pi-crew 0.9.16 → 0.9.18

package/src/state/atomic-write.ts

@@ -3,8 +3,8 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { logInternalError } from "../utils/internal-error.ts";
-import { isWorkerAtomicWriterEnabled, atomicWriteFileViaWorker } from "./worker-atomic-writer.ts";
 import { sleepSync } from "../utils/sleep.ts";
+import { atomicWriteFileViaWorker, isWorkerAtomicWriterEnabled } from "./worker-atomic-writer.ts";
 
 function hashContent(content: string): string {
 	return crypto.createHash("sha256").update(content, "utf-8").digest("hex");
@@ -68,7 +68,9 @@ export function isSymlinkSafePath(filePath: string): boolean {
 							// Found existing ancestor — join with remaining non-existent parts
 							realBase = path.join(resolved, path.relative(walk, baseDir));
 							break;
-						} catch { /* not found yet, keep walking */ }
+						} catch {
+							/* not found yet, keep walking */
+						}
 					}
 					const realDirNorm = realDir.endsWith(path.sep) ? realDir : realDir + path.sep;
 					const realBaseNorm = realBase.endsWith(path.sep) ? realBase : realBase + path.sep;
@@ -84,7 +86,11 @@ export function isSymlinkSafePath(filePath: string): boolean {
 					if (typeof process.getuid === "function" && realStat.uid !== process.getuid()) {
 						const systemTmp = (typeof os.tmpdir === "function" ? os.tmpdir() : "/tmp").toLowerCase();
 						let realSystemTmp = systemTmp;
-						try { realSystemTmp = fs.realpathSync(systemTmp).toLowerCase(); } catch { /* ok */ }
+						try {
+							realSystemTmp = fs.realpathSync(systemTmp).toLowerCase();
+						} catch {
+							/* ok */
+						}
 						const realDirLower = realDir.toLowerCase();
 						const dirNorm = realDirLower.endsWith(path.sep) ? realDirLower : realDirLower + path.sep;
 						const tmpNorm = realSystemTmp.endsWith(path.sep) ? realSystemTmp : realSystemTmp + path.sep;
@@ -95,11 +101,14 @@ export function isSymlinkSafePath(filePath: string): boolean {
 						// Also accept canonical system temp paths:
 						// - /tmp → /private/tmp (macOS)
 						// - /var/folders → /private/var/folders (macOS)
-						const isSystemTmp = process.platform === "darwin" && (
-							realDirLower === "/tmp" || realDirLower === "/private/tmp" ||
-							realDirLower === "/var/folders" || realDirLower === "/private/var/folders" ||
-							realDirLower.startsWith("/var/folders/") || realDirLower.startsWith("/private/var/folders/")
-						);
+						const isSystemTmp =
+							process.platform === "darwin" &&
+							(realDirLower === "/tmp" ||
+								realDirLower === "/private/tmp" ||
+								realDirLower === "/var/folders" ||
+								realDirLower === "/private/var/folders" ||
+								realDirLower.startsWith("/var/folders/") ||
+								realDirLower.startsWith("/private/var/folders/"));
 						if (!isInsideTmp && !isAncestorOfTmp && !isSystemTmp) {
 							return false;
 						}
@@ -124,7 +133,6 @@ export function isSymlinkSafePath(filePath: string): boolean {
 			currentPath = dir;
 		}
 
-
 		// Issue 1 fix: verify baseDir itself is not a symlink.
 		// The while loop above walks ancestors but stops when currentPath reaches
 		// root (currentPath === path.dirname(currentPath)). If baseDir is a symlink
@@ -152,18 +160,20 @@ export function isSymlinkSafePath(filePath: string): boolean {
 	}
 }
 
