Never roll back an ambiguous broadcast as if it had been refused (B-76, TX-04, TX-05, TX-20, TX-21, BET-16, BET-17, BET-23, WDR-11, WDR-12, WDR-16, API-13)

place_bet and request_withdrawal released everything on any exception from the
broadcast, including the 15s timeout and a connection dropped after the write. The
tx may have propagated: a bet's sats landed in the pool with no participant, a
withdrawal left while its row said failed and its coins were spendable again.

- client: ElectrumRpcError (subclass of ElectrumError) is raised only for a reply
  carrying a JSON-RPC `error`; timeouts, drops and write errors stay plain
  ElectrumError.
- tx/outcome.py:broadcast_with_verdict sorts a broadcast into accepted / refused /
  uncertain. A refusal is verified first: ElectrumListener.transaction_known asks
  blockchain.transaction.get of the active server and every other one (10s each) —
  any server returning the tx means accepted; the active server plus
  MIN_QUORUM_RESPONSES others all denying it means refused (ALLOW_NO_QUORUM keeps
  the reduced rule); too few answers is uncertain. "already known" wording is only a
  shortcut that skips the check. With no network to ask, a refusal is uncertain.
- place_bet / request_withdrawal / _trigger_payout use it: only a verified refusal
  releases; uncertain leaves the rows building for the reconciler, publishes SSE and
  POST /bets and POST /withdrawals answer 202 with status building; "already known"
  promotes a payout (payout_sent) like any accepted broadcast.
- An accepted transaction is fanned out to every other server
  (ElectrumListener.fan_out_transaction, best effort, off the caller's path). The RBF
  replacement in bump_fee is left for B-77, which rewrites that function.

Tests changed because the spec changed: the existing "refused broadcast" tests raised
a bare RuntimeError (now an uncertain outcome) and are made explicit refusals
(rpc_error) with a network that denies the tx; direct route calls pass a Response;
FakePayoutListener gains the network surface.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

app/withdrawals/service.py

@@ -12,6 +12,7 @@ from app.db.models import PendingTransaction, Round, User, UtxoEvent, Withdrawal
 from app.electrum.client import ElectrumClient
 from app.rounds.config import get_round_config
 from app.rounds.events import broadcaster
+from app.tx.outcome import BroadcastOutcome, TransactionNetwork, broadcast_with_verdict
 from app.wallet.address import is_valid_plm_address
 from app.wallet.balance import compute_pending_balance, recompute_balance
 from app.wallet.hd import derive_pool_address, derive_user_key
@@ -31,7 +32,12 @@ class WithdrawalError(ApiError):
 
 
 async def request_withdrawal(
-    session: AsyncSession, client: ElectrumClient, user: User, external_address: str, amount_sats: int
+    session: AsyncSession,
+    client: ElectrumClient,
+    user: User,
+    external_address: str,
+    amount_sats: int,
+    network: TransactionNetwork | None = None,
 ) -> Withdrawal:
     # Checked before anything else: an address from another chain parses fine as a
     # witness program (see wallet/address.py), so without this the tx would build,
@@ -162,11 +168,14 @@ async def request_withdrawal(
     session.add(pending)
     await session.commit()
 
-    try:
-        await client.broadcast(built.raw_hex)
-    except Exception as exc:
+    # B-76 (TX-04, TX-20): only a verified refusal releases the coins. A timeout, a
+    # drop after the write, or a refusal nobody could verify may mean the transaction
+    # left: the withdrawal would then be paid out while its row said "failed" and its
+    # coins were spendable again. Those outcomes leave the rows "building".
+    verdict = await broadcast_with_verdict(client, network, built.raw_hex, built.txid)
+    if verdict.outcome is BroadcastOutcome.REFUSED:
         try:
-            await _release_failed_withdrawal(session, withdrawal, pending, built, user.id, str(exc))
+            await _release_failed_withdrawal(session, withdrawal, pending, built, user.id, verdict.reason)
         except OperationalError:
             # B-88: the release could not be written (database busy). The rows stay
             # "building", the state committed before the broadcast, and the
@@ -175,9 +184,16 @@ async def request_withdrawal(
             logger.error(
                 "could not release the failed withdrawal %s: database busy, left to the reconciler", built.txid
             )
-        raise WithdrawalError(
-            "broadcast_failed", f"the network refused the transaction: {exc}"
-        ) from exc
+        raise WithdrawalError("broadcast_failed", f"the network refused the transaction: {verdict.reason}")
+    if verdict.outcome is BroadcastOutcome.UNCERTAIN:
+        logger.warning(
+            "withdrawal %s: broadcast outcome uncertain (%s), left 'building' for the reconciler",
+            built.txid,
+            verdict.reason,
+        )
+        await session.refresh(withdrawal)
+        broadcaster.publish()
+        return withdrawal
 
     # B-88: after the broadcast nothing is undone. Without the lock the rows stay
     # "building" and the reconciler promotes them; the caller sees the real status.