Real SQLite transactions: BEGIN IMMEDIATE and synchronous=FULL (B-88, DAT-74, DAT-52, ARC-07, TX-28, BET-11, DAT-16)

pysqlite's legacy mode emitted BEGIN only at the first DML, so every read
before it ran outside any transaction and a lock wait surfaced as "database is
locked" at an arbitrary later statement; place_bet also mistook that error for
a write-snapshot conflict, which SQLite cannot produce.

- _register_sqlite_pragmas: synchronous=FULL, isolation_level=None and a
  `begin` event that emits BEGIN / BEGIN IMMEDIATE.
- begin_immediate(session): takes the write lock before the first read; called
  first thing in place_bet, request_withdrawal, the scheduler transitions,
  _trigger_payout, the confirmation poller, the reconciler, bump_fee's persist
  phase, deposit crediting / external-spend marking / reinstating, and the
  derivation-index allocation at registration.
- A lock not granted before a broadcast answers service_busy (503, all seven
  languages), nothing built or sent; after a broadcast nothing is undone, the
  rows stay `building` for the reconciler.
- Spec, storico, BUGS.md and CLAUDE.md updated; 37 new tests on a real file DB.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

app/deposits/service.py

@@ -4,6 +4,7 @@ from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.audit.log import write_audit_log
+from app.db.base import begin_immediate
 from app.db.models import UtxoEvent
 from app.rounds.events import broadcaster
 from app.wallet.balance import recompute_balance
@@ -45,7 +46,12 @@ async def credit_confirmed_utxos(session: AsyncSession, user_id: int, entries: l
     entries: [{"tx_hash": ..., "tx_pos": ..., "height": ..., "value": ...}, ...]
     height <= 0 means unconfirmed (mempool) per the Electrum protocol convention —
     skipped, since the spec requires 1 confirmation before crediting.
+
+    B-88: opens with BEGIN IMMEDIATE, so the "already recorded?" read and the inserts
+    it guards are one transaction — the unique (txid, vout) constraint stays the
+    backstop, not the mechanism.
     """
+    await begin_immediate(session)
     existing_keys = {
         (txid, vout)
         for txid, vout in (
@@ -98,6 +104,20 @@ async def reinstate_reappeared_utxos(session: AsyncSession, user_id: int, entrie
     """
     current_keys = {(entry["tx_hash"], entry["tx_pos"]) for entry in entries}
 
+    # B-88: the lock is only worth taking when there is something to write, and this
+    # runs on every refresh — so look first (plain columns), then take it and read the
+    # rows again under it.
+    flagged = (
+        await session.execute(
+            select(UtxoEvent.txid, UtxoEvent.vout).where(
+                UtxoEvent.user_id == user_id, UtxoEvent.spent_txid == _EXTERNAL_SPEND_SENTINEL
+            )
+        )
+    ).all()
+    if not any((txid, vout) in current_keys for txid, vout in flagged):
+        return 0
+    await begin_immediate(session)
+
     marked_rows = (
         await session.scalars(
             select(UtxoEvent).where(
@@ -178,6 +198,7 @@ async def mark_utxos_spent_externally(session: AsyncSession, user_id: int, utxo_
     may have resolved it (a legitimate platform spend, or a prior refresh) between
     when the caller read the candidate list and finished corroborating it.
     """
+    await begin_immediate(session)  # B-88: that re-check and the mark are one transaction
     marked = 0
     for utxo_id in utxo_ids:
         row = await session.get(UtxoEvent, utxo_id)