-
-
 function sleep(ms: number): Promise<void> {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
 function isRetryableRenameError(error: unknown): boolean {
-	return Boolean(error && typeof error === "object" && "code" in error && RETRYABLE_RENAME_CODES.has(String((error as NodeJS.ErrnoException).code)));
+	return Boolean(
+		error && typeof error === "object" && "code" in error && RETRYABLE_RENAME_CODES.has(String((error as NodeJS.ErrnoException).code)),
+	);
 }
 
 function isRetryableLinkError(error: unknown): boolean {
-	return Boolean(error && typeof error === "object" && "code" in error && RETRYABLE_LINK_CODES.has(String((error as NodeJS.ErrnoException).code)));
+	return Boolean(
+		error && typeof error === "object" && "code" in error && RETRYABLE_LINK_CODES.has(String((error as NodeJS.ErrnoException).code)),
+	);
 }
 
 /**
@@ -181,7 +191,11 @@ function renameWithLinkSync(tempPath: string, filePath: string, retries = 8): vo
 			// path aliases are mixed (e.g. RUNNER~1 vs runneradmin). Use
 			// renameSync which handles this correctly via MoveFileEx.
 			if (process.platform === "win32") {
-				try { fs.unlinkSync(filePath); } catch { /* destination may not exist */ }
+				try {
+					fs.unlinkSync(filePath);
+				} catch {
+					/* destination may not exist */
+				}
 				try {
 					fs.renameSync(tempPath, filePath);
 					return;
@@ -191,7 +205,11 @@ function renameWithLinkSync(tempPath: string, filePath: string, retries = 8): vo
 				}
 			} else {
 				// First try to unlink any existing file at destination (hard links don't follow symlinks)
-				try { fs.unlinkSync(filePath); } catch { /* destination may not exist */ }
+				try {
+					fs.unlinkSync(filePath);
+				} catch {
+					/* destination may not exist */
+				}
 				// Create hard link - does NOT follow symlinks at filePath
 				fs.linkSync(tempPath, filePath);
 				// Successfully linked - now unlink the temp file
@@ -214,7 +232,11 @@ async function renameWithLinkAsync(tempPath: string, filePath: string, retries =
 	for (let attempt = 0; attempt <= retries; attempt++) {
 		try {
 			if (process.platform === "win32") {
-				try { await fs.promises.unlink(filePath); } catch { /* destination may not exist */ }
+				try {
+					await fs.promises.unlink(filePath);
+				} catch {
+					/* destination may not exist */
+				}
 				try {
 					await fs.promises.rename(tempPath, filePath);
 					return;
@@ -223,7 +245,11 @@ async function renameWithLinkAsync(tempPath: string, filePath: string, retries =
 					if (!isRetryableLinkError(renameError) || attempt === retries) break;
 				}
 			} else {
-				try { await fs.promises.unlink(filePath); } catch { /* destination may not exist */ }
+				try {
+					await fs.promises.unlink(filePath);
+				} catch {
+					/* destination may not exist */
+				}
 				await fs.promises.link(tempPath, filePath);
 				await fs.promises.unlink(tempPath);
 				return;
@@ -239,7 +265,12 @@ async function renameWithLinkAsync(tempPath: string, filePath: string, retries =
 	throw lastError;
 }
 
-export function renameWithRetry(tempPath: string, filePath: string, retries = 8, rename: (oldPath: string, newPath: string) => void = fs.renameSync): void {
+export function renameWithRetry(
+	tempPath: string,
+	filePath: string,
+	retries = 8,
+	rename: (oldPath: string, newPath: string) => void = fs.renameSync,
+): void {
 	let lastError: unknown;
 	for (let attempt = 0; attempt <= retries; attempt++) {
 		try {
@@ -262,7 +293,12 @@ export function renameWithRetry(tempPath: string, filePath: string, retries = 8,
 /** Test alias for renameWithRetry. */
 export const __test__renameWithRetry = renameWithRetry;
 
