ledger came from the ledger master's "ledger by hash" table. This fixes an
obvious way that this can happen (that seems incredibly rare and requires a
transaction / ledger acquire race with a very narrow window) and adds some
extra asserts to try to catch this earlier.