fix: enforce actual venue persistence contract

trex_core/adapters/persistence/sql/024_add_ledger_order_venue.sql

@@ -1,6 +1,18 @@
--- GitHub #61: keep the original submission venue separate from actual execution venue.
+-- GitHub #61: keep original submission venue separate from actual execution venue.
+-- The nullable add + NULL-only backfill makes replay safe: rows written after
+-- this migration already have order_venue and are never reinterpreted.
 ALTER TABLE ledger_outbox
-    ADD COLUMN IF NOT EXISTS order_venue TEXT NOT NULL DEFAULT 'KRX';
+    ADD COLUMN IF NOT EXISTS order_venue TEXT;
+
+UPDATE ledger_outbox
+SET order_venue = venue
+WHERE order_venue IS NULL
+  AND venue IN ('KRX', 'NXT', 'SOR');
+
+ALTER TABLE ledger_outbox
+    ALTER COLUMN order_venue SET DEFAULT 'KRX';
+ALTER TABLE ledger_outbox
+    ALTER COLUMN order_venue SET NOT NULL;
 
 ALTER TABLE ledger_outbox
     DROP CONSTRAINT IF EXISTS ledger_outbox_order_venue_check;
@@ -8,5 +20,14 @@ ALTER TABLE ledger_outbox
     ADD CONSTRAINT ledger_outbox_order_venue_check
     CHECK (order_venue IN ('KRX', 'NXT', 'SOR'));
 
--- Historical rows used venue for both concepts. Preserve that provenance.
-UPDATE ledger_outbox SET order_venue = venue WHERE order_venue = 'KRX' AND venue <> 'KRX';
+-- Historical SOR in `venue` recorded routing provenance, not a proven KRX/NXT
+-- execution exchange. Preserve SOR in order_venue and mark actual as unknown.
+ALTER TABLE ledger_outbox
+    ALTER COLUMN venue DROP NOT NULL;
+UPDATE ledger_outbox SET venue = NULL WHERE venue = 'SOR';
+
+ALTER TABLE ledger_outbox
+    DROP CONSTRAINT IF EXISTS ledger_outbox_venue_check;
+ALTER TABLE ledger_outbox
+    ADD CONSTRAINT ledger_outbox_venue_check
+    CHECK (venue IS NULL OR venue IN ('KRX', 'NXT'));

trex_core/application/broker_port.py

@@ -71,8 +71,8 @@ class OrderAck:
     accepted: bool
     broker_order_id: Optional[str] = None
     reason: Optional[str] = None
-    # Actual venue used for submission. Execution persists this value with the
-    # broker order id so restart/cancel never has to infer the original venue.
+    # Original submission/routing venue. Execution persists this with the
+    # broker order id so restart/cancel never infer it from wall-clock time.
     venue: Optional[str] = None
     raw: dict[str, Any] = field(default_factory=dict)
     submitted_at: Optional[datetime] = None

trex_core/application/ledger_port.py

@@ -57,8 +57,9 @@ class LedgerTrade:
     fee: float = 0.0
     tax: float = 0.0
     executed_at: Optional[datetime] = None
-    # Broker-authoritative execution exchange (KRX/NXT).
-    venue: str = "KRX"
+    # Broker-authoritative execution exchange (KRX/NXT). Historical rows whose
+    # SOR execution exchange cannot be reconstructed are None.
+    venue: Optional[str] = None
     # Original submission/routing venue (KRX/NXT/SOR), retained for audit.
     order_venue: str = "KRX"