-export async function renameWithRetryAsync(tempPath: string, filePath: string, retries = 8, rename: (oldPath: string, newPath: string) => Promise<void> = (source, destination) => fs.promises.rename(source, destination)): Promise<void> {
+export async function renameWithRetryAsync(
+	tempPath: string,
+	filePath: string,
+	retries = 8,
+	rename: (oldPath: string, newPath: string) => Promise<void> = (source, destination) => fs.promises.rename(source, destination),
+): Promise<void> {
 	let lastError: unknown;
 	for (let attempt = 0; attempt <= retries; attempt++) {
 		try {
@@ -303,7 +339,11 @@ export function atomicWriteFile(filePath: string, content: string, expectedHash?
 			const r = fs.realpathSync.native(p);
 			return r.startsWith("\\\\?\\") ? r.slice(4) : r;
 		} catch {
-			try { return fs.realpathSync(p); } catch { return p; }
+			try {
+				return fs.realpathSync(p);
+			} catch {
+				return p;
+			}
 		}
 	};
 	const dirPath = path.dirname(filePath);
@@ -312,7 +352,7 @@ export function atomicWriteFile(filePath: string, content: string, expectedHash?
 	} catch (error) {
 		if (process.platform === "win32" && (error as NodeJS.ErrnoException).code === "EPERM") {
 			// mkdir hit a short/long-name alias wall — retry with the canonical
-		// form. The write itself still targets the original filePath below.
+			// form. The write itself still targets the original filePath below.
 			const realDir = canonicalize(dirPath);
 			if (realDir !== dirPath) fs.mkdirSync(realDir, { recursive: true });
 		} else {
@@ -332,6 +372,16 @@ export function atomicWriteFile(filePath: string, content: string, expectedHash?
 			throw new Error(`Refusing to write: opened path is not a regular file: ${tempPath}`);
 		}
 		fs.writeSync(fd, content, undefined, "utf-8");
+		// FIX (2026-07-01 mailbox-replay CI flake investigation): fsync the data
+		// before close. Without this, writeSync puts content in page cache but
+		// the data may not be flushed to disk before the subsequent rename.
+		// On shared CI runners (Ubuntu, high I/O pressure), a subsequent
+		// readFileSync could see the OLD content if the page cache evicted
+		// between write and read. fsyncSync forces the data to disk so the
+		// rename + post-rename read always sees the new content. Cost: ~1ms
+		// per write (acceptable for the small delivery.json / manifest.json
+		// files this function writes; large state-store uses the async path).
+		fs.fsyncSync(fd);
 		fs.closeSync(fd);
 		try {
 			// Issue 1 fix: re-check symlink safety immediately before rename.
@@ -346,6 +396,23 @@ export function atomicWriteFile(filePath: string, content: string, expectedHash?
 			}
 			// Issue 1 fix: use link+unlink instead of rename to avoid following symlinks
 			renameWithLinkSync(tempPath, filePath);
+			// FIX (2026-07-01 mailbox-replay CI flake): fsync the parent directory
+			// after rename so the directory entry update is durable. On most Linux
+			// filesystems, rename is journaled but the journal flush isn't always
+			// synchronous; without this, a subsequent open() after rename can
+			// race and see ENOENT or stale content on high-IO CI runners.
+			// We skip on Windows where directory fsync semantics differ (and
+			// where the Windows-specific rename path in renameWithLinkSync already
+			// uses MoveFileEx which is fully durable).
+			if (process.platform !== "win32") {
+				try {
+					const dirFd = fs.openSync(path.dirname(filePath), "r");
+					fs.fsyncSync(dirFd);
+					fs.closeSync(dirFd);
+				} catch {
+					/* best-effort — not all filesystems support directory fsync */
+				}
+			}
 		} catch (renameError) {
 			// Issue 4 fix: use finally block to guarantee temp file cleanup.
 			// Between the initial isSymlinkSafePath check and rename attempt,
@@ -374,12 +441,15 @@ export function atomicWriteFile(filePath: string, content: string, expectedHash?
 		// Issue 4 fix: always clean up temp file, regardless of success or error path.
 		// This ensures no orphaned temp files remain when errors occur at any point.
 		if (fd !== undefined) {
-			try { fs.rmSync(tempPath, { force: true }); } catch { /* best-effort */ }
+			try {
+				fs.rmSync(tempPath, { force: true });
+			} catch {
+				/* best-effort */
+			}
 		}
 	}
 }
 
