PerEdgeSafety
An edge whose aggregate charged-plus-returned exceeds what was ever issued down it: leafSpent(e) + rollupSpent(e) + returned(e) > issued(e). Checked sum-wise on aggregate values, never per slot — a peer may legitimately return entitlement it received by transfer, so a per-slot returned > issued is fine; only the edge total crossing issued is a fault (design §4.6).