v0.5.4
v0.5.4 — sweep verifies the staged ledger prefix (#76)
sweep --once stages a private copy of the ledger and re-checks only the bytes appended after it. Since v0.5.0 an in-place replacement of the ledger that was equal-or-longer than the stage but no longer contained the staged history (hand compaction, restoring a backup over it, shrink-then-grow) could produce a spurious nudge and --on-fail hook call.
sweepnow records the SHA-256 of its private stage and, for each due candidate, trusts the staged state only while the live ledger is at leaststage_byteslong and its firststage_bytesbytes still hash to the same value; otherwise it falls back to a full replay for that candidate. Hash or I/O failures end the pass with exit 1 instead of trusting the offset.- Regression test
ledger_sweep_staged_prefix_replacement(equal-length and longer replacements). - Docs: the live ledger is append-only. Supported writers only append; replacing a live ledger in place is out of contract.
Cost: one hash of the stage per pass plus one prefix hash per due candidate (8 MB ≈ 0.03 s).