Abandon a transaction only on proof, and keep watching failed rows (B-78, TX-15, TX-17, TX-23, TX-26, ELC-28, DAT-33, DAT-36, DAT-69, DAT-72, AUD-11, AUD-12, AUD-31, AUD-39, API-32)

reconcile_once abandoned a row when the *active* server's history lacked its txid:
after 120s for `building` (which a restart onto a different server makes likely),
after 6h for `pending`, and all at once after a forward clock jump. It re-checked the
status but not the txid, so it raced the bumper, and a `failed` row was never looked at
again.

- The reconciler asks every server (ElectrumListener.get_histories, active + others) for
  the history of the row's address and looks for every txid of the row. Present on any
  server -> promoted (adopting the version found). Absent is only "no server of the
  quorum knows it" and needs the active server plus the quorum minimum of the others to
  have answered; even then nothing is released without proof:
  (a) an input spent in a block by a transaction that is none of the row's versions,
      agreed by a strict majority of a quorum of the other servers (confirmed_spender), or
  (b) a rebroadcast of the latest raw tx to every server (rebroadcast_everywhere)
      refused by all of them, explicitly, for missing/spent inputs.
  Accepted or "already known" by any server means alive; a fee refusal is not proof
  (`building` -> `pending` for the bumper, `pending` untouched); too few answers or
  anything else leaves the row alone. failure_reason names the proof.
- The write re-reads status *and* current_txid under begin_immediate (TX-26).
- pending_transactions.failed_at (set by _abandon and _release_failed_withdrawal) starts
  a 14-day watch: a failed row that a majority of the other servers (at least the quorum
  minimum) list in a block becomes `confirmed`, writes pending_tx_resurrected once and
  pauses the lottery with paused_reason `resurrected_tx`; linked rows are not corrected.
  The confirmation is by quorum of histories for now; merkle proofs come with B-83.
- round_config.paused_reason (migration b7d2e41c9a05, with the failed_at one): `operator`
  from POST /admin/pause (which accepts an optional `note` and never overwrites an
  automatic reason), cleared by resume, which logs the reason it lifted; exposed on
  /admin/config and GET /rounds/current. rounds/pause.py:pause_automatically is the
  system's way in.
- PendingTransactionReconciler takes the listener as `network`; with none it can promote
  but never abandon.

Tests changed because the spec changed: the three reconciler tests that expect an
abandonment (and the one in test_tx_versions) now supply a network that proves the
transaction is gone.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

docs/audit-log.md

@@ -213,9 +213,11 @@ flowchart LR
   `app/electrum/listener.py:ElectrumListener._apply_header`,
   `app/rounds/scheduler.py:RoundScheduler._trigger_payout`,
   `app/tx/reconcile.py:reconcile_once` ·
-  *Test:* nessun test verifica la riga di audit.
-  *Stato:* da implementare (B-78, B-82, B-85, B-90) · *Oggi:* scritto solo
-  da `POST /admin/pause`, con payload vuoto `{}`.
+  *Test:* `tests/unit/test_pause_reason.py`
+  *Stato:* da implementare (B-82, B-85, B-90) · *Oggi:* scritto da
+  `POST /admin/pause` (`operator`) e dal riconciliatore (`resurrected_tx`);
+  `reorg`, `payout_blocked` e l'avvio con `START_PAUSED` non lo scrivono
+  ancora.
 
 - **[AUD-12]** `lottery_resumed` — `POST /admin/resume`. Payload
   `{"reason"}`: il `paused_reason` che la ripresa ha tolto (`null` se la
@@ -225,8 +227,9 @@ flowchart LR
   `paused = false`, `paused_reason = NULL` e dell'azzeramento di
   `payout_blocked_at`.
   *Codice:* `app/api/routes/admin.py:resume_lottery` ·
-  *Test:* nessun test verifica la riga di audit.
-  *Stato:* da implementare (B-78, B-82, B-85) · *Oggi:* payload vuoto `{}`.
+  *Test:* `tests/unit/test_pause_reason.py`
+  *Stato:* da implementare (B-82), per l'azzeramento di `payout_blocked_at` ·
+  *Oggi:* `rounds.payout_blocked_at` non esiste ancora.
 
 - **[AUD-13]** `admin_privkey_accessed` — `GET /admin/users/{id}/privkey` ha
   esportato la chiave privata (WIF) di un utente. Payload `{"user_id"}`.
@@ -582,10 +585,7 @@ flowchart LR
   montepremi non è tracciato in `utxo_events`). `user_id` e `round_id` come
   in [AUD-30]. Stessa transazione dell'abbandono.
   *Codice:* `app/tx/reconcile.py:_abandon` ·
-  *Test:* `tests/unit/test_reconcile.py`
-  *Stato:* da implementare (B-78) · *Oggi:* basta che la cronologia del
-  server attivo non contenga il txid corrente, e `reason` è sempre
-  `"not found on chain"`.
+  *Test:* `tests/unit/test_reconcile.py`, `tests/unit/test_reconcile_proof.py`
 
 - **[AUD-39]** `pending_tx_resurrected` — una riga `failed` da meno di 14
   giorni è risultata confermata: una transazione data per persa è arrivata in
@@ -599,9 +599,7 @@ flowchart LR
   passaggio a `confirmed`, della pausa e della riga `lottery_paused` con
   `reason = "resurrected_tx"` ([AUD-11]). Le righe collegate non vengono
   corrette: la procedura è in [operativita.md](operativita.md) (OPS-30).
-  *Codice:* `app/tx/reconcile.py:reconcile_once` · *Test:* —
-  *Stato:* da implementare (B-78) · *Oggi:* una riga `failed` non viene più
-  guardata e l'evento non esiste.
+  *Codice:* `app/tx/reconcile.py:_resurrect` · *Test:* `tests/unit/test_reconcile_proof.py`
 
 - **[AUD-40]** `rbf_bump_failed` — un aumento di commissione non è riuscito
   ([TX-24](transazioni-e-riconciliazione.md#rbf-accelerare-una-transazione-lenta)).