-
 export async function atomicWriteFileAsync(filePath: string, content: string): Promise<void> {
 	// Phase 1.5 (RFC 15): when the worker-thread atomic writer is enabled
 	// (PI_CREW_WORKER_ATOMIC_WRITER=1), dispatch to a dedicated worker thread
@@ -412,7 +482,11 @@ export async function atomicWriteFileAsync(filePath: string, content: string): P
 			// The post-rename lstat check only runs on rename failure, so we must
 			// check BEFORE the rename to catch this TOCTOU race.
 			if (!isSymlinkSafePath(filePath)) {
-				try { await fs.promises.rm(tempPath, { force: true }); } catch { /* best-effort */ }
+				try {
+					await fs.promises.rm(tempPath, { force: true });
+				} catch {
+					/* best-effort */
+				}
 				throw new Error(`Refusing to rename: target became a symlink or inside untrusted directory: ${filePath}`);
 			}
 			// Issue 1 fix: use link+unlink instead of rename to avoid following symlinks
@@ -445,7 +519,6 @@ export async function atomicWriteFileAsync(filePath: string, content: string): P
 	}
 }
 
-
 export function atomicWriteJson<T>(filePath: string, value: T): void {
 	atomicWriteFile(filePath, `${JSON.stringify(value, null, 2)}\n`);
 }
@@ -500,7 +573,13 @@ export function atomicWriteJsonCoalesced<T>(filePath: string, value: T, coalesce
 	timer.unref();
 	// Issue 2 fix: increment generation for each new entry
 	const generation = ++writeGeneration;
-	pendingAtomicWrites.set(filePath, { content, timer, coalesceMs, retryCount: 0, generation });
+	pendingAtomicWrites.set(filePath, {
+		content,
+		timer,
+		coalesceMs,
+		retryCount: 0,
+		generation,
+	});
 }
 
 function flushOnePendingAtomicWrite(filePath: string): void {
@@ -536,7 +615,7 @@ function flushOnePendingAtomicWrite(filePath: string): void {
 				throw error;
 			}
 			// Exponential backoff: base delay * 2^(retryCount-1), capped at 30 seconds
-			const backoffMs = Math.min(30000, current.coalesceMs * Math.pow(2, current.retryCount - 1));
+			const backoffMs = Math.min(30000, current.coalesceMs * 2 ** (current.retryCount - 1));
 			const timer = setTimeout(() => flushOnePendingAtomicWrite(filePath), backoffMs);
 			timer.unref();
 			current.timer = timer;

package/src/state/blob-store.ts

@@ -1,10 +1,10 @@
+import { createHash, randomUUID } from "node:crypto";
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { createHash, randomUUID } from "node:crypto";
 import { resolveRealContainedPath } from "../utils/safe-paths.ts";
+import { sleepSync } from "../utils/sleep.ts";
 import { atomicWriteFile, renameWithRetry } from "./atomic-write.ts";
 import { withFileLockSync } from "./locks.ts";
-import { sleepSync } from "../utils/sleep.ts";
 
 const SHA256_HEX = /^[a-f0-9]{64}$/i;
 
@@ -32,11 +32,19 @@ function atomicWriteBuffer(filePath: string, content: Buffer): void {
 		fs.writeSync(fd, content, 0, content.length);
 		renameWithRetry(tempPath, filePath);
 	} catch (error) {
-		try { fs.rmSync(tempPath, { force: true }); } catch { /* best-effort */ }
+		try {
+			fs.rmSync(tempPath, { force: true });
+		} catch {
+			/* best-effort */
+		}
 		throw error;
 	} finally {
 		// Always close fd; closeSync is safe to call even if fd was already closed
-		try { fs.closeSync(fd); } catch { /* best-effort */ }
+		try {
+			fs.closeSync(fd);
+		} catch {
+			/* best-effort */
+		}
 	}
 }
 
@@ -75,7 +83,9 @@ export interface BlobWriteResult {
 }
 
 function sha256Of(content: string | Buffer): string {
-	return createHash("sha256").update(typeof content === "string" ? content : content).digest("hex");
+	return createHash("sha256")
+		.update(typeof content === "string" ? content : content)
+		.digest("hex");
 }
 
