What the trust account must always satisfy

TRUST_ACCOUNT == Σ ESCROW_HELD + Σ USER_AVAILABLE

Checked after every state transition, so drift is caught by the request that caused it rather than by a nightly job that finds it a day late.