# Ledger invariants

`Ledger.apply(operation_id, account, delta)` applies an operation at most once globally.

- A successful operation permanently consumes its operation ID.
- A rejected overdraft must not consume its operation ID.
- A caller may fund the account and retry the same rejected operation.
- Balances may never become negative.
- Duplicate successful operations return the current balance without applying the delta again.

The current implementation violates the rejected-operation rule.