Track every version of a bumped transaction and write the RBF replacement before broadcasting it (B-77, TX-12, TX-13, TX-19, TX-21, DAT-13, DAT-14, DAT-34, DAT-44, DAT-45, DAT-70, DAT-71)

The poller and the reconciler matched current_txid only. If an earlier version of
a bumped transaction confirmed it was never seen, and after 6h the row was abandoned:
a confirmed bet's participant deleted, a sent withdrawal marked failed, a paid payout
rebuilt. bump_fee also broadcast in phase 2 and persisted in phase 3 unconditionally,
so a crash or a `database is locked` in between left a transaction on the network that
the DB did not know, and an abandon or a confirmation in the meantime was overwritten.

- New table pending_transaction_txids (migration a3f5c2d9b7e1; txid unique, index on
  the owning row; existing rows backfilled with current_txid + raw and the txid their
  last bump replaced, raw_hex empty). Written with the row by place_bet,
  request_withdrawal and _trigger_payout; removed with a bet row that a verified
  refusal deletes (DAT-38).
- bump_fee in four phases: read, build and sign, commit the replacement as a candidate
  version, broadcast (verdict of B-76, fanned out when accepted; an explicit refusal
  raises RbfError and leaves the row), then switch the row over with
  `UPDATE ... WHERE status='pending' AND current_txid=<replaced>`. Zero rows matched is
  a logged conflict: nothing is overwritten and the candidate stays recorded. An
  uncertain broadcast adopts the replacement. A retry rebuilds the same candidate
  without tripping the unique txid.
- poll_once and reconcile_once look for every txid of a row. When the version found is
  not the current one, broadcast.adopt_version makes it current (raw tx included) and
  retargets spent_txid, bet_txid, withdrawals.txid and payout_txid as a bump does,
  before the confirmation handler runs. _release_inputs frees inputs claimed by any
  version of the row.
- RbfBumper takes the listener as `network`.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

tests/unit/test_migrations.py

@@ -74,3 +74,53 @@ def test_the_migrated_database_still_enforces_both_invariants(migrated_db):
         conn.execute(f"INSERT INTO users {columns} VALUES ('Alice', 'x', 0, 'plm1qa', 0, 0, '2026-01-01 00:00:00')")
         with pytest.raises(sqlite3.IntegrityError):
             conn.execute(f"INSERT INTO users {columns} VALUES ('aLICE', 'x', 1, 'plm1qb', 0, 0, '2026-01-01 00:00:00')")
+
+
+def _alembic(db_path: Path, *args: str) -> None:
+    env = {**os.environ, "DATABASE_URL": f"sqlite+aiosqlite:///{db_path}"}
+    result = subprocess.run(
+        [sys.executable, "-m", "alembic", *args], cwd=_ROOT, env=env, capture_output=True, text=True, timeout=120
+    )
+    assert result.returncode == 0, f"alembic {' '.join(args)} failed:\n{result.stderr[-3000:]}"
+
+
+def test_pending_transaction_txids_table_matches_the_model(migrated_db):
+    """B-77 (DAT-70): the migrated table has the model's columns, the unique txid and the
+    index on the owning row."""
+    from app.db.models import PendingTransactionTxid
+
+    with sqlite3.connect(migrated_db) as conn:
+        columns = {row[1]: row for row in conn.execute("PRAGMA table_info(pending_transaction_txids)")}
+        sql = conn.execute("SELECT sql FROM sqlite_master WHERE name = 'pending_transaction_txids'").fetchone()[0]
+        indexes = {row[1] for row in conn.execute("PRAGMA index_list(pending_transaction_txids)")}
+    assert set(columns) == {c.name for c in PendingTransactionTxid.__table__.columns}
+    assert "unique" in sql.lower()
+    assert "ix_pending_transaction_txids_pending_transaction_id" in indexes
+
+
+def test_existing_pending_transactions_are_backfilled_with_the_txids_they_remember(tmp_path):
+    """B-77 (DAT-70): upgrading a database that already has rows records each one's
+    current txid with its raw transaction, and the txid a bump replaced with an empty
+    raw_hex — and the expression indexes survive the step."""
+    db_path = tmp_path / "old.db"
+    _alembic(db_path, "upgrade", "477bddae1a84")
+    with sqlite3.connect(db_path) as conn:
+        columns = (
+            "(kind, current_txid, fee_rate_sat_vb, raw_tx_hex, broadcast_at, last_broadcast_at, status, "
+            "replaced_by_txid, attempt_count, updated_at)"
+        )
+        stamp = "'2026-01-01 00:00:00'"
+        conn.execute(
+            f"INSERT INTO pending_transactions {columns} VALUES "
+            f"('bet', 'cc', 2, 'rawcc', {stamp}, {stamp}, 'pending', 'bb', 2, {stamp})"
+        )
+        conn.execute(
+            f"INSERT INTO pending_transactions {columns} VALUES "
+            f"('withdrawal', 'dd', 1, 'rawdd', {stamp}, {stamp}, 'building', NULL, 1, {stamp})"
+        )
+    _alembic(db_path, "upgrade", "head")
+    with sqlite3.connect(db_path) as conn:
+        rows = sorted(conn.execute("SELECT pending_transaction_id, txid, raw_hex FROM pending_transaction_txids"))
+    assert rows == [(1, "bb", ""), (1, "cc", "rawcc"), (2, "dd", "rawdd")]
+    assert _index_sql(db_path, "ix_rounds_single_active") is not None
+    assert _index_sql(db_path, "ix_users_username_lower") is not None