Credit deposits at deposit_confirmations and verify the round's coins with the quorum before paying (B-82, DEP-03, DEP-04, DEP-09, DEP-12, DEP-14, ELC-17, ELC-27, RND-21, RND-22, RND-25, RND-39, DAT-10, DAT-11, DAT-24, DAT-62, DAT-67, DAT-68, AUD-12, AUD-44, AUD-45, API-30, API-31, API-36, ADR-06, ADR-52)

A user could bet and then double-spend the 1-conference deposit that funded the bet with a
private chain: the bet left the chain but its participant stayed `confirmed`, and the payout
failed "insufficient pool UTXOs" for ever with everyone else's money stuck. Coinbase outputs
were also credited at 1 confirmation (maturity is 120).

Deposits
- `round_config.deposit_confirmations` (default 6, 1-100, editable from /admin) is the
  threshold for a deposit; an output of a platform transaction (any txid of a
  pending_transactions row, RBF versions included) keeps 1; a coinbase output needs 120,
  recognised from the raw transaction, which must hash to the txid (`is_coinbase`, cached).
  `read_deposit_policy` / `classify_new_deposits` run between the read and the write, so no
  session is open across the lookup.
- The quorum must also place the coin deep enough on our own tip (ELC-17).
- Confirmed outputs short of their threshold are pending deposits (memory only, replaced at
  every refresh): shown in `pending_balance_sats` / `has_pending` (also for DEP-13's withdrawal
  message), never spendable. No scripthash notification announces a maturing deposit, so each
  new block refreshes only the users that have one, one task per user (DEP-09 now says so).

Payout
- `_trigger_payout` verifies the round's confirmed participants' bet outputs with the other
  servers (`verify_pool_outpoints`: strict majority of >= 2 answers per outpoint, a
  mempool-only coin or a tie gives no verdict) and builds from exactly those outpoints
  (RND-22), never from whatever else sits at the address. No quorum: `payout_failed`, `pool
  verification unavailable`, nothing changes. Bets that are gone become `reorged_out`, one
  `participant_reorged_out` row each, `pool_amount_sats` rewritten (only downward) in the same
  transaction, and the 70/30 split is computed on what is left.
- Winner's own bet gone: nothing is built; `rounds.payout_blocked_at` (Alembic f2c64a8d1e93,
  with `deposit_confirmations`, plain add_column) is set, `payout_blocked` and the pause with
  `paused_reason = 'payout_blocked'` are written in one transaction; `POST /admin/resume` clears
  the mark and the next attempt verifies again. /admin/rounds returns it.
- Rounds opened before B-80 (pool = the shared reserve address) keep the old active-server
  `listunspent` choice, since that address holds no single round's bets.

Ambiguities resolved: the winner's row stays `confirmed` while held (AUD-45 says every
participant whose bet is gone becomes `reorged_out`, but OPS-30/DAT-68 need the verification to
repeat after the resume, which only a `confirmed` row allows); `/`'s deposit hint no longer says
"1 confirmation" (7 languages, same keys); guides updated.

Tests changed because the spec changed: listener tests that credited height-100 coins at tip 0
now set a tip past every threshold; the payout fixtures seed confirmed participants (the new
source of the inputs) instead of an active-server `listunspent`, FakeNetwork answers the
verification, and test_round_pool_address asserts the quorum is asked about the round's
address. New: thresholds at exactly 6/5, configured value, coinbase at 119/120 and a mismatching
or missing raw tx, platform outputs at 1, dust, quorum height, waiting-deposit display and
disappearance, block-triggered refresh, resume, verification verdicts, gone bets excluded with
the split recomputed, winner gone held and paused, held payouts untouched until the resume,
re-verification after it, no quorum, a payout with 1 and with 400 participants against
reserve+fee+dust, admin config bounds and migration. Mutation-checked: threshold 1, ignored
coinbase, no height bound, no verification and no winner hold each fail tests.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

tests/unit/test_admin.py

@@ -265,6 +265,8 @@ async def test_config_update_without_changes_logs_nothing(client):
         {"rbf_timeout_seconds": 1},
         {"draw_confirmations": 0},  # B-73: a draw with no confirmations is a draw on the tip
         {"draw_confirmations": 21},
+        {"deposit_confirmations": 0},  # B-82: a deposit credited with no confirmation at all
+        {"deposit_confirmations": 101},
     ],
 )
 async def test_config_rejects_unusable_values(client, payload):
@@ -466,3 +468,47 @@ async def test_config_still_accepts_a_payable_change_and_unrelated_edits(client)
     assert resp.status_code == 200
     # an unrelated edit is never blocked by the payability check
     assert (await client.put("/admin/config", headers=headers, json={"draw_animation_seconds": 5})).status_code == 200
+
+
+async def test_deposit_confirmations_is_configurable_between_1_and_100(client):  # B-82 (DAT-62, API-31)
+    headers = {"X-Admin-Token": "test-admin-token"}
+    assert (await client.get("/admin/config", headers=headers)).json()["deposit_confirmations"] == 6
+    for value in (1, 100, 12):
+        resp = await client.put("/admin/config", headers=headers, json={"deposit_confirmations": value})
+        assert resp.status_code == 200 and resp.json()["deposit_confirmations"] == value
+    audit = (await client.get("/admin/audit-log", headers=headers)).json()
+    changes = [e["payload"]["deposit_confirmations"] for e in audit if e["event_type"] == "config_updated"]
+    assert {"from": 100, "to": 12} in changes
+
+
+async def test_resume_releases_a_payout_held_because_the_winners_bet_left_the_chain(client):  # B-82 (DAT-68, API-32)
+    from datetime import datetime, timezone
+
+    from sqlalchemy import select
+
+    from app.db import base as db_base
+    from app.db.models import AuditLog, Round
+
+    headers = {"X-Admin-Token": "test-admin-token"}
+    async with db_base.engine.begin() as conn:  # the fixture creates the tables before the models are imported
+        await conn.run_sync(db_base.Base.metadata.create_all)
+    async with db_base.AsyncSessionLocal() as session:
+        session.add(Round(status="paying_out", payout_blocked_at=datetime.now(timezone.utc)))
+        session.add(Round(status="closed"))
+        await session.commit()
+    async with db_base.AsyncSessionLocal() as session:
+        from app.rounds.pause import pause_automatically
+
+        await pause_automatically(session, "payout_blocked")
+        await session.commit()
+    assert (await client.get("/admin/config", headers=headers)).json()["paused_reason"] == "payout_blocked"
+    listed = (await client.get("/admin/rounds", headers=headers)).json()  # API-36: the mark is visible
+    assert sorted(r["payout_blocked_at"] is not None for r in listed) == [False, True]
+
+    resp = await client.post("/admin/resume", headers=headers)
+    assert resp.status_code == 200 and resp.json()["paused"] is False and resp.json()["paused_reason"] is None
+
+    async with db_base.AsyncSessionLocal() as session:
+        assert (await session.scalars(select(Round.payout_blocked_at))).all() == [None, None]
+        resumed = [e for e in (await session.scalars(select(AuditLog))).all() if e.event_type == "lottery_resumed"]
+        assert resumed and '"payout_blocked"' in resumed[0].payload_json