Never roll back an ambiguous broadcast as if it had been refused (B-76, TX-04, TX-05, TX-20, TX-21, BET-16, BET-17, BET-23, WDR-11, WDR-12, WDR-16, API-13)

place_bet and request_withdrawal released everything on any exception from the
broadcast, including the 15s timeout and a connection dropped after the write. The
tx may have propagated: a bet's sats landed in the pool with no participant, a
withdrawal left while its row said failed and its coins were spendable again.

- client: ElectrumRpcError (subclass of ElectrumError) is raised only for a reply
  carrying a JSON-RPC `error`; timeouts, drops and write errors stay plain
  ElectrumError.
- tx/outcome.py:broadcast_with_verdict sorts a broadcast into accepted / refused /
  uncertain. A refusal is verified first: ElectrumListener.transaction_known asks
  blockchain.transaction.get of the active server and every other one (10s each) —
  any server returning the tx means accepted; the active server plus
  MIN_QUORUM_RESPONSES others all denying it means refused (ALLOW_NO_QUORUM keeps
  the reduced rule); too few answers is uncertain. "already known" wording is only a
  shortcut that skips the check. With no network to ask, a refusal is uncertain.
- place_bet / request_withdrawal / _trigger_payout use it: only a verified refusal
  releases; uncertain leaves the rows building for the reconciler, publishes SSE and
  POST /bets and POST /withdrawals answer 202 with status building; "already known"
  promotes a payout (payout_sent) like any accepted broadcast.
- An accepted transaction is fanned out to every other server
  (ElectrumListener.fan_out_transaction, best effort, off the caller's path). The RBF
  replacement in bump_fee is left for B-77, which rewrites that function.

Tests changed because the spec changed: the existing "refused broadcast" tests raised
a bare RuntimeError (now an uncertain outcome) and are made explicit refusals
(rpc_error) with a network that denies the tx; direct route calls pass a Response;
FakePayoutListener gains the network surface.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

tests/unit/test_electrum_client.py

@@ -380,3 +380,36 @@ async def test_main_builds_clients_with_the_endpoint_pin():
 
     assert _make_electrum_client(ElectrumEndpoint("h", 1, True, _PIN)).pin == _PIN
     assert _make_electrum_client(ElectrumEndpoint("h", 1, True)).pin is None
+
+
+async def test_only_a_server_error_object_is_an_explicit_refusal():
+    """B-76 / TX-04: a JSON-RPC `error` reply is an ElectrumRpcError carrying the
+    server's wording (string or object); a timeout or a dropped connection is a plain
+    ElectrumError — they say nothing about whether the server acted."""
+    from app.electrum import client as client_module
+    from app.electrum.client import ElectrumRpcError
+
+    client, reader, writer = await _client_with_fake_transport()
+    task = asyncio.create_task(client.request("blockchain.transaction.broadcast", ["00"]))
+    await asyncio.sleep(0)
+    sent = json.loads(writer.written.decode())
+    reader.feed_data((json.dumps({"id": sent["id"], "error": {"code": -26, "message": "txn-mempool-conflict"}}) + "\n").encode())
+    try:
+        await task
+        assert False, "expected ElectrumRpcError"
+    except ElectrumRpcError as exc:
+        assert exc.message == "txn-mempool-conflict"
+    client._read_task.cancel()
+
+    original = client_module._REQUEST_TIMEOUT_SECONDS
+    client_module._REQUEST_TIMEOUT_SECONDS = 0.05
+    try:
+        silent, _reader, _writer = await _client_with_fake_transport()
+        try:
+            await silent.request("blockchain.transaction.broadcast", ["00"])
+            assert False, "expected ElectrumError"
+        except ElectrumError as exc:
+            assert not isinstance(exc, ElectrumRpcError)
+        silent._read_task.cancel()
+    finally:
+        client_module._REQUEST_TIMEOUT_SECONDS = original