fix: enforce actual venue persistence contract

trex_core/adapters/persistence/sql/024_add_ledger_order_venue.sql

@@ -1,6 +1,18 @@
--- GitHub #61: keep the original submission venue separate from actual execution venue.
+-- GitHub #61: keep original submission venue separate from actual execution venue.
+-- The nullable add + NULL-only backfill makes replay safe: rows written after
+-- this migration already have order_venue and are never reinterpreted.
 ALTER TABLE ledger_outbox
-    ADD COLUMN IF NOT EXISTS order_venue TEXT NOT NULL DEFAULT 'KRX';
+    ADD COLUMN IF NOT EXISTS order_venue TEXT;
+
+UPDATE ledger_outbox
+SET order_venue = venue
+WHERE order_venue IS NULL
+  AND venue IN ('KRX', 'NXT', 'SOR');
+
+ALTER TABLE ledger_outbox
+    ALTER COLUMN order_venue SET DEFAULT 'KRX';
+ALTER TABLE ledger_outbox
+    ALTER COLUMN order_venue SET NOT NULL;
 
 ALTER TABLE ledger_outbox
     DROP CONSTRAINT IF EXISTS ledger_outbox_order_venue_check;
@@ -8,5 +20,14 @@ ALTER TABLE ledger_outbox
     ADD CONSTRAINT ledger_outbox_order_venue_check
     CHECK (order_venue IN ('KRX', 'NXT', 'SOR'));
 
--- Historical rows used venue for both concepts. Preserve that provenance.
-UPDATE ledger_outbox SET order_venue = venue WHERE order_venue = 'KRX' AND venue <> 'KRX';
+-- Historical SOR in `venue` recorded routing provenance, not a proven KRX/NXT
+-- execution exchange. Preserve SOR in order_venue and mark actual as unknown.
+ALTER TABLE ledger_outbox
+    ALTER COLUMN venue DROP NOT NULL;
+UPDATE ledger_outbox SET venue = NULL WHERE venue = 'SOR';
+
+ALTER TABLE ledger_outbox
+    DROP CONSTRAINT IF EXISTS ledger_outbox_venue_check;
+ALTER TABLE ledger_outbox
+    ADD CONSTRAINT ledger_outbox_venue_check
+    CHECK (venue IS NULL OR venue IN ('KRX', 'NXT'));