Close the window where a bet pays into a round it was left out of (B-53)

place_bet commits its participant row as "building" before broadcasting (B-08's
two-phase write), while the scheduler flips the round "open" -> "closing" in one
transaction and counts in-flight participants in another. A bet whose deadline
check passed just before that flip could commit in between: the count saw zero,
so the round drew and paid out over the "confirmed" participants only, while the
bet confirmed normally and its sats landed in the pool address — credited to no
round, to no participant, with no refund path, silently improving the next
round's payout change.

Two locks on the same door:

- place_bet re-checks the deadline after building and signing (the first check
  happens before the UTXO scan, so a slow build could carry a bet past it), then
  commits the participant row behind a compare-and-set on the round's own row,
  UPDATE rounds ... WHERE status = 'open'. That UPDATE takes SQLite's write lock,
  so the two transactions can no longer interleave: either the bet commits first
  and the scheduler's in-flight count sees it, or the flip commits first and the
  guard matches zero rows and refuses the bet with round_closing before anything
  is broadcast. A write-snapshot conflict (OperationalError) is the same
  situation and gets the same answer. Nothing has been broadcast at that point,
  so the rollback releases the UTXOs and leaves no rows behind.

- _close_and_draw re-counts in-flight bets in the same session it snapshots the
  participants from, and returns with the round still "closing" if it finds any.
  Redundant given the CAS, and cheap: it fails safe and the next tick retries.

No new error code — a bet refused this way is exactly the "round is closing"
case the user already sees.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

app/rounds/scheduler.py

@@ -120,6 +120,27 @@ class RoundScheduler:
         async with self._session_factory() as session:
             round_ = await session.get(Round, round_id)
 
+            # B-53: re-check for in-flight bets in the *same* session that snapshots
+            # the participants. _tick's check ran in a session of its own, so a bet
+            # committing its "building" row in between was counted by neither: the
+            # round drew and paid out without it, while its sats still landed in the
+            # pool. place_bet's compare-and-set on the round row is what makes that
+            # window unreachable; this is the cheap second lock on the same door, and
+            # it fails safe — the round stays "closing" and the next tick retries.
+            pending_count = await session.scalar(
+                select(func.count())
+                .select_from(RoundParticipant)
+                .where(
+                    RoundParticipant.round_id == round_id,
+                    RoundParticipant.status.in_(("building", "broadcast")),
+                )
+            )
+            if pending_count:
+                logger.info(
+                    "round %s: %s bet(s) still in flight at close time, waiting", round_id, pending_count
+                )
+                return
+
             participants = (
                 await session.scalars(
                     select(RoundParticipant)