nx_fin_ledger.nx

nx_fin_ledger.nx -- R2 of THE NISHI FINANCIAL ECOSYSTEM: the content-addressed, append-only, DOUBLE-ENTRY ledger. Net worth is a VIEW (folded from history), never a stored number. WHY THIS SHAPE: * NO-FLOAT: every amount is exact i64 minor units (cents); all arithmetic via nx_money (mny_add). * ADDITIVE-ONLY (#13): there is NO delete/update of a transaction. History is the truth. A correction is a new compensating transaction, never an edit. * CONTENT-ADDRESSED (self-proof of integrity): each transaction is canon-encoded -> a CID (nxc1-<sha256>); the CID is its storage key. Same content -> same id everywhere. * IDEMPOTENT (#10): re-posting the SAME (extid + content) is a no-op (same CID already present). `extid` is the caller's idempotency key so two GENUINELY distinct but identical-looking transactions stay distinct (different extid -> different CID). * NEVER-BRICK FINANCIAL ANALOG (#26): an UNBALANCED transaction (postings not netting to zero) is REJECTED BY CONSTRUCTION before anything is written -- a corrupt entry can never be recorded. SIGN CONVENTION (unified accounting-equation space): Every posting is a signed cents delta. A transaction is VALID iff the signed sum of its postings == 0 (debits == credits). Asset balances are positive (owned); liability balances are negative (owed). NET WORTH = sum of balances over accounts whose class is asset or liability (equity/income/expense are excluded -- they reconcile the books, they are not net worth). Proof the math is real: paying a liability from an asset (asset down, liability up toward zero) leaves net worth INVARIANT; spending on an expense (asset down, no asset/liability offset) lowers net worth. The R2 gate asserts exactly these. STORAGE: sovereign seg-store (nx_seg_store) under a path prefix (e.g. "knowledge/store/finled-"). key "fin:txnidx" -> newline-joined list of transaction CIDs (the append-only log index) key "fin:acctidx" -> newline-joined list of account names key <txn-CID> -> the canonical NXR1 transaction record key "acctclass:<name>" -> the account's class string (NUL-terminated) segid = sys_now_us(): microsecond ids are distinct across the fsync+rename gap between commits, so no two commits share a segment file (a ms-resolution id could collide in a tight loop and lose a record -- unacceptable for money). SCALING (#21): one segment per post is O(segments^2) at open; nx_seg_store ss_compact merges segments -- that is the later durability/scale rung. license_tier: ORIGINAL