertion (an unanchored grep matched the
+#      paths line), closed by anchoring on `run:`; the paths entry that made it
+#      satisfiable was added by this very change.
+#  10. the checker's derivation replaced by the hardcoded literal it derives —
+#      1 red. Note what this mutation does NOT break: the checker still passes
+#      against today's images, which is why a literal there would go unnoticed
+#      until the mount moved.
+#  11. the checker made non-executable — 1 red. `run: dev/check-image-mount-parents`
 #      execs it directly, so a lost mode bit is a CI failure with a confusing
 #      message; this is the #129 shape, caught hermetically.
+#  12. `- docker-compose.yml` removed from docker-build.yml's trigger paths —
+#      2 red, one per event list. Without it a compose-side move of the
+#      transcript mount rebuilds nothing, so the checker never re-derives and
+#      the `ci:` half silently stops covering that direction.
 #
-# Items 15-18 are the FOUR FAIL-OPENS an independent review of item 10 found,
-# each reproduced here (58/0 green while the image was broken) before being
-# closed, then re-measured. Item 10 as first written could be satisfied by a
-# comment, by a chown to the wrong owner, and by a workflow that ran the
-# checker nowhere — three restatements of the same lesson this file already
-# carried twice, which is the argument for reviewing a guard rather than
-# trusting that its author read it carefully.
-#  15. the nix tail's RUN replaced by a COMMENT naming the same mkdir and
-#      chown (the likeliest future edit — the file's own comment calls
-#      flake.nix "the obvious home" for it) — was GREEN at 58/0 with the
-#      directory shipped by nobody; now 2 red. `precreated` read comment lines
-#      as code: the #97 shape ("a comment naming the path satisfied textual
-#      containment while the file went genuinely unhashed"), recurring inside
-#      a guard written by someone who had just read that ledger entry.
-#  16. the nix chown's owner changed to `root:root`, same path, same position
-#      — was GREEN at 58/0; now 1 red. The check accepted any chown and never
-#      looked at operand 0.
-#  17. a LATER `RUN chown root:root <path>` appended to the root Dockerfile,
-#      leaving the correct block untouched — was GREEN at 58/0; now 1 red.
-#      Only the last writer of ownership is what the image ships, so the walk
-#      keeps looking rather than returning at the first match.
-#  18. the checker's `run:` step deleted from docker-build.yml while its
-#      trigger-path entry gained a trailing comment — was GREEN at 58/0,
-#      because the unanchored grep matched the paths entry. Now 1 red: the
-#      assertion is anchored on a `run:` line. The trigger-path entry added in
-#      the same commit is what made the old grep satisfiable without the step.
+# WHAT WAS DELETED, and why it is worth recording rather than quietly dropping:
+# an earlier version of item 10 parsed both Dockerfiles for the mkdir/chown, as
+# a hermetic proxy for what the image ships. That parser had FOUR measured
+# fail-opens (a comment naming the commands satisfied it; `chown root:root`
+# satisfied it; a later chown taking ownership away again satisfied it; and the
+# workflow assertion above). All four were found by review, not by its author.
+# Once dev/check-image-mount-parents existed the parser was measuring a proxy
+# for something being measured directly, so it was removed with its seven
+# mutation records — ~110 lines, and every defect this change had after the
+# Dockerfile edit itself. The lesson kept: where a `ci:` check can observe the
+# artefact, a hermetic re-derivation of the same fact from source text is not a
+# second guard, it is a second thing to get wrong.
 #
 # METHOD: measure each mutation in a FRESH copy of the tree, and transcribe the
 # numbers from the run rather than reasoning about them. Three earlier versions
@@ -152,8 +127,8 @@
 # tests/mutation-coverage automates this (fresh copy per mutation, plus it
 # flags a mutation that changed nothing). It is not in this tree — it ships on
 # the branch behind PR #124.
-#   (mutation runs 2026-08-04; items 8-18 on 2026-08-10, fresh copy each;
-#    8-14 re-measured after 15-18 changed the parser, counts unchanged)
+#   (mutation runs 2026-08-04; items 8-12 on 2026-08-11, fresh copy each,
+#    re-measured after the Dockerfile-text parser was deleted)
 set -euo pipefail
 
