Abandon a transaction only on proof, and keep watching failed rows (B-78, TX-15, TX-17, TX-23, TX-26, ELC-28, DAT-33, DAT-36, DAT-69, DAT-72, AUD-11, AUD-12, AUD-31, AUD-39, API-32)

reconcile_once abandoned a row when the *active* server's history lacked its txid:
after 120s for `building` (which a restart onto a different server makes likely),
after 6h for `pending`, and all at once after a forward clock jump. It re-checked the
status but not the txid, so it raced the bumper, and a `failed` row was never looked at
again.

- The reconciler asks every server (ElectrumListener.get_histories, active + others) for
  the history of the row's address and looks for every txid of the row. Present on any
  server -> promoted (adopting the version found). Absent is only "no server of the
  quorum knows it" and needs the active server plus the quorum minimum of the others to
  have answered; even then nothing is released without proof:
  (a) an input spent in a block by a transaction that is none of the row's versions,
      agreed by a strict majority of a quorum of the other servers (confirmed_spender), or
  (b) a rebroadcast of the latest raw tx to every server (rebroadcast_everywhere)
      refused by all of them, explicitly, for missing/spent inputs.
  Accepted or "already known" by any server means alive; a fee refusal is not proof
  (`building` -> `pending` for the bumper, `pending` untouched); too few answers or
  anything else leaves the row alone. failure_reason names the proof.
- The write re-reads status *and* current_txid under begin_immediate (TX-26).
- pending_transactions.failed_at (set by _abandon and _release_failed_withdrawal) starts
  a 14-day watch: a failed row that a majority of the other servers (at least the quorum
  minimum) list in a block becomes `confirmed`, writes pending_tx_resurrected once and
  pauses the lottery with paused_reason `resurrected_tx`; linked rows are not corrected.
  The confirmation is by quorum of histories for now; merkle proofs come with B-83.
- round_config.paused_reason (migration b7d2e41c9a05, with the failed_at one): `operator`
  from POST /admin/pause (which accepts an optional `note` and never overwrites an
  automatic reason), cleared by resume, which logs the reason it lifted; exposed on
  /admin/config and GET /rounds/current. rounds/pause.py:pause_automatically is the
  system's way in.
- PendingTransactionReconciler takes the listener as `network`; with none it can promote
  but never abandon.

Tests changed because the spec changed: the three reconciler tests that expect an
abandonment (and the one in test_tx_versions) now supply a network that proves the
transaction is gone.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

tests/unit/test_migrations.py

@@ -124,3 +124,39 @@ def test_existing_pending_transactions_are_backfilled_with_the_txids_they_rememb
     assert rows == [(1, "bb", ""), (1, "cc", "rawcc"), (2, "dd", "rawdd")]
     assert _index_sql(db_path, "ix_rounds_single_active") is not None
     assert _index_sql(db_path, "ix_users_username_lower") is not None
+
+
+def test_failed_at_and_paused_reason_are_backfilled_for_existing_rows(tmp_path):
+    """B-78 (DAT-36, DAT-69, DAT-72): rows that are already failed start their 14-day
+    watch from their last update, and an instance that is already paused was paused by its
+    operator; the expression indexes survive the add_column steps."""
+    db_path = tmp_path / "old.db"
+    _alembic(db_path, "upgrade", "a3f5c2d9b7e1")
+    with sqlite3.connect(db_path) as conn:
+        columns = (
+            "(kind, current_txid, fee_rate_sat_vb, raw_tx_hex, broadcast_at, last_broadcast_at, status, "
+            "attempt_count, updated_at)"
+        )
+        conn.execute(
+            f"INSERT INTO pending_transactions {columns} VALUES "
+            "('bet', 'aa', 1, 'raw', '2026-01-01 00:00:00', '2026-01-01 00:00:00', 'failed', 1, '2026-02-03 04:05:06')"
+        )
+        conn.execute(
+            f"INSERT INTO pending_transactions {columns} VALUES "
+            "('bet', 'bb', 1, 'raw', '2026-01-01 00:00:00', '2026-01-01 00:00:00', 'pending', 1, '2026-02-03 04:05:06')"
+        )
+        round_config = [r[1] for r in conn.execute("PRAGMA table_info(round_config)")]
+        assert "paused_reason" not in round_config
+        conn.execute(
+            "INSERT INTO round_config (fee_address, bet_amount_sats, round_duration_seconds, round_cooldown_seconds, "
+            "fee_rate_sat_vb, rbf_timeout_seconds, draw_animation_seconds, paused, updated_at) "
+            "VALUES ('', 1000000000, 600, 30, 1, 900, 20, 1, '2026-01-01 00:00:00')"
+        )
+    _alembic(db_path, "upgrade", "head")
+    with sqlite3.connect(db_path) as conn:
+        failed_at = dict(conn.execute("SELECT current_txid, failed_at FROM pending_transactions"))
+        reason = conn.execute("SELECT paused_reason FROM round_config").fetchone()[0]
+    assert failed_at == {"aa": "2026-02-03 04:05:06", "bb": None}
+    assert reason == "operator"
+    assert _index_sql(db_path, "ix_rounds_single_active") is not None
+    assert _index_sql(db_path, "ix_users_username_lower") is not None