 /**
@@ -85,16 +95,19 @@ function sha256Of(content: string | Buffer): string {
  * partial writes on crash. The deduplication check is now advisory (the atomic
  * write handles concurrent writes correctly via O_EXCL temp file pattern).
  */
-export function writeBlob(artifactsRoot: string, input: {
-	content: string | Buffer;
-	runId: string;
-	taskId?: string;
-	mime?: string;
-	producer: string;
-	originalPath: string;
-	redacted?: boolean;
-	retention?: BlobMetadata["retention"];
-}): BlobWriteResult {
+export function writeBlob(
+	artifactsRoot: string,
+	input: {
+		content: string | Buffer;
+		runId: string;
+		taskId?: string;
+		mime?: string;
+		producer: string;
+		originalPath: string;
+		redacted?: boolean;
+		retention?: BlobMetadata["retention"];
+	},
+): BlobWriteResult {
 	const content = input.content;
 	const hash = sha256Of(content);
 	const algorithm = SHA256_PREFIX;
@@ -165,11 +178,15 @@ export function writeBlob(artifactsRoot: string, input: {
 				// taskId, the conflict check passes and both writes succeed — the
 				// final taskId reflects whichever write completed last.
 				// Callers should not rely on taskId for correctness-critical decisions.
-				if (existingMeta.mime !== metadata.mime ||
+				if (
+					existingMeta.mime !== metadata.mime ||
 					existingMeta.retention !== metadata.retention ||
 					existingMeta.producer !== metadata.producer ||
-					existingMeta.originalPath !== metadata.originalPath) {
-					throw new Error(`Concurrent metadata write conflict for blob ${hash}: different metadata values detected. Existing: ${JSON.stringify(existingMeta)}, New: ${JSON.stringify(metadata)}`);
+					existingMeta.originalPath !== metadata.originalPath
+				) {
+					throw new Error(
+						`Concurrent metadata write conflict for blob ${hash}: different metadata values detected. Existing: ${JSON.stringify(existingMeta)}, New: ${JSON.stringify(metadata)}`,
+					);
 				}
 			} catch (err) {
 				if (err instanceof Error && err.message.includes("ENOENT")) {
@@ -203,7 +220,11 @@ export function writeBlob(artifactsRoot: string, input: {
 		// file from a failed content write) — which is the only unambiguously-safe
 		// case to clean up here.
 		if (!blobContentWritten) {
-			try { fs.rmSync(blobPath, { force: true }); } catch { /* best-effort */ }
+			try {
+				fs.rmSync(blobPath, { force: true });
+			} catch {
+				/* best-effort */
+			}
 		}
 		throw error;
 	}
@@ -211,7 +232,13 @@ export function writeBlob(artifactsRoot: string, input: {
 	// Issue 2 fix: resolve paths before writes and return cached values
 	const resolvedBlobPath = resolveRealContainedPath(artifactsRoot, blobPath);
 	const resolvedMetadataPath = resolveRealContainedPath(artifactsRoot, metadataPath);
-	return { hash, algorithm, blobPath: resolvedBlobPath, metadataPath: resolvedMetadataPath, sizeBytes: metadata.sizeBytes };
+	return {
+		hash,
+		algorithm,
+		blobPath: resolvedBlobPath,
+		metadataPath: resolvedMetadataPath,
+		sizeBytes: metadata.sizeBytes,
+	};
 }
 
 /**

package/src/state/contracts.ts

@@ -1,11 +1,26 @@
 export const TEAM_RUN_STATUSES = ["queued", "planning", "running", "blocked", "completed", "failed", "cancelled"] as const;
-export type TeamRunStatus = typeof TEAM_RUN_STATUSES[number];
+export type TeamRunStatus = (typeof TEAM_RUN_STATUSES)[number];
 
