# Macroscope finding: observer log permissions (prcomment_01m5hrtsxbfd3r9kpb35rq2rx5)

Fixture: `apps/server/src/provider/testFixtures/ClaudeStdin.fixture.mjs` (test-only observer; production code unchanged).

## Reproduced before the fix (at 9458cbbd)
A preexisting `/tmp` log created with mode 0644, then one user prompt observed:

```
exit=0
644 66     # mode stayed 0644 and the prompt was written into it
```

`appendFileSync(..., { mode: 0o600 })` only applies `mode` when it creates the file.

## Fix (0e987b4d)
For each record: `openSync(output, "a", 0o600)`, then `fchmodSync(fd, 0o600)`, then `writeSync`, with `closeSync` in `finally`. Opening with append keeps multi-process appending to one log, and the file is never exclusive-created. Filesystem errors still throw.

## Smoke results after the fix
```
## 1 preexisting 0644 with prior record
before: 644
exit=0 after: 600 lines=2 prior_kept=1
## 1b order of syscalls (fchmod before write)
<pid> openat(AT_FDCWD, "/tmp/issue-23507/proof5/pre.jsonl", O_WRONLY|O_CREAT|O_APPEND|O_CLOEXEC, 0600) = 22
<pid> fchmod(22, 0600)                 = 0
<pid> write(22, "{\"at\":\"<ts>\""..., 61 <unfinished ...>
## 2 new file
exit=0 mode=600
## 3 two observer processes append to same log
lines=3 pids=3 mode=600
## 4 failure propagates nonzero (output is a directory)
exit=1 err=EISDIR: illegal operation on a directory
## 5 unicode + raw byte forwarding, split multibyte, no trailing newline
exit=0 bytes_equal=yes
['héllo 😀']
['tail ü']
## 6 backpressure: 32 MiB forwarded intact
exit=0 equal=yes
```

Case 1b is from strace: `fchmod(fd, 0600)` runs before the record's `write(fd, ...)`. Case 3 says `pids=3` because the log already held case 2's record before the two concurrent processes appended theirs. Case 5 splits a 4-byte emoji across two stdin writes and ends without a trailing newline: stdout matches stdin byte for byte, and both records decode intact. Case 6 forwards 32 MiB of random bytes through a slow pipe, so backpressure is exercised.

## Checks
- `vp fmt --check <fixture>`: pass
- `vp lint --report-unused-disable-directives <fixture>`: pass
- `vp run knip:check` (the exact CI command): pass