row_write.py depends on private members of PgReportingLedgerStore #1488

Problem

row_write.py is a separate module, but it works by reading four private attributes of the store and one module-private name from pg.py. pg.py in turn imports row_write lazily inside three methods to avoid the cycle. Neither module can change its private layout without the other, and the type checker does not see the contract between them. #1464 had this logic inside PgReportingLedgerStore; #1467 moved it out and added the reach-ins.

Evidence

All references are to main at 47084e83a, src/adcp/reporting/ledger/row_write.py unless stated.

• store._row_storage: lines 97, 153, 235, and 310.

• store._connection(): line 160.

• store._pool: lines 190, 196, 206, and 238.

• store._lock_account: line 239.

• Module-private import, line 151, inside stage_revision_rows:

  from adcp.reporting.ledger.pg import _BOUND_CONNECTION

  used at line 189: bound = _BOUND_CONNECTION.get().

• src/adcp/reporting/ledger/pg.py:1280, :1345, and :1369: lazy from adcp.reporting.ledger.row_write import ... inside commit_revision, the inline-row migration path, and stage_revision_rows.

Suggested fix

Either of the following removes the reach-ins:

• Move prepare_revision_row_set, stage_revision_rows, _open_intent, and persist_revision_row_set back into PgReportingLedgerStore (they are only called from there).
• Define a small Protocol that the store implements and row_write accepts: row_storage, connection(), pool, lock_account(), and is_bound_to(pool). Then row_write takes the protocol, pg.py imports row_write at module level, and _BOUND_CONNECTION stays private to pg.py.

Introduced in #1467.