feat(ledger): double-entry, where a stored balance cannot exist

[isaacismaelx14]

Phase 7A. 06 calls ledger-first "the single most consequential engineering decision in the system, and the one most likely to be compromised for convenience", so the shortcuts it warns about are made unavailable rather than discouraged.

• No balance column, so a balance cannot be stored.
• No method that writes a single entry, so nothing can post one side of a movement.
• No update, no delete, so history cannot be repaired in place.

What remains is post, which writes a balanced transaction or writes nothing.

Law XXI is the part to read closely

An implementation that can produce a negative balance can mint currency.

Every account a movement touches is checked after the entries are written and inside the same database transaction, with those accounts SELECT ... FOR UPDATE locked first.

Without the lock, two concurrent debits can each read a sufficient balance, each pass the check, and together overdraw. There is a test that fires both at once and asserts exactly one survives.

Precision

bigint end to end. Summed in Postgres, cast to text, widened to BigInt. A SUM over bigint arriving as a JavaScript number would be the floating point error 06 forbids, entering through the one place nobody looks.

A value past MAX_SAFE_INTEGER round-trips exactly, and twenty small movements conserve to the subunit.

Three things the domain caught that I had wrong

The tests found all three, which is the domain validator from Phase 0 doing its job:

1. An entry must carry its transaction's idempotency key, so one half of a movement cannot be deduplicated apart from the other.
2. An entry must carry its transaction's type, so a distribution cannot contain an entry that reads as a transfer.
3. Kredbits cannot hold a negative value. That is why the overdraft check reads an unbranded bigint: the type cannot express the thing being detected, and branding first raises a range error instead of reporting the overdraft.

A finding, not a gap

post cannot create the opening supply. A transaction must sum to zero, and creating money is precisely the movement that does not. Genesis belongs to the Central Bank, which is Phase 8. The tests seed an opening balance directly and say so in a comment.

Verification

Against a real Postgres, stable across three runs. Verified by mutation: removing the Law XXI check fails three tests, including the concurrent overdraft.

374 tests. Format, lint, typecheck and build clean.

Not in this PR

Phase 7B is the Official global ledger and lives in kreds-network. The roadmap is explicit that it must implement its own accounting domain rather than importing this AGPL package: same principles, separate boundary.