Polish /report-bug's visual design and refine bug report semantics

Design pass on the bug report page, staying inside the site's existing
design system (tokens, IBM Plex Sans, card/badge/pill components, stroke
icon set) rather than introducing a new one:
- A slim top bar (brand mark + back-to-home pill button + language switcher)
  replaces the bare floating heading, so the page reads as part of the
  product instead of an orphaned form.
- The "write in English" notice moves inside the form card, right above the
  field it applies to, and switches from the amber "needs attention" tone to
  an accent-tinted info tone, so it doesn't visually collide with the
  bug-status badges' own use of amber for "not read yet".
- "Your reports" is promoted to a proper labeled section with a cleaner row
  layout (truncated description with a title tooltip, compact date).
- A character counter on the description field.
- The back-to-home control is now a bordered pill with an arrow icon instead
  of a bare text link with a hardcoded "←", which also meant dropping that
  hardcoded arrow from all 7 translations.

Also, two content refinements based on feedback:
- Max description length dropped from 5000 to 2000 characters, enforced on
  both the textarea and the API's Pydantic validator.
- The "read" status is relabeled from a passive "read"/"letta" to an active
  "acknowledged"/"presa in carico" (and each other language's own equivalent
  helpdesk term) — it communicates a team is on it, not just that someone
  glanced at it. Only the label changed; the underlying "read" status value
  in the API/DB is untouched.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

BUGS.md

@@ -1,75 +0,0 @@
-# Known bugs
-
-A second full-codebase audit on 2026-07-27 found **25 further issues** (4 critical, 6 high,
-7 medium, 8 low), listed below as B-48 … B-49. B-25 through B-47 are fixed (see "Previously
-fixed" below) — no Critical-, High- or Medium-severity finding remains open; the remaining 2 are
-Low/hygiene. The 139-test suite was green at the time of the audit, so none of these were caught
-by existing coverage — every fix lands with a regression test (the twenty-three fixes so far
-brought the suite from 139 to 248).
-
-The recurring pattern across the open findings is worth stating once: the code is rigorous
-about the failure modes that have actually been hit, and silent about the ones that have not.
-The payout phase is now fully recoverable; the "drawing" phase (waiting on a block) is now
-observable (B-36) but still has no equivalent resume-after-restart — see "Known gaps / TODO"
-in [CLAUDE.md](CLAUDE.md), which is also where other by-design limitations (single-shared-token
-admin auth, single-process assumptions, no user-facing history, etc.) are documented.
-
----
-
-## Low / hygiene
-
-### B-48 — No cap on input count in `select_utxos`
-
-A user with hundreds of small UTXOs builds a huge transaction whose fee — deducted from the bet
-amount — materially erodes their contribution to the pool, and it can exceed standardness
-limits.
-**Fix:** cap the selected inputs (e.g. 50) and fail with a translatable error suggesting a
-consolidation, or consolidate the address automatically when the count crosses a threshold.
-
-### B-49 — Rollback paths do not publish an SSE update
-
-`bets/service.py:_release_failed_bet` and `withdrawals/service.py:_release_failed_withdrawal`
-restore the balance without calling `broadcaster.publish()`, so dashboards only find out on
-their next poll.
-**Fix:** one `broadcaster.publish()` at the end of each, as every other state-changing path
-already does.
-
----
-
-## Previously fixed
-
-- **B-25** — the payout had no two-phase write, unlike bets and withdrawals
-- **B-26** — a payout failure or a process restart could wedge a round in `paying_out` forever
-- **B-27** — an RBF bump reset the reconciler's own abandon clock, so a repeatedly-bumped tx was never abandoned
-- **B-28** — a hostile Electrum server (or a MITM) could single-handedly pick the round's winner
-- **B-29** — a UTXO absent from one server's `listunspent` was marked spent immediately, irreversibly, on a single unauthenticated reply
-- **B-30** — a lost scripthash subscription meant a user's deposits were never credited, with no periodic safety net
-- **B-31** — resubscribing on reconnect ran serially before anything else started, freezing the chain tip (and so an in-flight draw) for the whole sweep
-- **B-42** — Swagger/ReDoc/the raw OpenAPI JSON enumerated the entire API surface, admin endpoints included, to anyone who requested them; now off by default and gated behind `ENABLE_API_DOCS`
-- **B-43** — the Caddyfile sent no CSP, no `X-Frame-Options`/`frame-ancestors`, and no HSTS, on a page whose JWT lives in `localStorage`
-- **B-44** — README's Quick start documented a bare `uvicorn --reload` workflow, and `docs/running-the-server.md` still had a matching "Locale / venv" section, both contradicting CLAUDE.md's Docker-only policy
-- **B-45** — `/admin/rounds`/`/admin/audit-log`'s `limit` had no bounds (`-1` means "everything" on SQLite), and `/admin/pending-transactions` had no limit or status filter at all
-- **B-46** — `secrets.compare_digest` on a `str` raises `TypeError` on non-ASCII input, turning an invalid admin token with non-ASCII characters into a 500 instead of a 403
-- **B-47** — `raw_tx_hex` and `payload_json` were unbounded `String` columns (`VARCHAR` with no length) — fine on SQLite/PostgreSQL, rejected by backends like MySQL that require a length
-- **B-32** — an RBF bump could retry forever below BIP125's relay-mandated minimum fee delta, with no ceiling on the fee rate either
-- **B-33** — `POST /auth/login` had no rate limiting, so a password could be brute-forced against an enumerable username list
-- **B-34** — password change/reset didn't invalidate already-issued JWTs, so a stolen token survived a change meant to lock it out
-- **B-35** — API timestamps round-tripped as naive datetimes, so the frontend parsed them as local time instead of UTC
-- **B-36** — a stalled draw wait had no timeout, no log, and no audit trail, so a frozen round showed nothing in `/admin`
-- **B-37** — a withdrawal covered by unconfirmed change answered "insufficient balance" instead of distinguishing it from actually having no funds
-- **B-38** — the SSE subscriber cap was global, so one client opening enough connections degraded every other user to polling
-- **B-39** — SQLite ran without WAL or a `busy_timeout`, so a writer could block every reader and a second writer failed immediately instead of waiting
-- **B-40** — `bump_fee` held a DB session open across N slow network calls, and computed a prevout's value from a server-reported float instead of an exact integer
-- **B-41** — confirmation/reconciliation depended on a verbose `blockchain.transaction.get` reply many Electrum servers reject, and abandonment relied on fragile substring-matching of an error message
-
-See git history for the fix-by-fix breakdown (commits `f13f685`, `50a43ae`, `933760e`, and the
-B-28/B-29/B-30/B-31/B-32/B-33/B-34/B-35/B-36/B-37/B-38/B-39/B-40/B-41/B-42/B-43/B-44/B-45/B-46/B-47 fixes). Suite grew from 139 to 248 tests over the twenty-three.
-
-A full-codebase audit on 2026-07-26 (commit `d4e0974`) found 24 bugs across every Python
-module under `app/`, both static frontends, and the Docker/Caddy deployment — 5 critical,
-7 high, 7 medium, 5 low. All 24 were fixed and verified against the current code on
-2026-07-27; the fixes are covered by the regression suite (grew from 79 to 139 tests) and
-five of them were additionally confirmed against a real mainnet deployment (see git history
-between `fb734bb` (documenting the findings) and `845ba98` (recording the audit outcome) for
-the fix-by-fix breakdown — each commit message names the bugs it closes and where their
-tests live).