-export const TEAM_TASK_STATUSES = ["queued", "running", "waiting", "completed", "failed", "cancelled", "skipped", "needs_attention"] as const;
-export type TeamTaskStatus = typeof TEAM_TASK_STATUSES[number];
+export const TEAM_TASK_STATUSES = [
+	"queued",
+	"running",
+	"waiting",
+	"completed",
+	"failed",
+	"cancelled",
+	"skipped",
+	"needs_attention",
+] as const;
+export type TeamTaskStatus = (typeof TEAM_TASK_STATUSES)[number];
 
 export const TEAM_TERMINAL_RUN_STATUSES: ReadonlySet<TeamRunStatus> = new Set(["blocked", "completed", "failed", "cancelled"]);
-export const TEAM_TERMINAL_TASK_STATUSES: ReadonlySet<TeamTaskStatus> = new Set(["completed", "failed", "cancelled", "skipped", "needs_attention"]);
+export const TEAM_TERMINAL_TASK_STATUSES: ReadonlySet<TeamTaskStatus> = new Set([
+	"completed",
+	"failed",
+	"cancelled",
+	"skipped",
+	"needs_attention",
+]);
 
 export const TEAM_RUN_STATUS_TRANSITIONS: Readonly<Record<TeamRunStatus, readonly TeamRunStatus[]>> = {
 	queued: ["planning", "running", "cancelled", "failed"],
@@ -93,7 +108,7 @@ const TEAM_EVENT_TYPES = [
 	"dwf.failed",
 	"dwf.log",
 ] as const;
-export type TeamEventType = typeof TEAM_EVENT_TYPES[number];
+export type TeamEventType = (typeof TEAM_EVENT_TYPES)[number];
 
 export const TEAM_WAKEABLE_EVENT_TYPES: ReadonlySet<TeamEventType> = new Set([
 	"run.blocked",

package/src/state/crew-init.ts

@@ -89,10 +89,7 @@ function parseRoot(start: string): string {
 		const rest = start.slice(2);
 		const firstSep = Math.max(rest.indexOf("\\"), rest.indexOf("/"));
 		if (firstSep === -1) return start;
-		const secondSep = Math.max(
-			rest.indexOf("\\", firstSep + 1),
-			rest.indexOf("/", firstSep + 1),
-		);
+		const secondSep = Math.max(rest.indexOf("\\", firstSep + 1), rest.indexOf("/", firstSep + 1));
 		if (secondSep === -1) return start;
 		// secondSep is an index into `rest`; add 2 to map back to `start`.
 		return start.slice(0, 2 + secondSep);
@@ -136,17 +133,11 @@ function safeJoin(...parts: string[]): string {
 	}
 	// Strip the leading separator(s) from the first part before joining, so
 	// the collapse regex doesn't re-collapse them.
-	const firstPartStripped =
-		sep === "\\"
-			? firstPart.replace(/^\\{1,2}/, "")
-			: firstPart.replace(/^\/+/, "");
+	const firstPartStripped = sep === "\\" ? firstPart.replace(/^\\{1,2}/, "") : firstPart.replace(/^\/+/, "");
 	const rest = filtered.slice(1);
 	const joined = [firstPartStripped, ...rest].filter(Boolean).join(sep);
 	// Collapse internal runs of the separator.
-	const collapsed = joined.replace(
-		new RegExp(`${sep === "\\" ? "\\\\" : "/"}{2,}`, "g"),
-		sep,
-	);
+	const collapsed = joined.replace(new RegExp(`${sep === "\\" ? "\\\\" : "/"}{2,}`, "g"), sep);
 	return leading + collapsed;
 }
 
@@ -171,17 +162,9 @@ function safeResolve(p: string, pathDep?: typeof path): string {
 	return p;
 }
 
-function findProjectRoot(
-	start: string,
-	pathDep?: typeof path,
-): string | undefined {
+function findProjectRoot(start: string, pathDep?: typeof path): string | undefined {
 	const dirMarkers = [".git", ".hg", ".svn"];
-	const fileMarkers = [
-		"package.json",
-		"pyproject.toml",
-		"Cargo.toml",
-		"go.mod",
-	];
+	const fileMarkers = ["package.json", "pyproject.toml", "Cargo.toml", "go.mod"];
 	// Use `parseRoot` (inlined above) to avoid `path.parse` for the critical
 	// termination root — fixes the jiti namespace race in issue #28.
 	const root = parseRoot(start);

package/src/state/decision-ledger.ts

@@ -30,24 +30,15 @@ export interface RolloutEntry {
  * Uses projectCrewRoot() to honour the `.pi/teams/` fallback for `.pi`-based
  * projects (see issue #29).
  */
-function getLedgerPath(
-	runId: string,
-	stateRoot?: string,
-	cwd?: string,
-): string {
-	const base =
-		stateRoot ??
-		join(projectCrewRoot(cwd ?? process.cwd()), "state", "runs", runId);
+function getLedgerPath(runId: string, stateRoot?: string, cwd?: string): string {
+	const base = stateRoot ?? join(projectCrewRoot(cwd ?? process.cwd()), "state", "runs", runId);
 	return `${base}/decision-ledger.jsonl`;
 }
 
