Credit deposits at deposit_confirmations and verify the round's coins with the quorum before paying (B-82, DEP-03, DEP-04, DEP-09, DEP-12, DEP-14, ELC-17, ELC-27, RND-21, RND-22, RND-25, RND-39, DAT-10, DAT-11, DAT-24, DAT-62, DAT-67, DAT-68, AUD-12, AUD-44, AUD-45, API-30, API-31, API-36, ADR-06, ADR-52)

A user could bet and then double-spend the 1-conference deposit that funded the bet with a
private chain: the bet left the chain but its participant stayed `confirmed`, and the payout
failed "insufficient pool UTXOs" for ever with everyone else's money stuck. Coinbase outputs
were also credited at 1 confirmation (maturity is 120).

Deposits
- `round_config.deposit_confirmations` (default 6, 1-100, editable from /admin) is the
  threshold for a deposit; an output of a platform transaction (any txid of a
  pending_transactions row, RBF versions included) keeps 1; a coinbase output needs 120,
  recognised from the raw transaction, which must hash to the txid (`is_coinbase`, cached).
  `read_deposit_policy` / `classify_new_deposits` run between the read and the write, so no
  session is open across the lookup.
- The quorum must also place the coin deep enough on our own tip (ELC-17).
- Confirmed outputs short of their threshold are pending deposits (memory only, replaced at
  every refresh): shown in `pending_balance_sats` / `has_pending` (also for DEP-13's withdrawal
  message), never spendable. No scripthash notification announces a maturing deposit, so each
  new block refreshes only the users that have one, one task per user (DEP-09 now says so).

Payout
- `_trigger_payout` verifies the round's confirmed participants' bet outputs with the other
  servers (`verify_pool_outpoints`: strict majority of >= 2 answers per outpoint, a
  mempool-only coin or a tie gives no verdict) and builds from exactly those outpoints
  (RND-22), never from whatever else sits at the address. No quorum: `payout_failed`, `pool
  verification unavailable`, nothing changes. Bets that are gone become `reorged_out`, one
  `participant_reorged_out` row each, `pool_amount_sats` rewritten (only downward) in the same
  transaction, and the 70/30 split is computed on what is left.
- Winner's own bet gone: nothing is built; `rounds.payout_blocked_at` (Alembic f2c64a8d1e93,
  with `deposit_confirmations`, plain add_column) is set, `payout_blocked` and the pause with
  `paused_reason = 'payout_blocked'` are written in one transaction; `POST /admin/resume` clears
  the mark and the next attempt verifies again. /admin/rounds returns it.
- Rounds opened before B-80 (pool = the shared reserve address) keep the old active-server
  `listunspent` choice, since that address holds no single round's bets.

Ambiguities resolved: the winner's row stays `confirmed` while held (AUD-45 says every
participant whose bet is gone becomes `reorged_out`, but OPS-30/DAT-68 need the verification to
repeat after the resume, which only a `confirmed` row allows); `/`'s deposit hint no longer says
"1 confirmation" (7 languages, same keys); guides updated.

Tests changed because the spec changed: listener tests that credited height-100 coins at tip 0
now set a tip past every threshold; the payout fixtures seed confirmed participants (the new
source of the inputs) instead of an active-server `listunspent`, FakeNetwork answers the
verification, and test_round_pool_address asserts the quorum is asked about the round's
address. New: thresholds at exactly 6/5, configured value, coinbase at 119/120 and a mismatching
or missing raw tx, platform outputs at 1, dust, quorum height, waiting-deposit display and
disappearance, block-triggered refresh, resume, verification verdicts, gone bets excluded with
the split recomputed, winner gone held and paused, held payouts untouched until the resume,
re-verification after it, no quorum, a payout with 1 and with 400 participants against
reserve+fee+dust, admin config bounds and migration. Mutation-checked: threshold 1, ignored
coinbase, no height bound, no verification and no winner hold each fail tests.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

tests/unit/test_scheduler.py

@@ -120,7 +120,15 @@ async def payout_session_factory(tmp_path, monkeypatch):
     hd._account_key = None
 
 
-async def _seed_paying_out_round(session_factory, round_id: int = 1) -> int:
+def _payout_bet_txid(index: int) -> str:
+    return f"{index + 0x33:064x}"
+
+
+async def _seed_paying_out_round(session_factory, round_id: int = 1, bets: list[int] | None = None) -> int:
+    """A round in `paying_out` whose confirmed participants — the first one is the winner —
+    each placed a bet of the given net amount (B-82: the payout spends exactly those bet
+    outputs, `bet_txid:0`, so the pool is their sum)."""
+    bets = bets if bets is not None else [_POOL_AMOUNT_SATS]
     async with session_factory() as session:
         winner = User(username="winner", password_hash="x", derivation_index=0, address=_WINNER_ADDRESS)
         session.add(winner)
@@ -130,11 +138,27 @@ async def _seed_paying_out_round(session_factory, round_id: int = 1) -> int:
             Round(
                 id=round_id,
                 status="paying_out",
-                pool_amount_sats=_POOL_AMOUNT_SATS,
+                pool_amount_sats=sum(bets),
                 winner_user_id=winner.id,
                 pool_address=derive_pool_address(round_id),  # B-80
             )
         )
+        await session.flush()
+        for index, amount in enumerate(bets):
+            user = winner
+            if index:
+                user = User(
+                    username=f"bettor{index}", password_hash="x", derivation_index=index,
+                    address=derive_pool_address(7000 + index),
+                )
+                session.add(user)
+                await session.flush()
+            session.add(
+                RoundParticipant(
+                    round_id=round_id, user_id=user.id, bet_amount_sats=amount, bet_txid=_payout_bet_txid(index),
+                    bet_vout=0, status="confirmed", draw_position=index,
+                )
+            )
         await session.commit()
         return winner.id
 
@@ -206,18 +230,14 @@ async def test_trigger_payout_pays_a_round_with_more_participants_than_max_tx_in
     so a round past MAX_TX_INPUTS participants could not be paid at all — the build
     failed with too_many_inputs, the round stayed "paying_out" retrying every 60s,
     and no new round could ever open behind it. It must now broadcast normally."""
-    await _seed_paying_out_round(payout_session_factory)
-
     participants = MAX_TX_INPUTS + 1
     bet_sats = _POOL_AMOUNT_SATS // participants
-    entries = [
-        {"tx_hash": f"{i:064x}", "tx_pos": 0, "height": 10, "value": bet_sats}
-        for i in range(participants)
-    ]
-    # The pool's total must cover the round's recorded pool_amount_sats, exactly as
-    # on-chain: integer division above leaves a remainder, so top the last one up.
-    entries[-1]["value"] += _POOL_AMOUNT_SATS - bet_sats * participants
-    client = FakePayoutClient(entries)
+    bets = [bet_sats] * participants
+    # The pool's total is the round's recorded pool_amount_sats: integer division above
+    # leaves a remainder, so top the last one up.
+    bets[-1] += _POOL_AMOUNT_SATS - bet_sats * participants
+    await _seed_paying_out_round(payout_session_factory, bets=bets)
+    client = FakePayoutClient([])
     scheduler = RoundScheduler(payout_session_factory, FakePayoutListener(client))
 
     await scheduler._trigger_payout(1)