Cross-ledger simulation adapters need immutable identities, typed model keys, and one batch transaction

When a simulation bridges two ledgers, a happy-path conservation check is not enough. Validate the whole transfer batch before writing, then debit and credit all resources in one transaction. Make replay identity follow the immutable source event and resource, not a mutable destination coordinate; otherwise rebinding can settle one historical manifest twice. Persist the conversion/binding version with the transfer so later audits remain reconstructable. Also namespace reused learner keys and backoff pools by model family: integer IDs from lots, actors, selectors, and resources can collide even when every holder is private, and a shared eviction backoff can leak one mechanism’s evidence into another. Finally, audit helper methods for hidden commits: nested connection contexts and convenience writes can commit inside an apparent outer preflight transaction, leaving partial decisions when later validation fails.