 . "$(dirname "$(readlink -f "$0")")/lib/harness.sh"
@@ -516,122 +491,55 @@ sh -c "$script" volume-perms "volume:/home/vscode/.cache/uv"
 assert_contains "injected script: mount points arrive in \"\$@\" and resolve under /home/vscode" \
     "vscode:vscode /home/vscode/.cache" "$(log)"
 
-# ---- 10. both image routes pre-create the transcript bind's parent ----
-# The ancestor walk repairs that directory after the daemon has created it as
-# root; shipping it in the image means it is never root-owned to begin with,
-# which is the only thing that covers an entry path that never runs setup()
-# (VS Code "Reopen in Container", a bare `docker compose up`). Two images build
-# that path, so this is a three-file coupling — compose plus both Dockerfiles.
+# ---- 10. the image half of #106 is checked against real images ----
+# Shipping the directory in the image is what covers an entry path that never
+# runs setup() (VS Code "Reopen in Container", a bare `docker compose up`).
+# Whether an IMAGE ships it writable cannot be answered without a daemon, so
+# that fact is typed `ci:` and lives in dev/check-image-mount-parents, which
+# runs #106's own mkdir probe against the built image.
 #
-# DERIVED, not restated (ADR-0005): the directory is read out of
-# docker-compose.yml as the parent of the one mount target that interpolates
-# DEV_CONTAINER_PROJECT_KEY — that variable is what makes the target a
-# per-project subdirectory — so moving or renaming the transcript mount moves
-# this guard with it instead of leaving it asserting a stale literal.
-echo "--- transcript bind parent pre-created in both image routes ---"
-
+# This suite deliberately does NOT parse the Dockerfiles for the mkdir/chown.
+# It did, and that parser was the single worst component of this change: four
+# separate fail-opens (a comment naming the commands satisfied it; a chown to
+# the wrong owner satisfied it; a later chown taking ownership away again
+# satisfied it; the workflow assertion was satisfied by a trigger-path entry),
+# every one of them found by review rather than by its author, and every one in
+# the proxy rather than in the thing being proxied. Deleting it removed ~110
+# lines and every defect this change has had since the Dockerfile edit itself.
+#
+# What is left here is the coupling that keeps the `ci:` half REACHABLE, which
+# is the part a hermetic suite can actually hold:
+#   - both build workflows invoke the checker (a checker no job runs is not a
+#     guard — the #83 shape, a step nobody owned and duly went undone)
+#   - docker-build.yml triggers on docker-compose.yml, because the checker
+#     DERIVES the directory from it: move the transcript mount without touching
+#     a Dockerfile and nothing would rebuild, so nothing would re-derive. That
+#     entry is in the classic workflow only — it is a ~2 minute build, and a red
+#     there blocks the PR just as well as a red in the hour-long two-arch nix
+#     one, which is why the compose file is NOT worth listing there
+#   - the checker does not hardcode what it derives
+echo "--- the ci: half of #106 is wired and reachable ---"
+
+# Derived the same way the checker derives it: the transcript mount is the one
+# whose target interpolates DEV_CONTAINER_PROJECT_KEY (that variable is what
+# makes the target a per-project subdirectory), and its parent is the directory
+# the daemon would otherwise create as root.
 bind_target="$(awk '/^[[:space:]]*target:[[:space:]]/ && /DEV_CONTAINER_PROJECT_KEY/ {print $2}' \
     "$DEV_BASE/docker-compose.yml")"
 assert_eq "exactly one compose target interpolates DEV_CONTAINER_PROJECT_KEY" \
     1 "$(printf '%s' "$bind_target" | grep -c . || true)"
-# Cut at the interpolation and drop the trailing slash: the key is the leaf, so
-# what remains is the parent the daemon would otherwise create.
 bind_parent="${bind_target%%\$\{*}"
 bind_parent="${bind_parent%/}"
 assert_true "the transcript bind's parent derives to a path under /home/vscode" \
     bash -c '[[ "$1" == /home/vscode/?* ]]' _ "$bind_parent"
 
