Never roll back an ambiguous broadcast as if it had been refused (B-76, TX-04, TX-05, TX-20, TX-21, BET-16, BET-17, BET-23, WDR-11, WDR-12, WDR-16, API-13)

place_bet and request_withdrawal released everything on any exception from the
broadcast, including the 15s timeout and a connection dropped after the write. The
tx may have propagated: a bet's sats landed in the pool with no participant, a
withdrawal left while its row said failed and its coins were spendable again.

- client: ElectrumRpcError (subclass of ElectrumError) is raised only for a reply
  carrying a JSON-RPC `error`; timeouts, drops and write errors stay plain
  ElectrumError.
- tx/outcome.py:broadcast_with_verdict sorts a broadcast into accepted / refused /
  uncertain. A refusal is verified first: ElectrumListener.transaction_known asks
  blockchain.transaction.get of the active server and every other one (10s each) —
  any server returning the tx means accepted; the active server plus
  MIN_QUORUM_RESPONSES others all denying it means refused (ALLOW_NO_QUORUM keeps
  the reduced rule); too few answers is uncertain. "already known" wording is only a
  shortcut that skips the check. With no network to ask, a refusal is uncertain.
- place_bet / request_withdrawal / _trigger_payout use it: only a verified refusal
  releases; uncertain leaves the rows building for the reconciler, publishes SSE and
  POST /bets and POST /withdrawals answer 202 with status building; "already known"
  promotes a payout (payout_sent) like any accepted broadcast.
- An accepted transaction is fanned out to every other server
  (ElectrumListener.fan_out_transaction, best effort, off the caller's path). The RBF
  replacement in bump_fee is left for B-77, which rewrites that function.

Tests changed because the spec changed: the existing "refused broadcast" tests raised
a bare RuntimeError (now an uncertain outcome) and are made explicit refusals
(rpc_error) with a network that denies the tx; direct route calls pass a Response;
FakePayoutListener gains the network surface.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

app/bets/service.py

@@ -14,6 +14,7 @@ from app.electrum.client import ElectrumClient
 from app.rounds.config import get_round_config
 from app.rounds.events import broadcaster
 from app.rounds.service import open_new_round_if_needed, round_accepts_bets
+from app.tx.outcome import BroadcastOutcome, TransactionNetwork, broadcast_with_verdict
 from app.wallet.balance import recompute_balance
 from app.wallet.hd import derive_user_key
 from app.wallet.psbt_builder import (
@@ -37,7 +38,12 @@ class _RoundClosedDuringBuild(Exception):
     being built. Never leaves place_bet — it becomes a `round_closing` BetError."""
 
 
-async def place_bet(session: AsyncSession, client: ElectrumClient, user: User) -> RoundParticipant:
+async def place_bet(
+    session: AsyncSession, client: ElectrumClient, user: User, network: TransactionNetwork | None = None
+) -> RoundParticipant:
+    """`network` (the ElectrumListener) is what verifies a refused broadcast and fans an
+    accepted one out (B-76); without it a refusal can never be proven, so it never
+    releases anything."""
     # B-88 (DAT-74, BET-11): take SQLite's write lock before the first read, so the
     # balance, the free UTXOs, the participants and the round's status read below are
     # the state the phase-1 write lands on — a plain BEGIN only starts at the first
@@ -184,21 +190,29 @@ async def place_bet(session: AsyncSession, client: ElectrumClient, user: User) -
         raise _service_busy() from exc
 
     # --- Phase 2: broadcast, then promote both rows to their live state ---------
-    try:
-        await client.broadcast(built.raw_hex)
-    except Exception as exc:
-        # The node refused it (fee too low, dust, mempool conflict, or simply an
-        # unreachable server) — nothing is on-chain, so undo phase 1 completely and
-        # give the user a translatable failure instead of a bare 500 (B-07).
+    # B-76 (TX-04, TX-20): only a *verified* refusal undoes phase 1. A timeout, a
+    # dropped connection or a refusal nobody could verify leaves the tx possibly on the
+    # network, and releasing the coins then sent the bet's sats into the pool with no
+    # participant behind them — so those rows stay "building" for the reconciler.
+    verdict = await broadcast_with_verdict(client, network, built.raw_hex, built.txid)
+    if verdict.outcome is BroadcastOutcome.REFUSED:
+        # The network refused it (fee too low, dust, mempool conflict) and no server
+        # knows it — nothing is on-chain, so undo phase 1 completely and give the user
+        # a translatable failure instead of a bare 500 (B-07).
         try:
-            await _release_failed_bet(session, participant, pending, built, user.id, str(exc))
+            await _release_failed_bet(session, participant, pending, built, user.id, verdict.reason)
         except OperationalError:
             # B-88: the database is busy, so the release could not be written. The
             # rows stay "building" — the state phase 1 committed — and the
             # reconciler resolves them against the chain.
             await session.rollback()
             logger.error("could not release the failed bet %s: database busy, left to the reconciler", built.txid)
-        raise BetError("broadcast_failed", f"the network refused the transaction: {exc}") from exc
+        raise BetError("broadcast_failed", f"the network refused the transaction: {verdict.reason}")
+    if verdict.outcome is BroadcastOutcome.UNCERTAIN:
+        logger.warning("bet %s: broadcast outcome uncertain (%s), left 'building' for the reconciler", built.txid, verdict.reason)
+        await session.refresh(participant)  # reports the status the DB really holds: building
+        broadcaster.publish()  # an in-flight bet counts towards the round's figures
+        return participant
 
     # B-88: after the broadcast nothing may be undone. If the lock cannot be had the
     # rows stay "building" (the tx is on the network) and the reconciler promotes