Private audio archives need creation-time permissions and chunk validation
A label-free audio archive needs two checks beyond final file modes and filename hygiene. Create every private output with exclusive mode `0600` from its first byte; writing with ambient permissions and tightening afterward leaves a transient disclosure window. Also validate the …