diff --git a/dev/ledger.md b/dev/ledger.md
index 32460ad..5e227cb 100644
--- a/dev/ledger.md
+++ b/dev/ledger.md
@@ -342,6 +342,12 @@ transaction contains the following fields:
  - The first round $r_1$ and last round $r_2$ for which the transaction may be
    executed.
 
+ - The _lease_ $x$, which is an optional 256-bit integer specifying mutual
+   exclusion.  If $x \neq 0$ (i.e., $x$ is set) and this transaction is
+   confirmed, then this transaction prevents another transaction from the same
+   sender and with the lock set to the same value from being confirmed until
+   $r_2$ is confirmed.
+
  - The _genesis identifier_ $\GenesisID$ of the ledger for which this
    transaction is valid.  The $\GenesisID$ is optional.
 
@@ -534,7 +540,7 @@ block to be valid, each transaction in its transaction sequence must be valid at
 the block's round $r$ and for the block's genesis identifier $\GenesisID_B$.
 
 For a transaction
-$$\Tx = (\GenesisID, \TxType, r_1, r_2, I, I', I_0, f, a, N, \pk, \nonpart)$$
+$$\Tx = (\GenesisID, \TxType, r_1, r_2, I, I', I_0, f, a, x, N, \pk, \nonpart)$$
 to be valid at the intermediate state $\rho$ in round $r$ for the genesis
 identifier $\GenesisID_B$, the following conditions must all hold:
 
@@ -550,6 +556,9 @@ identifier $\GenesisID_B$, the following conditions must all hold:
  - Exactly one of the signature or the multisignature is present and verifies
    for $\Hash(\Tx)$ under $I$.
  - $\Hash(\Tx) \notin \TxTail_r$.
+ - If $x \neq 0$, there exists no $\Tx' \in TxTail$ with sender $I'$, lock value
+   $x'$, and last valid round $r_2'$ such that $I' = I$, $x' = x$, and
+   $r_2' >= r$.
  - If $\TxType$ is "pay",
     - $I \neq I_k$ or both $I' \neq I_{pool}$ and $I_0 \neq 0$.
     - $\Stake(r+1, I) - f > a$ if $I' \neq I$ and $I' \neq 0$.