[bokelley]

This is a follow-up to #1857, and it needs to land before 0.1.0b5 is published (#1834).

#1857 made 0.1.x refuse a ledger whose reporting_configurations has an offering_id column. The rolling-safe upgrade being built on next for #1856 adds that column in an expand step. It keeps the four-column generation key, under its original name, until the operator runs the contract step. 0.1.x writes exactly those keys, and the #1856 work verified that 0.1.0b5 otherwise runs on the expand state unchanged, worker turns included. With the column check, though, a 0.1.0b5 pod would refuse to restart in the middle of a rollout.

Change: require_owned_schema_or_empty now refuses only when the configuration primary key includes offering_id, i.e. once the ledger is contracted (or was widened by 0.2.0b1/b2). That's the same test the packaged SQL's key check already makes. The 42P10 write mapping is unchanged: on the expand state, 0.1.x writes succeed, so it never fires there.

Test: test_an_expanded_ledger_that_is_not_yet_contracted_still_runs_this_release applies the ledger-core part of next's expand state (the column, a 5-column unique key, the CHECK (offering_id = '') constraints and the 7-column obligation index). It then restarts create_schema(), runs put_configuration, and runs commit_obligation. The test fails under #1857's column check with ReportingSchemaAheadError and passes here. The four existing refusal tests still pass, so a contracted ledger is still refused. make lint passes.

Refs #1856

🤖 Generated with Claude Code

[aao-secretariat]

Ladon verdict: Approve

Approve — clean, scoped fix with no blocking findings.

This PR narrows the contract-2 refusal in require_owned_schema_or_empty from "offering_id column exists" to "offering_id is in the primary key" (migration.py:14-17), aligning the Python guard with the packaged SQL key check. The reviewer verified: _WIDEN places offering_id in the pkey so the four prior refusal tests still refuse, and the new _EXPAND keeps the four-column PK plus the 6-column reporting_obligations_period_key index, so put_configuration and commit_obligation still resolve on the expand state — exactly what the new test asserts. Non-breaking, scoped to the adcp-reporting-storage package, and the change ships with a matching conformance test.

Gate check: gated_paths is false, high_risk is false, no no-auto-approve team match, and no critical/high/medium findings. None of decision-table rows 1–8 fire, so this falls through to row 9 (approve). Note review_decision is REVIEW_REQUIRED, but with gated_paths=false that does not gate approval.