nx_ledger_lib.nx

nx_ledger_lib.nx -- F981: THE SOVEREIGN DOUBLE-ENTRY LEDGER (the first byte of Nishi finance). Two entities (accounts, transfers) and ONE invariant: every transfer DEBITS one account and CREDITS another by the same amount, so sum(debits) == sum(credits) ALWAYS. Money cannot be created or destroyed -- not by promise, BY CONSTRUCTION, and the gate proves it. Money = integer MINOR UNITS (cents). No float anywhere -- a float ledger drifts cent-by-cent and an auditor cannot reproduce it. Append-only on the immutable CID plane (rule 13, history sacred): nothing is ever mutated or deleted; a reversal is a NEW opposing transfer, a two-phase resolution is a NEW record. That is exactly what regulators and bar audits want. TWO-PHASE (pending -> post|void): a pending transfer reserves funds without moving them. It counts toward an account's RESERVED total and reduces AVAILABLE, but never touches the posted balance until a resolution record posts it. Resolutions are keyed by the transfer id = O(1) lookup, not a second scan. LINKED CHAINS: led_chain validates EVERY leg BEFORE committing ANY (validate-then-commit, rule 12) so a refused chain leaves ZERO partial state -- no half-moved money. BALANCE CONVENTION: led_balance = credits - debits (custodial/liability sense: a deposit CREDITS the holder, matching nx_trust). An ASSET account reads the negation; led_debits/led_credits are exposed raw so a caller can apply either convention explicitly. SCALE ENVELOPE (declared, never silent): led_sums scans the whole transfer index each call -- O(transfers) per query, index buffer LED_IDXCAP. A per-account index is the next rung. DRY: reuses nx_matter_lib helpers (mt_catcopy/mt_catn/mt_field/mt_streq, canon_encode, reg_*). license_tier: ORIGINAL No hw writes (Rule 26). LIB (no main).