-# precreated <dockerfile> <path> <owner> — prints `mkdir` when some mkdir
-# creates <path>, and `chown` when the LAST command to change its ownership
-# afterwards gives it to <owner>, directly or by -R on an ancestor.
-#
-# Three things it must get right, each one a measured fail-open when it did not
-# (mutations 15-17):
-#   - COMMENTS ARE NOT CODE. Dockerfile comment lines are dropped before
-#     continuations are joined, exactly as the builder does. Without this a
-#     comment naming the mkdir satisfied the assertion while the RUN was gone —
-#     the #97 shape the ledger records, recurring inside its own guard.
-#   - ORDER. BOTH Dockerfiles chown -R /home/vscode ABOVE these lines (the UID
-#     remap), where the directory does not exist yet, so a position-blind check
-#     would read that as coverage.
-#   - THE OWNER, AND THE LAST WRITER OF IT. `chown root:root` satisfies "a
-#     chown happened"; so does a correct chown followed by a later one that
-#     takes the directory away again. Only the final owner is what the image
-#     ships, and it is compared against the compose `user:` — derived, not a
-#     literal.
-# Nothing containing the substring "chown" may be printed on the failing paths:
-# the caller uses assert_contains, so a diagnostic like "chown-by:root" would
-# pass the very assertion it was meant to fail.
-precreated() {
-    python3 - "$1" "$2" "$3" <<'PY'
-import re, sys
-
-# Comment lines first, then continuations: a `#` line inside a wrapped RUN is
-# not part of the command, and joining first would splice it into one.
-text = "\n".join(ln for ln in open(sys.argv[1]).read().split("\n")
-                 if not ln.lstrip().startswith("#")).replace("\\\n", " ")
-path, owner = sys.argv[2], sys.argv[3]
-
-def operands(cmd):
-    return [w.strip('"\'') for w in cmd.split()[1:] if not w.startswith("-")]
-
-mkdir_at = next((m.start() for m in re.finditer(r"mkdir[^&|;\n]*", text)
-                 if path in operands(m.group(0))), None)
-if mkdir_at is None:
-    sys.exit(0)
-print("mkdir")
-
-final = None
-for m in re.finditer(r"chown[^&|;\n]*", text):
-    if m.start() < mkdir_at:
-        continue
-    words = m.group(0).split()
-    recursive = any(w.startswith("-") and "R" in w for w in words)
-    ops = operands(m.group(0))
-    if not ops:
-        continue
-    for target in (t.rstrip("/") for t in ops[1:]):
-        if target == path or (recursive and (path + "/").startswith(target + "/")):
-            final = ops[0]          # last writer wins, so keep looking
-# The group half is not checked: compose declares a user, not a group, so
-# deriving an expectation for it would mean inventing one here.
-if final is not None and final.split(":")[0] == owner:
-    print("chown")
-PY
-}
-
-# Who must own it is derived too: the compose service's `user:` is the identity
-# the container runs as, so it is the one that has to be able to write there.
-compose_user="$(awk '/^[[:space:]]*user:[[:space:]]/ {print $2; exit}' \
-    "$DEV_BASE/docker-compose.yml")"
-assert_nonempty "the compose service user was derived from docker-compose.yml" \
-    "$compose_user"
-
-for dockerfile in "$DEV_BASE/Dockerfile" "$DEV_BASE/nix/base/Dockerfile.nix-default"; do
-    route="${dockerfile#"$DEV_BASE/"}"
-    coverage="$(precreated "$dockerfile" "$bind_parent" "$compose_user")"
-    assert_contains "$route creates $bind_parent" "mkdir" "$coverage"
-    assert_contains "$route leaves it owned by '$compose_user' after creating it" \
-        "chown" "$coverage"
-done
-
-# Anti-vacuity: a parser that answered "mkdir" for anything would pass both
-# routes above while checking nothing.
-assert_eq "the parser reports nothing for a path no Dockerfile creates" \
-    "" "$(precreated "$DEV_BASE/Dockerfile" "$bind_parent-absent" "$compose_user")"
-
-# Everything above reads Dockerfile TEXT, which is a proxy for what the built
-# image ships. The fact itself needs a daemon, so it is typed `ci:` and lives in
-# dev/check-image-mount-parents, invoked by both build workflows. That
-# workflow<->tool coupling is what this suite can hold: a checker no job runs is
-# not a guard, which is the #83 shape (a step nobody owned, duly undone).
 checker="$DEV_BASE/dev/check-image-mount-parents"
 assert_true "the ci: half exists and is executable" test -x "$checker"
 # Anchored on a `run:` step, not a bare mention: the checker's own path is also
 # a TRIGGER-PATH entry in both workflows, so an unanchored grep is satisfied by
 # the file that merely lists it while the step that runs it is gone (mutation
-# 18 — the assertion whose entire job is "a checker no job runs is not a
-# guard", passing on a workflow that runs it nowhere).
+# 9 — the assertion whose entire job is "a checker no job runs is not a guard",
+# passing on a workflow that runs it nowhere).
 for workflow in docker-build.yml nix-base.yml; do
     assert_true "$workflow has a run: step invoking dev/check-image-mount-parents" \
         grep -qE '^[[:space:]]*run:[[:space:]]+dev/check-image-mount-parents[[:space:]]' \
@@ -644,4 +552,16 @@ done
 assert_false "the checker does not hardcode the directory it checks" \
     grep -qF "$bind_parent" "$checker"
 
