[LIghtJUNction]

Refs #65. This change fixes the code-level migration omission and adds actual old-version backup evidence. It does not deploy or claim acceptance of production data.

Fix

Split the LedgerAccount migration into stages on the existing PostgreSQL transaction/advisory lock. Inspect explicit typed JSON references alongside direct columns, refusing to retire an escrow identity still referenced as resource owner/author, Event actor, certificate subject/scope, or another authoritative identity. Unknown body-bearing tables fail closed. Ordinary historical names, Event.data, change notes and financial account references are not treated as authorization. No ledger row, sequence or signed receipt is rewritten.

Verification

Five focused regressions reproduced the JSON-reference omission before the fix. The final local Python 3.15/real PostgreSQL suite reports 28 passed, with no skips, covering:

• A database and v4 backup generated by actual pinned old code ac083b3666b1b5268d90115129e2cc4e0dd11521, not a current schema with simulated FKs. Critical source hashes are pinned and required in CI.
• Funded/settled/refunded orders, active/closed bounties, paid claims and consumed challenges. Every ledger field, exact receipt text, sequence, balances, supply, market records and retained history are compared.
• Repeat initialization and two concurrent real initializers; fault injection after account creation, FK switch, identity deletion and trigger installation; full transaction rollback and an unmodified retry.
• Active/unknown references, credential and certificate references; preserved append-only triggers and existing authenticated network-isolation tests.
• Restored write/worker gates remain closed.

The uploaded migration and PostgreSQL blobs match the tested local files. Compilation and diff checks pass. Full current-head CI must still pass before merge.

Remaining gate

The actual production inventory, protected stored backup, preflight and separately authorized migration/rollback exercise are not available in this run. #65 therefore remains open, with Refs rather than an automatic closing keyword. See docs/LEDGER_MIGRATION.md for the exact reference contract and reproduction procedure.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-27T16:13:01.794878Z	b0ef882	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[LIghtJUNction]

当前补丁自查，不冒充独立批准：已复核迁移阶段均使用原构造器事务和 schema advisory lock，无独立 commit；JSON 引用白名单与 schema 覆盖测试对应，普通历史数据不会作为身份授权；旧 ledger/receipt 字节、sequence 和 market/history 比对覆盖重复和并发初始化。真实旧代码 fixture 及其 source hashes 已进入 CI，原有 escrow 网络隔离测试未弱化。

当前 head 的完整 CI 36331960865 已成功，包含 Python 3.15/PostgreSQL/Valkey、核心测试、跨协议/tokenizer conformance 和构建。本地专项 28 项通过。只合并源码修复，不执行生产迁移；#65 的实际生产备份/preflight/迁移回滚证据仍须保留为未完成验收。