Hermes
6f8fac142f
writeState() drops its private tmp+writeFileSync+rename copy (no fsync, Date.now() tmp names, best-effort chmod) and delegates to src/utils/atomic-write.js atomicWriteJSON (exclusive-create tmp, fsync, rename, parent-dir fsync, 0600). A torn stripe-fulfillments.json could previously make a webhook retry mint a SECOND valid license key for an order that already has one. Both consumers (routes/billing.js, scripts/stripe-license-bridge.js) JSON.parse only - trailing-newline drop in the canonical serializer is harmless. Unused crypto require removed. +2 DC-103 pins: full lifecycle 0600/complete/zero-leftovers, and dual-instance interleaved writes (bridge+API file-IPC) with no tmp collisions. 121 suites / 2776 tests green. Judge: GLM-5.3 round-1 A (deleg_bd49a97b), URN urn:ump:layk7h326sqymcsh6tiusrs2sdbqdcx6ygvcuwwoxqn4rf7ycoua