+# The checker reads docker-compose.yml at run time, so a compose-side move of
+# the mount only reaches it if a build re-runs. docker-compose.yml is no build
+# INPUT — nothing COPYs it — which is exactly why it would not otherwise be
+# listed, and why this needs its own assertion rather than riding on
+# tests/test-docker-build-trigger-paths.sh.
+for event in push pull_request; do
+    assert_true "docker-build.yml triggers on docker-compose.yml ($event)" \
+        bash -c '
+            sed -n "/^  $2:/,/^  [a-z_]*:/p" "$1" | grep -qE "^ +- docker-compose\.yml$"
+        ' _ "$DEV_BASE/.github/workflows/docker-build.yml" "$event"
+done
+
 finish

From b2c60794c4dda3af9c99375e64ce030dc5c15b03 Mon Sep 17 00:00:00 2001
From: t <t@t>
Date: Tue, 11 Aug 2026 08:23:40 -0400
Subject: [PATCH 6/6] docs: trim the commentary this change added
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Measured against the repo rather than to taste: sibling suites run
16-44% comment lines, and tests/test-volume-chown-guard.sh had reached
54%. The lines added by this change were 66% comment.

Cut 130 lines of comment for 61 of replacement, all of it prose I wrote:

  - the section 10 preamble no longer retells the deleted parser's four
    fail-opens; that story is in git log and in one clause of the
    CLAUDE.md invariant, and repeating it in the suite header was a
    third copy
  - the "WHAT WAS DELETED" paragraph goes with it
  - mutation items 8-12 keep what ADR-0005 §2 requires (what was
    changed, how many red, which assertion) and drop the commentary
  - both Dockerfile blocks say why the line exists and what it does not
    cover, and stop re-deriving the mechanism the invariant already
    states
  - the CLAUDE.md entry is one bullet again rather than a section

The file lands at 50%, which is where it already was before this change
touched it (49% at 03d7d84) — the inherited bulk is the items 1-7
mutation record and the METHOD note, both of which survived review
rounds on their own merits and are left alone. dev/check-image-mount-parents
is at 27%, already below its siblings (check-env-drift.sh 32%,
check-gitignore-agents 44%), and is untouched.

