message: Document ledger invariants
diff: @@ -86,3 +86,18 @@ A low value for ``ledger.chunk_size`` means that smaller ledger files are genera
  Similarly, a low value for ``snapshots.tx_count`` means that snapshots are generated often and that join/recovery time will be short, at the cost of additional workload on the primary node for snapshot generation.
  .. tip:: Uncommitted ledger files (which are likely to contain committed transactions) can also be used on join/recovery, as long as they are copied to the node's ``ledger.directory`` directory.
  +
  +Invariants
  +----------
  +
  +1. To facilitate audit and verification of the integrity of the ledger, individual ledger files always end on a signature transaction.
  +
  +2. For operator convenience, all committed ledger files (``.committed`` suffix) are the same on all up-to-date nodes. More precisely, among up-to-date nodes:
  +
  +- Committed ledger files start and end at the same ``seqno``.
  +- Committed ledger files with the same name are byte-identical.
  +
  +3. Snapshots are always generated for the ``seqno`` of a signature transaction (but not all signature transactions trigger the generation of snapshot).
  +
  +4. The generation of a snapshot triggers the creation of a new ledger file. This is a corollary of 2. and 3., since new nodes should be able to join from a snapshot only and generate further ledger files that are the same as on the other nodes.
  +
  