validate

The integrity faults derivable from this merged state, in one canonical order (identical on every replica). This is an eventually-consistent diagnostic, not a safety gate — safety is the local holdings check in the mutators. On a fully-delivered state the report is exact; the per-patch witness keeps the direct and single-hop-transfer cases honest under partial delivery, but a partially- delivered multi-hop transfer-funded charge may transiently list a false conflict that self-heals on anti-entropy. The checks:

• LedgerConflict.PerEdgeSafety — sum-wise `effLeafSpent + effRollupSpent + returned

  effIssued` on an edge's aggregate effective values (base ± relocation).

• LedgerConflict.PersistentNegativeHoldings — a (group, replica) with negative derived holdings: the real overspend net. Quarantined lineages (holdings 0) are excluded — they surface as LedgerConflict.RecordDivergence.

• LedgerConflict.RecordDivergence — two distinct records under one id.

• LedgerConflict.DualActiveInbound — a group with two or more Lifecycle.ACTIVE inbound generations (§5.2, §10.11). Its lineage is quarantined (holdings 0), so it is excluded from the negative-holdings check above — it surfaces here instead.

• LedgerConflict.ClosureViolation — a Lifecycle.RETIRED edge with non-zero outstanding entitlement: a late delegation crossed a generation the cluster had already retired (closure dominance, §10.10).

• LedgerConflict.LineageCycle — a group whose live inbound edges loop back to it instead of reaching a root (§5.2, §10.11). Reported once per loop member, never for a mere descendant; records are grow-only, so a loop seen on any state is real.

• LedgerConflict.ConservationViolation — the global backstop: Σ effLeafSpent > mintedTotal, i.e. more service charged than supply ever minted (§10.1). Exact on a converged state; it never fires alone on honest partially- delivered traffic (a state missing a charge's root mint already strands a LedgerConflict.PersistentNegativeHoldings at the delegator). Its value is that it is derived from the raw totals, so it still catches manufactured authority when the per-lineage derivation of holdings is itself the thing that regressed.

• LedgerConflict.OrphanedTransferPath — transfer rows the topology moved out from under (#2366): a PathKey no group's live lineage reads, whose rows a generation move did not carry across, still holding a non-zero balance for one of the parties. The one fault here that conservation is structurally blind to — Σ_r transferNet(k, r) = 0 on every key, so abandoning a whole key is sum-preserving — and that the negative-holdings check misses because the recipient lands on 0 rather than below it.

What is deliberately not reported: a group whose only inbound edges are all prepared/retired is quarantined (holdings 0) but silent — that is the normal window of an honest reshape, and flagging it would fire on healthy traffic. It is the standing exception to §10.11's quarantine ⟺ report correspondence (see lineageEdges).