v0.5.0-beta — the durability release

The durability release. The ledger's state stops living only on the box that produced it, and the money path gets 24.5x faster on the way.

Highlights

• Money path 4.4k → 120k orders/s, and not saturated there. Egress moved off an inline per-session offer that parked the deterministic thread on a single back-pressured session — stopping the whole engine — to a queue drained in bulk off the critical path (#17), then to per-session filtering, which cut the bridge's share of the traffic to a fifth (#21).
• Snapshot bytes were a function of history, not of state. Accounts and holds were serialized in hash-table order, so a node replaying from genesis and a node resuming from a snapshot wrote different bytes for an identical ledger. Harmless to the ledger, fatal to verification: bundle replay is checked by comparing snapshots, so it would have raised divergence alarms for a ledger that had not diverged. One canonical ordering primitive fixes it; the format is unchanged (#36).
• Bundle capture — a snapshot plus the log behind it — with a retention watermark the purge honours, and archive housekeeping so a snapshot actually reclaims disk (#25, #26, #27, #28).
• A credit that would wrap a balance negative is rejected. Past Long.MAX a balance silently went negative: no log, no fault, and the conservation check still passed (#20).
• assets-loadgen, the money-path benchmark driver with no OMS in the loop, performing the hold gate exactly as the OMS does, with every latency measured on its own clock from the scheduled send time (#13, #16, #19, #22).
• The engine, the bridge and the load generator are published to the artifact store. The bridge had no published build at all before this (#34, #37).

Full detail in CHANGELOG.md.