digest check for inserted blob entry p

app/models/blob_entry_p.rb

@@ -12,6 +12,11 @@ class BlobEntryP < ReduxApplicationRecord
     foreign_key: :base_sha256,
     class_name: "::BlobEntryP"
 
+  after_create do
+    actual_sha256 = Digest::SHA256.digest(contents)
+    raise("digest mismatch for BlobEntryP") if sha256 != actual_sha256
+  end
+
   def base
     @base_model ||= super || self.class.ensure(base_sha256) if base_sha256
   end
@@ -27,7 +32,7 @@ class BlobEntryP < ReduxApplicationRecord
 
   def self.ensure(sha256)
     find_by(sha256: sha256) || begin
-      be = BlobEntry.find_by(sha256) || raise("not found: #{HexUtil.bin2hex(sha256)}")
+      be = BlobEntry.find_by(sha256: sha256) || raise("not found: #{HexUtil.bin2hex(sha256)}")
       create!([
         :sha256,
         :base_sha256,