Track every version of a bumped transaction and write the RBF replacement before broadcasting it (B-77, TX-12, TX-13, TX-19, TX-21, DAT-13, DAT-14, DAT-34, DAT-44, DAT-45, DAT-70, DAT-71)

The poller and the reconciler matched current_txid only. If an earlier version of
a bumped transaction confirmed it was never seen, and after 6h the row was abandoned:
a confirmed bet's participant deleted, a sent withdrawal marked failed, a paid payout
rebuilt. bump_fee also broadcast in phase 2 and persisted in phase 3 unconditionally,
so a crash or a `database is locked` in between left a transaction on the network that
the DB did not know, and an abandon or a confirmation in the meantime was overwritten.

- New table pending_transaction_txids (migration a3f5c2d9b7e1; txid unique, index on
  the owning row; existing rows backfilled with current_txid + raw and the txid their
  last bump replaced, raw_hex empty). Written with the row by place_bet,
  request_withdrawal and _trigger_payout; removed with a bet row that a verified
  refusal deletes (DAT-38).
- bump_fee in four phases: read, build and sign, commit the replacement as a candidate
  version, broadcast (verdict of B-76, fanned out when accepted; an explicit refusal
  raises RbfError and leaves the row), then switch the row over with
  `UPDATE ... WHERE status='pending' AND current_txid=<replaced>`. Zero rows matched is
  a logged conflict: nothing is overwritten and the candidate stays recorded. An
  uncertain broadcast adopts the replacement. A retry rebuilds the same candidate
  without tripping the unique txid.
- poll_once and reconcile_once look for every txid of a row. When the version found is
  not the current one, broadcast.adopt_version makes it current (raw tx included) and
  retargets spent_txid, bet_txid, withdrawals.txid and payout_txid as a bump does,
  before the confirmation handler runs. _release_inputs frees inputs claimed by any
  version of the row.
- RbfBumper takes the listener as `network`.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

BUGS.md

@@ -137,21 +137,6 @@ the intermediate headers (`blockchain.block.headers`) and validate the chain; on
 linkage mismatch walk back up to 10 headers to find the fork point and follow the
 reorg instead of ending the session (reorg handling: B-85).
 
-### B-77 — Only the latest txid is tracked, and `bump_fee` broadcasts before it persists
-
-The poller and the reconciler match `current_txid` only (`replaced_by_txid` keeps
-one step and nothing reads it). If an earlier version of a bumped tx confirms, it is
-never seen; after 6h the row is abandoned — a confirmed bet's participant deleted, a
-sent withdrawal marked failed, a paid payout rebuilt. `bump_fee` broadcasts in phase
-2 and persists in phase 3, unconditionally, so a crash or a `database is locked` in
-between, or an abandon that ran meanwhile, desynchronises DB and chain.
-
-Fix: a `pending_transaction_txids` table holding every txid (and raw tx) a row ever
-had; a confirmation of *any* of them confirms the row and retargets every reference
-to it. The replacement is written (as a candidate) before it is broadcast; phase 3
-updates with `WHERE status='pending' AND current_txid=<old>` and treats zero rows as
-a conflict to reconcile.
-
 ### B-78 — Abandonment rests on one server's silence
 
 `reconcile_once` abandons when the active server's `get_history` lacks the txid —