 /**
  * Compute coherence marks based on existing ledger entries.
  */
-function computeCoherence(
-	entry: RolloutEntry,
-	ledger: RolloutEntry[],
-): CoherenceMark {
+function computeCoherence(entry: RolloutEntry, ledger: RolloutEntry[]): CoherenceMark {
 	if (ledger.length === 0) {
 		return {
 			matchesPrior: false,
@@ -59,22 +50,15 @@ function computeCoherence(
 
 	const previousEntry = ledger[ledger.length - 1];
 	const matchesPrior: boolean =
-		entry.decisionMark === previousEntry.decisionMark ||
-		Boolean(
-			entry.priorWinner &&
-				entry.topCandidates.includes(entry.priorWinner),
-		);
+		entry.decisionMark === previousEntry.decisionMark || Boolean(entry.priorWinner && entry.topCandidates.includes(entry.priorWinner));
 
 	// Check last 10 entries for recursive pattern
 	const recentEntries = ledger.slice(-10);
 	const recentDecisions = recentEntries.map((e) => e.decisionMark);
 	const currentDecision = entry.decisionMark;
 
-	const recursiveMatches = recentDecisions.filter(
-		(d) => d === currentDecision,
-	).length;
-	const matchesRecursive =
-		recursiveMatches >= Math.ceil(recentDecisions.length / 2); // At least half match
+	const recursiveMatches = recentDecisions.filter((d) => d === currentDecision).length;
+	const matchesRecursive = recursiveMatches >= Math.ceil(recentDecisions.length / 2); // At least half match
 
 	const promotionAllowed = matchesPrior || matchesRecursive;
 
@@ -146,10 +130,7 @@ export function appendEntry(runId: string, entry: RolloutEntry): RolloutEntry {
 		// Append to JSONL file using atomic write to prevent corruption
 		// Use the already-loaded ledger content (no double-read)
 		const line = JSON.stringify(entryWithCoherence) + "\n";
-		const existingContent =
-			ledger.length > 0
-				? ledger.map((e) => JSON.stringify(e)).join("\n") + "\n"
-				: "";
+		const existingContent = ledger.length > 0 ? ledger.map((e) => JSON.stringify(e)).join("\n") + "\n" : "";
 		atomicWriteFile(ledgerPath, existingContent + line);
 	});
 
@@ -201,15 +182,7 @@ export function summarizeLedger(runId: string): string {
 		return "# Decision Ledger Summary\n\n*No entries recorded yet.*";
 	}
 
-	const lines: string[] = [
-		"# Decision Ledger Summary",
-		"",
-		`Run ID: ${runId}`,
-		`Total Entries: ${ledger.length}`,
-		"",
-		"## Entries",
-		"",
-	];
+	const lines: string[] = ["# Decision Ledger Summary", "", `Run ID: ${runId}`, `Total Entries: ${ledger.length}`, "", "## Entries", ""];
 
 	for (let i = 0; i < ledger.length; i++) {
 		const entry = ledger[i];
@@ -224,20 +197,12 @@ export function summarizeLedger(runId: string): string {
 			lines.push(`- **Prior Winner**: ${entry.priorWinner}`);
 		}
 
