feat(reconciliation): add evidence-derived run lifecycle command

.github/workflows/ci.yml

@@ -23,7 +23,7 @@ concurrency:
 jobs:
   exact-head-sast:
     name: Exact-head SAST
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     permissions:
       contents: read
@@ -60,7 +60,7 @@ jobs:
 
   exact-head-security:
     name: Exact-head security
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 15
     permissions:
       contents: read
@@ -103,7 +103,7 @@ jobs:
   exact-head-dependency-diff:
     name: Exact-head dependency diff
     if: github.event_name == 'pull_request'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     permissions:
       contents: read
@@ -174,7 +174,7 @@ jobs:
 
   accounting-foundation:
     name: Accounting foundation
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 20
     permissions:
       contents: read
@@ -354,7 +354,7 @@ jobs:
     name: Integrated-head attestations
     if: github.event_name == 'push'
     needs: accounting-foundation
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     permissions:
       contents: read

README.md

@@ -121,7 +121,7 @@ factory/runner and provide the tenant-bound host boundary explicitly.
 `unittest` discovery also runs `tests/test_postgres_posting.py`, which needs a
 reachable PostgreSQL 18 instance and `ACCOUNTING_DATABASE_URL` (CI uses
 `postgresql://postgres:postgres@127.0.0.1:5432/accounting_test` and applies
-the checked-in migration chain through `database/migrations/0020_reconciliation_run_completion_evidence.sql`). Persistence is still
+the checked-in migration chain through `database/migrations/0021_reconciliation_run_database_snapshot_authority.sql`). Persistence is still
 local to this repository; it is not a Naruon or sibling checkout.
 
 Optional import smoke after the editable install above:

database/migrations/0016_reconciliation_approval_evidence.sql

@@ -462,6 +462,22 @@ BEGIN
         END IF;
     END IF;
 
+    -- Superseded is a historical overlay on an already reviewed decision, not
+    -- an alternate terminal state that can skip decision evidence. New matches
+    -- and proposed matches therefore cannot jump directly to superseded.
+    IF NEW.match_status_code = 'superseded' THEN
+        IF TG_OP <> 'UPDATE' THEN
+            RAISE EXCEPTION
+                'reconciliation match may be superseded only from approved or rejected reviewed evidence (reconciliation_supersede_requires_reviewed_decision)'
+                USING ERRCODE = '23514';
+        END IF;
+        IF OLD.match_status_code NOT IN ('approved', 'rejected', 'superseded') THEN
+            RAISE EXCEPTION
+                'reconciliation match may be superseded only from approved or rejected reviewed evidence (reconciliation_supersede_requires_reviewed_decision)'
+                USING ERRCODE = '23514';
+        END IF;
+    END IF;
+
     IF TG_OP = 'UPDATE'
        AND OLD.match_status_code IN ('approved', 'rejected', 'superseded') THEN
         IF NEW.approved_at IS DISTINCT FROM OLD.approved_at THEN

database/migrations/0017_reconciliation_approval_lock_order.sql

@@ -544,6 +544,22 @@ BEGIN
         END IF;
     END IF;
 
+    -- Superseded is a historical overlay on an already reviewed decision, not
+    -- an alternate terminal state that can skip decision evidence. New matches
+    -- and proposed matches therefore cannot jump directly to superseded.
+    IF NEW.match_status_code = 'superseded' THEN
+        IF TG_OP <> 'UPDATE' THEN
+            RAISE EXCEPTION
+                'reconciliation match may be superseded only from approved or rejected reviewed evidence (reconciliation_supersede_requires_reviewed_decision)'
+                USING ERRCODE = '23514';
+        END IF;
+        IF OLD.match_status_code NOT IN ('approved', 'rejected', 'superseded') THEN
+            RAISE EXCEPTION
+                'reconciliation match may be superseded only from approved or rejected reviewed evidence (reconciliation_supersede_requires_reviewed_decision)'
+                USING ERRCODE = '23514';
+        END IF;
+    END IF;
+
     IF TG_OP = 'UPDATE'
        AND OLD.match_status_code IN ('approved', 'rejected', 'superseded') THEN
         IF NEW.approved_at IS DISTINCT FROM OLD.approved_at THEN