With synchronous = NORMAL in WAL mode, SQLite stays consistent through a power cut, but the last few commits can roll back. That recreates your case of a file already on disk with no completed status, so the fingerprint check carries more of the safety than the pragma. Our crash tests kill the worker between the file write and the ledger commit, then check that replay spots the changed file instead of writing it twice.