No assertion, mutation count or behaviour changed: 55 passed, 0 failed,
bash tests/run-all -> 0 failures, pre-commit run --all-files -> all pass.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J8Q8kBDc2TtCF7ZzSwD3iX
---
 CLAUDE.md                        | 50 +++++++---------
 Dockerfile                       | 21 +++----
 nix/base/Dockerfile.nix-default  | 23 +++-----
 tests/test-volume-chown-guard.sh | 97 +++++++++-----------------------
 4 files changed, 61 insertions(+), 130 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index a6b154d..9a01cd4 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -307,37 +307,25 @@ taxonomy and reads as `test:`.
   docker, but the python snippet inside it is lifted out and run against a
   synthetic config document (test: `tests/test-volume-chown-guard.sh`).
 - BOTH image routes pre-create the transcript bind's parent
-  (`~/.claude/projects`) and chown it to the compose `user:` AFTER creating it,
-  so a fresh `claude-home` volume seeds it user-owned and the daemon never
-  creates it as root. This is belt to the ancestor walk's braces, and it covers
-  what the walk cannot: the walk runs in `setup()`, so an entry path that never
-  calls `dev/devcontainer` — VS Code "Reopen in Container" (#43), a bare `docker
-  compose up` — gets the root-owned directory and the #106 failure back. It
-  covers that for a FRESH volume only: a `claude-home` that already holds a
-  root-owned `projects/` is untouched by a rebuild and still needs the walk (or
-  a `clean`/`reset`), so this narrows who can hit #106, it does not retire the
-  walk. The
-  ordering is load-bearing: both Dockerfiles `chown -R /home/vscode` during the
-  UID remap, ABOVE these lines, where the directory does not exist yet. The nix
-  route carries it in the tail build rather than `nix/base/flake.nix` on
-  purpose — the base pre-creates the other home dirs, but a fix there reaches
-  nobody until a republish AND a `BASE_IMAGE` repin (#83), while the tail
-  rebuilds per project (`ci:` docker-build.yml and nix-base.yml both run
-  `dev/check-image-mount-parents`, which derives the directory and the owner
-  from `docker-compose.yml` and runs #106's own `mkdir` probe as that user
-  against the built image; `test: tests/test-volume-chown-guard.sh` holds only
-  what keeps that check REACHABLE — both workflows invoke it, it is executable,
-  it does not hardcode what it derives, and `docker-compose.yml` is a trigger
-  path of docker-build.yml, since a compose-side move of the mount would
-  otherwise rebuild nothing and the checker would never re-derive. That trigger
-  entry is in the classic workflow only: it is a ~2 minute build, and a red
-  there blocks a PR as well as a red in the hour-long two-arch nix one would.
-  The suite deliberately does NOT re-derive the fact from the Dockerfiles'
-  text: it did, and that parser had four measured fail-opens (a comment naming
-  the commands, a chown to the wrong owner, a later chown taking ownership
-  back, and an unanchored workflow grep) — where a `ci:` check can observe the
-  artefact, a hermetic restatement of the same fact is not a second guard but a
-  second thing to get wrong).
+  (`~/.claude/projects`) and chown it to the compose `user:`, so a FRESH
+  `claude-home` volume seeds it user-owned and the daemon never creates it as
+  root. This covers what the ancestor walk cannot — the walk runs in `setup()`,
+  so an entry path that never calls `dev/devcontainer` (VS Code "Reopen in
+  Container", #43) would get #106 back — but only for a fresh volume: an
+  existing one still needs the walk, a `clean` or a `reset`. The nix route
+  carries it in the tail build, not `nix/base/flake.nix`, because a fix in the
+  base reaches nobody until a republish AND a repin (#83)
+  (`ci:` docker-build.yml and nix-base.yml run `dev/check-image-mount-parents`,
+  which derives directory and owner from `docker-compose.yml` and runs #106's
+  own `mkdir` probe against the built image; `test:
+  tests/test-volume-chown-guard.sh` holds only what keeps that check reachable
+  — both workflows invoke it, it is executable, it does not hardcode what it
+  derives, and `docker-compose.yml` is a trigger path of docker-build.yml, or a
+  compose-side move of the mount rebuilds nothing. The suite deliberately does
+  not re-derive the fact from Dockerfile text: it did, and that parser had four
+  measured fail-opens. Where a `ci:` check can observe the artefact, a hermetic
+  restatement of the same fact is not a second guard but a second thing to get
+  wrong).
 - Lock discipline: per-worktree lock on fd 9, repo-scoped build lock on fd 8;
   any helper backgrounded inside the locked region must be spawned with
   `9>&-` or it holds the worktree lock forever (`test:
diff --git a/Dockerfile b/Dockerfile
index 641e4ae..0eb1bb7 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -89,20 +89,13 @@ RUN printf '. /usr/local/lib/devcontainer/claude-code-token-env.sh\n' \
 # token into the claude-home volume from the :ro host profile store
 # (docs/adr/0001-devcontainer-private-token-isolation.md). Just create the dirs.
 #
-# .claude/projects is here for a second reason: it is the parent of the
-# transcript bind (docker-compose.yml mounts the host log dir at
-# .claude/projects/<key>), so the daemon creates it as root if the image does
-# not ship it — the #106 defect. The ancestor walk in lib/volume-perms.sh
-# repairs that after the fact; creating it here means a FRESH claude-home
-# volume is never wrong in the first place, including on entry paths that never
-# run `dev/devcontainer setup` (VS Code "Reopen in Container", a bare `docker
-# compose up`). Only fresh: an existing volume already holding a root-owned
-# projects/ is unaffected by a rebuild and still needs the walk, a `clean` or a
-# `reset`.
-#
-# The daemon still creates the <key> mount point itself inside the volume, and
-# still as root — but nothing needs to write THAT: it is shadowed by the bind
-# at runtime, and what #106 was about is creating siblings next to it.
+# .claude/projects is here for a second reason: compose mounts the transcript
+# bind at .claude/projects/<key>, so the daemon creates the parent as root if
+# the image does not ship it (#106). lib/volume-perms.sh repairs that after the
+# fact, but only from setup(); shipping it here covers entry paths that never
+# run dev/devcontainer at all. A FRESH claude-home volume seeds from this path
+# — an existing one holding a root-owned projects/ still needs the walk, a
+# clean or a reset.
 RUN mkdir -p /home/vscode/.cache /home/vscode/.ssh /home/vscode/.claude/projects \
     && chown -R vscode:vscode /home/vscode/.cache /home/vscode/.ssh /home/vscode/.claude \
     && chmod 700 /home/vscode/.ssh
diff --git a/nix/base/Dockerfile.nix-default b/nix/base/Dockerfile.nix-default
index a026a8b..806d857 100644
--- a/nix/base/Dockerfile.nix-default
+++ b/nix/base/Dockerfile.nix-default
@@ -44,23 +44,14 @@ RUN if [ "$USER_GID" != "1000" ]; then groupmod -g "$USER_GID" vscode; fi \
         chown -R "$USER_UID:$USER_GID" /home/vscode; \
     fi
 