CLAUDE.md

@@ -8,11 +8,11 @@ The user communicates in Italian in chat — reply to them in Italian. Everythin
 
 ## Project status
 
-All 10 stages of the original build order are code-complete and unit-tested — 185 tests, all under `tests/unit/` (`tests/integration/` is an empty package). Beyond them: Docker + Caddy deployment, admin dashboard (`/admin`), static test UI (`/`), pending-inclusive balance display, an SSE push channel layered over the original polling, self-service password change + admin password reset, and the reconciliation/corroboration machinery below.
+All 10 stages of the original build order are code-complete and unit-tested — 253 tests, all under `tests/unit/` (`tests/integration/` is an empty package). Beyond them: Docker + Caddy deployment, admin dashboard (`/admin`), static test UI (`/`), pending-inclusive balance display, an SSE push channel layered over the original polling, self-service password change + admin password reset, and the reconciliation/corroboration machinery below.
 
 Verified on mainnet with real money: registration + address derivation, deposit crediting (1-conf), a real 10 PLM bet (broadcast → confirmed → change credited back), and one full round cycle (close → draw on a real block hash → 70/30 payout with sat math checked against the broadcast tx → confirmation → close → next round auto-opened). **Withdrawal and the RBF bump path have never been exercised against a live broadcast** — unit-tested only.
 
-**Read [BUGS.md](BUGS.md) before trusting any behaviour here.** Two audits: 2026-07-26 found 24 bugs (5 critical), all fixed; 2026-07-27 found 25 more (B-25 … B-49), of which **2 are still open** — no Critical, High or Medium remains, only Low/hygiene: no cap on input count in `select_utxos` (B-48) and rollback paths not publishing an SSE update (B-49). BUGS.md is the live open list with a proposed fix per finding; "Known gaps" at the end of this file is for limitations accepted **by design** instead. Don't fix a BUGS.md item silently as a side effect of other work — each fix lands with its own regression test.
+Two full-codebase audits — 2026-07-26 (24 findings, 5 critical) and 2026-07-27 (25 more, B-25 … B-49) — are **all fixed** as of 2026-07-27, each with its own regression test. They were tracked in a `BUGS.md` that was deleted once the list emptied, so the ~276 `B-nn` markers left in comments across the code are pointers into git history (`git log --all --grep 'B-nn'` finds the commit that fixed one, and `git show f1a1145:BUGS.md`-style the file as it stood). A closed list is not the same as no bugs: the suite is unit-only (`tests/integration/` is empty), and withdrawal and the RBF bump have never been live-broadcast. "Known gaps" at the end of this file is for limitations accepted **by design** instead. A new finding gets the next B-nn, in its own commit with its own regression test.
 
