feat: persist review workbench decisions (#1)

Merge dcy-012 / REQ-020 / BAT-016 implementation after green CI.

docs/batches/bat-016_20260708_review-decision-reconciliation-workbench/implementation.md

@@ -1,17 +1,52 @@
 # BAT-016 Implementation Log
 
 ## Status
-- Not started.
+- Implemented locally; release-candidate after verification.
+- Completed At (KST): 2026-07-08 07:11 KST
+- Branch: `feat/bat-016-review-decision-workbench`
 
 ## Implementation Owner
-- dev-builder / dev-impl under delivery-runner orchestration.
+- 가웨인 direct recovery path. User explicitly prohibited Kanban after prior worker failures.
 
-## Expected Evidence
-- Code diff summary by slice.
-- Migration and validation DB evidence.
-- MCP tool discovery and representative call evidence.
-- Streamlit AppTest/HTTP smoke evidence.
-- Full lint/test evidence.
+## Changed Files
+- `jarca_ledger_mcp/infrastructure/sqlite/schema.py`
+- `jarca_ledger_mcp/infrastructure/sqlite/migrations.py`
+- `jarca_ledger_mcp/application/review_decision_service.py`
+- `jarca_ledger_mcp/application/cross_transfer_service.py`
+- `jarca_ledger_mcp/application/reconciliation_service.py`
+- `jarca_ledger_mcp/application/uncategorized_workbench_service.py`
+- `jarca_ledger_mcp/application/system_services.py`
+- `jarca_ledger_mcp/service.py`
+- `jarca_ledger_mcp/adapters/mcp/tool_contracts.py`
+- `jarca_ledger_mcp/adapters/mcp/server.py`
+- `jarca_ledger_mcp/adapters/streamlit/transfers_gateway.py`
+- `jarca_ledger_mcp/adapters/streamlit/reconciliation_gateway.py`
+- `jarca_ledger_mcp/adapters/streamlit/categorization_gateway.py`
+- `dashboard/app.py`
+- `tests/test_review_decision_workbench.py`
+- `tests/test_service.py`
+- `tests/test_ledger_categories.py`
+- `docs/data-model.md`
+- `docs/project-structure.md`
+- `docs/runtime-flows.md`
 
-## Log
-- 2026-07-08 00:00 KST: Batch scaffolded by lead. No implementation performed yet.
+## Implementation Summary
+- Raised SQLite schema version to `11` and added additive/idempotent `review_decisions` and `reconciliation_sessions` schema objects.
+- Added `review_decision_service.py` for safe non-destructive review decision and reconciliation session operations.
+- Added payload minimization to prevent raw payload/password/token/secret/file-path persistence.
+- Added review/session state enrichment to cross-transfer queue, balance reconciliation report, and uncategorized workbench outputs.
+- Added MCP tools for list/upsert/hold/recheck/release review decisions, list/upsert/close reconciliation sessions, and review operating indicators.
+- Added Streamlit actions and gateway exports for review decision/session workflow state.
+- Added regression tests for schema idempotency, sensitive payload filtering, reconciliation session round trip, report integration, and MCP tool surface.
+
+## Commands and Results
+- `python -m ruff check .` → passed.
+- `python -m pytest tests/test_review_decision_workbench.py -q` → `.... [100%]`.
+- `python -m pytest -q` → passed, with existing skipped tests preserved.
+- MCP surface smoke: required 9 review/session tools present; destructive delete/reset absent; tool count `65`.
+- DB safety smoke: schema version `11`, `PRAGMA integrity_check` `ok`, new tables present and empty on synthetic DB.
+
+## Notes
+- No production DB destructive operation was performed.
+- No raw financial evidence or secrets were added to repository fixtures.
+- Final PR/CI evidence remains the next gate after commit/push.