Architecture / The ledger / Over-issuance refused

Over-issuance refused.

Value that cannot be backed is not discouraged — it is rejected at the protocol layer, before it can enter circulation. The invariant is enforced, not reconciled after the fact.

Issued value can never exceed authorized backing

Conservation of value is a protocol rule checked on every issuance.

Supply within backing

Every issuance must reference authorized backing sufficient to cover it. An instruction that would push circulating supply beyond backing is invalid and never commits.

Refused, not flagged

The constraint is evaluated inside the issuance path, so an over-issuing transaction fails validation — rather than succeeding and being caught by later reconciliation.

No override path

There is no operator flag or emergency mode that mints unbacked value. The invariant holds for every actor, including the issuer's own operators.

Only a signed mandate can create new value

Issuance authority is cryptographic, scoped, and revocable.

Mandate required

Each mint carries an ML-DSA-65 signature from the holder of central-bank issuance authority. An unsigned or wrongly-signed instruction is rejected before any balance changes.

Bounded authority

Issuance authority can be limited by amount, purpose, or validity window, so a compromised or misused key cannot mint beyond the terms it was granted.

Sovereign control

The issuing keys remain in the central bank's custody, not the operator's. Sovex builds the engine but cannot itself create currency.

Every unit is conserved across the full lifecycle

Mint, transfer, and redeem all preserve the same accounting identity.

Nothing appears freely

Transfers move value between balances without changing total supply. Units are created only at authorized issuance and destroyed only at authorized redemption.

Symmetric retirement

Redeeming or retiring value reduces circulating supply by exactly the amount removed, keeping the supply figure a true count rather than a cumulative one.

Continuously provable

Circulating supply is derivable from the hash-chained ledger and can be checked against declared backing at any height, making the peg auditable rather than asserted.

The rule is enforced deterministically on every node

Refusal is not a matter of policy configuration but of protocol validation.

Same verdict everywhere

The over-issuance check is deterministic, so every validating party independently reaches the same accept-or-reject decision on an issuance instruction.

No partial mint

Issuance either commits fully within the hash-chained ledger or not at all. There is no state where value exists without corresponding authorized backing recorded.

Never spendable

A refused issuance produces no spendable balance, so unbacked value never becomes transferable — not even momentarily.

The refusal itself is part of the record

Both what was issued and what was rejected are provable after the fact.

Issuance provenance

Each unit in circulation traces to a specific signed issuance event in the ledger, so supply can be attributed to authorization rather than estimated.

Declared and pinned

The backing an issuance relied on is recorded alongside it, giving auditors a fixed reference point rather than a moving off-ledger figure.

Owner-verifiable peg

Because owners hold verification keys and ledger copies, the state can confirm supply-versus-backing without trusting the operator's reporting.