-# The transcript bind's parent, mirroring the root Dockerfile's mkdir. The Nix
-# base pre-creates the home dirs (nix/base/flake.nix fakeRootCommands) but not
-# this one, and adding it there would reach nobody until a republish AND a
-# BASE_IMAGE repin — so it lives in the tail build, which every nix-route image
-# rebuilds anyway. Without it the daemon creates .claude/projects as root to
-# host the bind that compose mounts at .claude/projects/<key> (#106).
+# The transcript bind's parent, mirroring the root Dockerfile's mkdir (#106).
+# Here rather than in nix/base/flake.nix, where the sibling home dirs are
+# pre-created: a fix in the base reaches nobody until a republish AND a
+# BASE_IMAGE repin (#83), while the tail rebuilds per project.
 #
-# Explicitly chowned rather than left to the remap above: that chown is guarded
-# on USER_UID != 1000, so at the default UID it does not run and this dir would
-# stay root-owned. One empty dir, so this is not the fat-layer case the guard
-# exists to avoid.
-#
-# By NAME, not "$USER_UID:$USER_GID": the remap above has already renumbered
-# vscode, so the name resolves to whatever UID this build asked for, and it
-# states the same identity compose runs the container as (`user: vscode`) —
-# which is what lets the guard compare the owner here against the compose file
-# instead of accepting any chown at all.
+# Chowned explicitly because the remap above is guarded on USER_UID != 1000, so
+# at the default UID it does not run. By NAME, since the remap has already
+# renumbered vscode and the name is the identity compose runs as (`user:`).
 RUN mkdir -p /home/vscode/.claude/projects \
     && chown vscode:vscode /home/vscode/.claude/projects
 
