Abandon a transaction only on proof, and keep watching failed rows (B-78, TX-15, TX-17, TX-23, TX-26, ELC-28, DAT-33, DAT-36, DAT-69, DAT-72, AUD-11, AUD-12, AUD-31, AUD-39, API-32)

reconcile_once abandoned a row when the *active* server's history lacked its txid:
after 120s for `building` (which a restart onto a different server makes likely),
after 6h for `pending`, and all at once after a forward clock jump. It re-checked the
status but not the txid, so it raced the bumper, and a `failed` row was never looked at
again.

- The reconciler asks every server (ElectrumListener.get_histories, active + others) for
  the history of the row's address and looks for every txid of the row. Present on any
  server -> promoted (adopting the version found). Absent is only "no server of the
  quorum knows it" and needs the active server plus the quorum minimum of the others to
  have answered; even then nothing is released without proof:
  (a) an input spent in a block by a transaction that is none of the row's versions,
      agreed by a strict majority of a quorum of the other servers (confirmed_spender), or
  (b) a rebroadcast of the latest raw tx to every server (rebroadcast_everywhere)
      refused by all of them, explicitly, for missing/spent inputs.
  Accepted or "already known" by any server means alive; a fee refusal is not proof
  (`building` -> `pending` for the bumper, `pending` untouched); too few answers or
  anything else leaves the row alone. failure_reason names the proof.
- The write re-reads status *and* current_txid under begin_immediate (TX-26).
- pending_transactions.failed_at (set by _abandon and _release_failed_withdrawal) starts
  a 14-day watch: a failed row that a majority of the other servers (at least the quorum
  minimum) list in a block becomes `confirmed`, writes pending_tx_resurrected once and
  pauses the lottery with paused_reason `resurrected_tx`; linked rows are not corrected.
  The confirmation is by quorum of histories for now; merkle proofs come with B-83.
- round_config.paused_reason (migration b7d2e41c9a05, with the failed_at one): `operator`
  from POST /admin/pause (which accepts an optional `note` and never overwrites an
  automatic reason), cleared by resume, which logs the reason it lifted; exposed on
  /admin/config and GET /rounds/current. rounds/pause.py:pause_automatically is the
  system's way in.
- PendingTransactionReconciler takes the listener as `network`; with none it can promote
  but never abandon.

Tests changed because the spec changed: the three reconciler tests that expect an
abandonment (and the one in test_tx_versions) now supply a network that proves the
transaction is gone.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

app/db/models.py

@@ -155,6 +155,12 @@ class RoundConfig(Base):
     # completion (closes, draws, pays out the winner) but no new round is opened
     # afterwards — see rounds/service.py:open_new_round_if_needed.
     paused: Mapped[bool] = mapped_column(default=False)
+    # B-78 (DAT-69): why the lottery is paused — NULL exactly when `paused` is false.
+    # "operator" (POST /admin/pause) or an automatic reason the system wrote itself
+    # ("resurrected_tx" so far; "reorg" and "payout_blocked" belong to B-85 and B-82).
+    # An automatic reason is never overwritten by an operator pause, so the cause that
+    # needs a look is not lost; POST /admin/resume clears whichever it is.
+    paused_reason: Mapped[str | None] = mapped_column(String(16), default=None)
     updated_at: Mapped[datetime] = mapped_column(default=utcnow, onupdate=utcnow)
 
 
@@ -197,6 +203,9 @@ class PendingTransaction(Base):
     attempt_count: Mapped[int] = mapped_column(default=1)
     # Why the reconciler gave up on this tx — operator-facing, only set on "failed".
     failure_reason: Mapped[str | None] = mapped_column(String(128), default=None)
+    # B-78 (DAT-72): when the row went to "failed". A failed row stays watched for
+    # FAILED_WATCH_DAYS from here: a transaction given up for dead can still confirm.
+    failed_at: Mapped[datetime | None] = mapped_column(default=None)
     updated_at: Mapped[datetime] = mapped_column(default=utcnow, onupdate=utcnow)