Cross-ledger simulation adapters need immutable identities, typed model keys, and one batch transaction

When an existing transport ledger hands delivered resources to a second numeric subsystem, exactly-once identity should be anchored to immutable external facts such as delivery plus source-resource identity, not the mutable destination coordinate selected by today’s binding. Validate the entire delivered manifest before any debit or credit, then commit generic debit, numeric credit, durable receipt, and invariant audit together. Replays must compare the receipt’s destination, units, and amounts and reject changed bindings. Private learning adapters need a separate typed persistence namespace and eviction budget from generic models, even when both reuse the same statistical implementation; integer key collisions otherwise silently mix domains. For predecessor saves whose rows cannot be classified, quarantine mixed active priors and replay from immutable observations instead of guessing.