diff --git a/tests/test-volume-chown-guard.sh b/tests/test-volume-chown-guard.sh
index e36e294..b089e11 100755
--- a/tests/test-volume-chown-guard.sh
+++ b/tests/test-volume-chown-guard.sh
@@ -78,37 +78,19 @@
 #      comparison, which is what proves that guard derives both sides rather
 #      than restating a vocabulary.
 #   8. the checker's `run:` step deleted from docker-build.yml — 1 red. The
-#      two workflows are asserted separately, so dropping the check from one
-#      route cannot hide behind the other still running it.
-#   9. the same deletion, plus a trailing comment on the trigger-path entry so
-#      the checker's name still appears in the file — 1 red. This is the
-#      fail-open version of that assertion (an unanchored grep matched the
-#      paths line), closed by anchoring on `run:`; the paths entry that made it
-#      satisfiable was added by this very change.
-#  10. the checker's derivation replaced by the hardcoded literal it derives —
-#      1 red. Note what this mutation does NOT break: the checker still passes
-#      against today's images, which is why a literal there would go unnoticed
+#      workflows are asserted separately, so one route cannot hide behind the
+#      other still running it.
+#   9. the same, plus a trailing comment on the trigger-path entry so the
+#      checker's name still appears in the file — 1 red. This was the
+#      assertion's fail-open form (an unanchored grep matched the paths line),
+#      and the paths entry that made it satisfiable was added by this change.
+#  10. the checker's derivation replaced by its literal — 1 red. It still
+#      passes against today's images, which is why a literal would go unnoticed
 #      until the mount moved.
-#  11. the checker made non-executable — 1 red. `run: dev/check-image-mount-parents`
-#      execs it directly, so a lost mode bit is a CI failure with a confusing
-#      message; this is the #129 shape, caught hermetically.
-#  12. `- docker-compose.yml` removed from docker-build.yml's trigger paths —
-#      2 red, one per event list. Without it a compose-side move of the
-#      transcript mount rebuilds nothing, so the checker never re-derives and
-#      the `ci:` half silently stops covering that direction.
-#
-# WHAT WAS DELETED, and why it is worth recording rather than quietly dropping:
-# an earlier version of item 10 parsed both Dockerfiles for the mkdir/chown, as
-# a hermetic proxy for what the image ships. That parser had FOUR measured
-# fail-opens (a comment naming the commands satisfied it; `chown root:root`
-# satisfied it; a later chown taking ownership away again satisfied it; and the
-# workflow assertion above). All four were found by review, not by its author.
-# Once dev/check-image-mount-parents existed the parser was measuring a proxy
-# for something being measured directly, so it was removed with its seven
-# mutation records — ~110 lines, and every defect this change had after the
-# Dockerfile edit itself. The lesson kept: where a `ci:` check can observe the
-# artefact, a hermetic re-derivation of the same fact from source text is not a
-# second guard, it is a second thing to get wrong.
+#  11. the checker made non-executable — 1 red (#129's shape).
+#  12. `- docker-compose.yml` dropped from docker-build.yml's trigger paths —
+#      2 red, one per event list: nothing rebuilds on a compose-side move of
+#      the mount, so the checker never re-derives.
 #
 # METHOD: measure each mutation in a FRESH copy of the tree, and transcribe the
 # numbers from the run rather than reasoning about them. Three earlier versions
@@ -492,38 +474,19 @@ assert_contains "injected script: mount points arrive in \"\$@\" and resolve und
     "vscode:vscode /home/vscode/.cache" "$(log)"
 