-		lines.push(
-			`- **Top Candidates**: ${entry.topCandidates.join(", ") || "(none)"}`,
-		);
+		lines.push(`- **Top Candidates**: ${entry.topCandidates.join(", ") || "(none)"}`);
 		lines.push("");
 		lines.push("#### Coherence");
-		lines.push(
-			`- **Matches Prior**: ${entry.coherenceMark.matchesPrior ? "✓" : "✗"}`,
-		);
-		lines.push(
-			`- **Matches Recursive**: ${entry.coherenceMark.matchesRecursive ? "✓" : "✗"}`,
-		);
-		lines.push(
-			`- **Promotion Allowed**: ${entry.coherenceMark.promotionAllowed ? "✓" : "✗"}`,
-		);
+		lines.push(`- **Matches Prior**: ${entry.coherenceMark.matchesPrior ? "✓" : "✗"}`);
+		lines.push(`- **Matches Recursive**: ${entry.coherenceMark.matchesRecursive ? "✓" : "✗"}`);
+		lines.push(`- **Promotion Allowed**: ${entry.coherenceMark.promotionAllowed ? "✓" : "✗"}`);
 		lines.push(`- **Reason**: ${entry.coherenceMark.reason}`);
 		lines.push("");
 	}
@@ -259,12 +224,8 @@ export function summarizeLedger(runId: string): string {
 	lines.push(`| Decay    | ${decayCount} |`);
 	lines.push("");
 
-	const promotedCount = ledger.filter(
-		(e) => e.coherenceMark.promotionAllowed,
-	).length;
-	lines.push(
-		`**Promotion Rate**: ${promotedCount}/${ledger.length} (${((promotedCount / ledger.length) * 100).toFixed(1)}%)`,
-	);
+	const promotedCount = ledger.filter((e) => e.coherenceMark.promotionAllowed).length;
+	lines.push(`**Promotion Rate**: ${promotedCount}/${ledger.length} (${((promotedCount / ledger.length) * 100).toFixed(1)}%)`);
 
 	return lines.join("\n");
 }
@@ -282,10 +243,7 @@ export function summarizeLedger(runId: string): string {
  * FIX: Wrap read+write in file lock to prevent concurrent promotion/decay
  * calls from losing entries.
  */
-export function promoteCandidate(
-	runId: string,
-	candidate: string,
-): RolloutEntry {
+export function promoteCandidate(runId: string, candidate: string): RolloutEntry {
 	assertSafePathId("runId", runId);
 	assertSafePathId("candidate", candidate);
 
@@ -314,10 +272,7 @@ export function promoteCandidate(
 		};
 
 		// Compute coherence (empty ledger = no matches)
-		const coherenceMark = computeCoherence(
-			entryWithoutCoherence as RolloutEntry,
-			ledger,
-		);
+		const coherenceMark = computeCoherence(entryWithoutCoherence as RolloutEntry, ledger);
 
 		// Manual promotion always allows further promotion
 		coherenceMark.promotionAllowed = true;
@@ -330,10 +285,7 @@ export function promoteCandidate(
 		ledger.push(entry);
 
 		// Rewrite entire ledger atomically to preserve all entries
-		atomicWriteFile(
-			ledgerPath,
-			ledger.map((e) => JSON.stringify(e)).join("\n") + "\n",
-		);
+		atomicWriteFile(ledgerPath, ledger.map((e) => JSON.stringify(e)).join("\n") + "\n");
 	});
 
 	return entry!;
@@ -373,10 +325,7 @@ export function decayCandidate(runId: string, candidate: string): RolloutEntry {
 		};
 
 		// Compute coherence (empty ledger = no matches)
-		const coherenceMark = computeCoherence(
-			entryWithoutCoherence as RolloutEntry,
-			ledger,
-		);
+		const coherenceMark = computeCoherence(entryWithoutCoherence as RolloutEntry, ledger);
 
 		// Manual decay never allows promotion
 		coherenceMark.promotionAllowed = false;
@@ -389,10 +338,7 @@ export function decayCandidate(runId: string, candidate: string): RolloutEntry {
 		ledger.push(entry);
 
 		// Rewrite entire ledger to preserve all entries
-		atomicWriteFile(
-			ledgerPath,
-			ledger.map((e) => JSON.stringify(e)).join("\n") + "\n",
-		);
+		atomicWriteFile(ledgerPath, ledger.map((e) => JSON.stringify(e)).join("\n") + "\n");
 	});
 
 	return entry!;