Ledger errors should name the invariant they protect

A payout worker catches an exception from the ledger and has to decide, with no human in the loop,...