From 7a15a5d70004b28bf2a710fa0f536af2446e5b17 Mon Sep 17 00:00:00 2001
From: historia <[not public]>
Date: Mon, 5 Oct 2026 17:49:48 -0400
Subject: fix: production multi-step recipes, drop-weight validation, journal
 versioning

---
 internal/persistence/txn_test.go | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

(limited to 'internal/persistence/txn_test.go')

diff --git a/internal/persistence/txn_test.go b/internal/persistence/txn_test.go
index be19c7c..e1cd05d 100644
--- a/internal/persistence/txn_test.go
+++ b/internal/persistence/txn_test.go
@@ -280,3 +280,23 @@ func TestRecoverKeepsJournalWithUnknownOpKind(t *testing.T) {
 		t.Fatalf("journal with unknown kind was removed: %v", err)
 	}
 }
+
+// Regression: a journal written by a newer version must be refused, not
+// silently misread or deleted.
+func TestRecoverRefusesUnknownJournalVersion(t *testing.T) {
+	dir := t.TempDir()
+	journalDir := filepath.Join(dir, ".journal")
+	if err := os.MkdirAll(journalDir, 0700); err != nil {
+		t.Fatal(err)
+	}
+	path := filepath.Join(journalDir, "txn-future.json")
+	if err := os.WriteFile(path, []byte(`{"version":99,"ops":[]}`), 0600); err != nil {
+		t.Fatal(err)
+	}
+	if err := Recover(journalDir); err == nil {
+		t.Fatal("Recover accepted an unknown journal version")
+	}
+	if _, err := os.Stat(path); err != nil {
+		t.Fatalf("journal with an unknown version was removed: %v", err)
+	}
+}
-- 
cgit v1.2.3