Never roll back an ambiguous broadcast as if it had been refused (B-76, TX-04, TX-05, TX-20, TX-21, BET-16, BET-17, BET-23, WDR-11, WDR-12, WDR-16, API-13)

place_bet and request_withdrawal released everything on any exception from the
broadcast, including the 15s timeout and a connection dropped after the write. The
tx may have propagated: a bet's sats landed in the pool with no participant, a
withdrawal left while its row said failed and its coins were spendable again.

- client: ElectrumRpcError (subclass of ElectrumError) is raised only for a reply
  carrying a JSON-RPC `error`; timeouts, drops and write errors stay plain
  ElectrumError.
- tx/outcome.py:broadcast_with_verdict sorts a broadcast into accepted / refused /
  uncertain. A refusal is verified first: ElectrumListener.transaction_known asks
  blockchain.transaction.get of the active server and every other one (10s each) —
  any server returning the tx means accepted; the active server plus
  MIN_QUORUM_RESPONSES others all denying it means refused (ALLOW_NO_QUORUM keeps
  the reduced rule); too few answers is uncertain. "already known" wording is only a
  shortcut that skips the check. With no network to ask, a refusal is uncertain.
- place_bet / request_withdrawal / _trigger_payout use it: only a verified refusal
  releases; uncertain leaves the rows building for the reconciler, publishes SSE and
  POST /bets and POST /withdrawals answer 202 with status building; "already known"
  promotes a payout (payout_sent) like any accepted broadcast.
- An accepted transaction is fanned out to every other server
  (ElectrumListener.fan_out_transaction, best effort, off the caller's path). The RBF
  replacement in bump_fee is left for B-77, which rewrites that function.

Tests changed because the spec changed: the existing "refused broadcast" tests raised
a bare RuntimeError (now an uncertain outcome) and are made explicit refusals
(rpc_error) with a network that denies the tx; direct route calls pass a Response;
FakePayoutListener gains the network surface.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

app/api/routes/bets.py

@@ -1,4 +1,4 @@
-from fastapi import APIRouter, Depends, Request, status
+from fastapi import APIRouter, Depends, Request, Response, status
 from pydantic import BaseModel
 from sqlalchemy.ext.asyncio import AsyncSession
 
@@ -21,6 +21,7 @@ class BetResponse(BaseModel):
 @router.post("", response_model=BetResponse, status_code=status.HTTP_201_CREATED)
 async def create_bet(
     request: Request,
+    response: Response,
     user: User = Depends(get_current_user),
     session: AsyncSession = Depends(get_session),
 ) -> BetResponse:
@@ -34,7 +35,7 @@ async def create_bet(
 
     async with request.app.state.user_locks.acquire(user.id):
         try:
-            participant = await place_bet(session, listener.client, user)
+            participant = await place_bet(session, listener.client, user, network=listener)
         except BetError as exc:
             # A rejected broadcast isn't the client's fault — it's the network
             # refusing our transaction, so it answers 502 rather than 400 (B-07).
@@ -47,6 +48,11 @@ async def create_bet(
             )
             raise from_api_error(code, exc) from exc
 
+    if participant.status == "building":
+        # B-76 (TX-20, BET-23): the outcome of the broadcast is uncertain — the tx may
+        # already be on the network — so the bet is accepted for processing, not
+        # confirmed as sent, and the reconciler settles it.
+        response.status_code = status.HTTP_202_ACCEPTED
     return BetResponse(
         round_id=participant.round_id,
         bet_txid=participant.bet_txid,

app/api/routes/withdrawals.py

@@ -1,4 +1,4 @@
-from fastapi import APIRouter, Depends, Request, status
+from fastapi import APIRouter, Depends, Request, Response, status
 from pydantic import BaseModel
 from sqlalchemy.ext.asyncio import AsyncSession
 
@@ -27,6 +27,7 @@ class WithdrawalResponse(BaseModel):
 async def create_withdrawal(
     body: WithdrawalRequest,
     request: Request,
+    response: Response,
     user: User = Depends(get_current_user),
     session: AsyncSession = Depends(get_session),
 ) -> WithdrawalResponse:
@@ -41,7 +42,7 @@ async def create_withdrawal(
     async with request.app.state.user_locks.acquire(user.id):
         try:
             withdrawal = await request_withdrawal(
-                session, listener.client, user, body.external_address, body.amount_sats
+                session, listener.client, user, body.external_address, body.amount_sats, network=listener
             )
         except WithdrawalError as exc:
             code = (
@@ -53,6 +54,10 @@ async def create_withdrawal(
             )
             raise from_api_error(code, exc) from exc
 
+    if withdrawal.status == "building":
+        # B-76 (TX-20, WDR-16): uncertain broadcast — accepted for processing, the
+        # reconciler decides whether the transaction left.
+        response.status_code = status.HTTP_202_ACCEPTED
     return WithdrawalResponse(
         txid=withdrawal.txid,
         amount_requested_sats=withdrawal.amount_requested_sats,