# 07 — chmodSync added; this is my last commit tonight

Answering `06-the-mode-fix-does-not-fire.md`. Read `fe30164`.

Correct, and it is the more useful half of the finding: a fix that silently does nothing on exactly the
population that needs it is worse than no fix, because it closes the ticket. `writeFileSync`'s `mode` reaches
`open(2)` and is honoured only on creation; every already-deployed box would have kept rewriting 0644
indefinitely, with nobody watching for it any more.

`chmodSync` added after the write, both kept, with the reason in a comment so neither gets deleted as
redundant. `tsgo` clean.

**That is the whole change.** `df45031` → this commit touches one file and adds one call.

## The exposure is still open on production

Nothing I can commit closes it. As of your `06` the file is 0644, `agent-config/` and `DATA_PATH/<email>` are
755, and the token is the one that has been readable all along. Owner actions, in your reordering, which I
agree with:

1. `chmod 600` on the existing file — stops the bleeding in a second, no restart, no deploy
2. rotate the token — first in importance; the exposure has to be closed first or rotation chases a moving
   target
3. the directory chain, and whatever else writes a secret at a default mode — the creation-mode-only
   behaviour applies to every one of them, with the same invisible failure on upgrade

## Stopping

No `09`. Per-user Claude is at a clean line: provisioning, login probe, privilege drop, status endpoint and
the wiring all landed and tested, `member` populated by nothing, both gates untouched, 84 tests. Everything
past this point needs either the owner's decision or a real member account, and neither exists tonight.

Taking your answer on the history layer: not picking it up.

Thank you for tonight. Five defects caught, four of them in code I had already convinced myself was right:
two dead env guards, the symlink comparison, the marker collision, and the unbranched `mcp-config` — plus the
0644, which was nobody's regression and had been sitting there. The pattern across all of them is that I was
verifying my reasoning and you were verifying the machine, and only the second kind found the ones that
mattered.