 # ---- 10. the image half of #106 is checked against real images ----
-# Shipping the directory in the image is what covers an entry path that never
-# runs setup() (VS Code "Reopen in Container", a bare `docker compose up`).
-# Whether an IMAGE ships it writable cannot be answered without a daemon, so
-# that fact is typed `ci:` and lives in dev/check-image-mount-parents, which
-# runs #106's own mkdir probe against the built image.
-#
-# This suite deliberately does NOT parse the Dockerfiles for the mkdir/chown.
-# It did, and that parser was the single worst component of this change: four
-# separate fail-opens (a comment naming the commands satisfied it; a chown to
-# the wrong owner satisfied it; a later chown taking ownership away again
-# satisfied it; the workflow assertion was satisfied by a trigger-path entry),
-# every one of them found by review rather than by its author, and every one in
-# the proxy rather than in the thing being proxied. Deleting it removed ~110
-# lines and every defect this change has had since the Dockerfile edit itself.
+# Whether an IMAGE ships the directory writable needs a daemon, so that fact is
+# typed `ci:` and lives in dev/check-image-mount-parents. This suite does NOT
+# re-derive it from the Dockerfiles' text; it did, and that parser had four
+# fail-opens (see CLAUDE.md's invariant, and `git log` for the deletion).
 #
-# What is left here is the coupling that keeps the `ci:` half REACHABLE, which
-# is the part a hermetic suite can actually hold:
-#   - both build workflows invoke the checker (a checker no job runs is not a
-#     guard — the #83 shape, a step nobody owned and duly went undone)
-#   - docker-build.yml triggers on docker-compose.yml, because the checker
-#     DERIVES the directory from it: move the transcript mount without touching
-#     a Dockerfile and nothing would rebuild, so nothing would re-derive. That
-#     entry is in the classic workflow only — it is a ~2 minute build, and a red
-#     there blocks the PR just as well as a red in the hour-long two-arch nix
-#     one, which is why the compose file is NOT worth listing there
-#   - the checker does not hardcode what it derives
+# What is hermetic is the wiring that keeps the ci: check REACHABLE: both
+# workflows invoke it, it is executable, it does not hardcode what it derives,
+# and docker-build.yml triggers on the compose file it derives FROM.
 echo "--- the ci: half of #106 is wired and reachable ---"
 
-# Derived the same way the checker derives it: the transcript mount is the one
-# whose target interpolates DEV_CONTAINER_PROJECT_KEY (that variable is what
-# makes the target a per-project subdirectory), and its parent is the directory
-# the daemon would otherwise create as root.
+# Derived as the checker derives it: the transcript mount is the one whose
+# target interpolates DEV_CONTAINER_PROJECT_KEY, and its parent is the
+# directory the daemon would otherwise create as root.
 bind_target="$(awk '/^[[:space:]]*target:[[:space:]]/ && /DEV_CONTAINER_PROJECT_KEY/ {print $2}' \
     "$DEV_BASE/docker-compose.yml")"
 assert_eq "exactly one compose target interpolates DEV_CONTAINER_PROJECT_KEY" \
@@ -535,11 +498,9 @@ assert_true "the transcript bind's parent derives to a path under /home/vscode"
 
 checker="$DEV_BASE/dev/check-image-mount-parents"
 assert_true "the ci: half exists and is executable" test -x "$checker"
-# Anchored on a `run:` step, not a bare mention: the checker's own path is also
-# a TRIGGER-PATH entry in both workflows, so an unanchored grep is satisfied by
-# the file that merely lists it while the step that runs it is gone (mutation
-# 9 — the assertion whose entire job is "a checker no job runs is not a guard",
-# passing on a workflow that runs it nowhere).
+# Anchored on `run:`, not a bare mention: the checker's path is also a
+# trigger-path entry, so an unanchored grep is satisfied by a workflow that
+# merely lists it and runs it nowhere (mutation 9).
 for workflow in docker-build.yml nix-base.yml; do
     assert_true "$workflow has a run: step invoking dev/check-image-mount-parents" \
         grep -qE '^[[:space:]]*run:[[:space:]]+dev/check-image-mount-parents[[:space:]]' \
@@ -552,11 +513,9 @@ done
 assert_false "the checker does not hardcode the directory it checks" \
     grep -qF "$bind_parent" "$checker"
 
-# The checker reads docker-compose.yml at run time, so a compose-side move of
-# the mount only reaches it if a build re-runs. docker-compose.yml is no build
-# INPUT — nothing COPYs it — which is exactly why it would not otherwise be
-# listed, and why this needs its own assertion rather than riding on
-# tests/test-docker-build-trigger-paths.sh.
+# docker-compose.yml is no build INPUT — nothing COPYs it — so the sibling
+# trigger-path guard has no reason to list it, and only a build re-run gets a
+# compose-side move of the mount back in front of the checker.
 for event in push pull_request; do
     assert_true "docker-build.yml triggers on docker-compose.yml ($event)" \
         bash -c '