 Before writing code, read the "Architecture" section below in full plus the diagrams in [flowchart/](flowchart/): [platform-overview.mmd](flowchart/platform-overview.mmd) (the 5-phase flow) and [round-lifecycle.mmd](flowchart/round-lifecycle.mmd) (the round/draw lifecycle). Every node **and edge label** (conditions, retries, loops) is a behaviour that must be implemented as described. Regenerate the companion PDFs with `flowchart/render-pdf.sh <file>.mmd` after editing either.
 
@@ -33,7 +33,7 @@ PYTHONPATH=. python scripts/decrypt_master_key.py     # ops recovery: decrypt+pr
 PYTHONPATH=. python scripts/encrypt_master_key.py     # ops bootstrap: import an externally-generated xprv (--overwrite to replace)
 PYTHONPATH=. python scripts/electrum_smoke_test.py    # manual check: connect, handshake, subscribe to headers, print the tip
 
-python -m pytest                                      # all 185 tests
+python -m pytest                                      # all 253 tests
 python -m pytest tests/unit/test_hd.py                # one file
 python -m pytest tests/unit/test_hd.py::test_derivation_is_deterministic   # one test
 ```
@@ -91,6 +91,7 @@ Source of truth: the `PalladiumWallet` repo — [ChainProfiles.cs](../PalladiumW
 | Min deposit | none | — |
 | Min password length | 8 | `auth/security.py:MIN_PASSWORD_LENGTH` |
 | Confirmations, every tx kind | **1** | hardcoded in `tx/confirmation.py` |
+| Max inputs per tx | 50 (`MAX_TX_INPUTS`, B-48) — over it the build fails with `too_many_inputs`, it never spends more | hardcoded in `wallet/psbt_builder.py` |
 
 `GET /rounds/current`'s `jackpot_sats` is the winner's 70% share, not the whole pool, and the pool is summed from the participants' actual `bet_amount_sats` (each already net of its own bet fee) rather than `count × current bet amount` — editing the bet amount mid-round must not move an in-progress round's advertised jackpot (B-11).
 
@@ -180,7 +181,7 @@ At 120s blocks that's ~4–6 min worst case (last bet confirms right at the dead
 
 `GET /rounds/stream` is **additive to** the polling loops in the two SPAs, not a replacement — a blocked or dropped stream just degrades to the old behaviour. No payload, no auth: it's a "something changed, go refetch" ping, with all personalization (e.g. `user_played`) staying in the authenticated REST endpoints. The generator re-checks `request.is_disconnected()` every 5s and sends a keep-alive comment every 20s, so neither a client that vanished without a clean close nor a proxy idle timeout breaks it silently.
 
-`rounds/events.py`'s `RoundEventBroadcaster` (singleton `broadcaster`) is in-process pub/sub, one `asyncio.Queue(maxsize=1)` per client so redundant notifications coalesce. `publish()` is called on: a round opening (`rounds/service.py`), every status transition (`scheduler.py`), a bet or withdrawal broadcast, any pending tx confirming (`tx/confirmation.py`), a deposit credited (`deposits/service.py`), and a new tip arriving (`electrum/listener.py` — exactly what the drawing phase waits on). Rollback paths are the known exception (B-49).
+`rounds/events.py`'s `RoundEventBroadcaster` (singleton `broadcaster`) is in-process pub/sub, one `asyncio.Queue(maxsize=1)` per client so redundant notifications coalesce. `publish()` is called on: a round opening (`rounds/service.py`), every status transition (`scheduler.py`), a bet or withdrawal broadcast, any pending tx confirming (`tx/confirmation.py`), a deposit credited (`deposits/service.py`), and a new tip arriving (`electrum/listener.py` — exactly what the drawing phase waits on). The rollback paths (`_release_failed_bet`, `_release_failed_withdrawal`, the reconciler's abandon) publish too — a rollback moves as much state as the success path, so it must ping the dashboards the same way (B-49).
 
 Deliberate scope limits, not oversights: **single-process only** (fine for one uvicorn process; a multi-worker deployment needs e.g. Redis pub/sub — don't add it speculatively); **generic broadcast, not per-user** (everyone refetches on every event; acceptable at ~100 concurrent users, and a targeted channel would need auth on the stream plus server-side knowledge of who each event affects); `MAX_SUBSCRIBERS` (500) is defensive only — past it the endpoint returns 503 and `EventSource` falls back to polling, which being global and unauthenticated makes the cap itself a cheap DoS of the realtime feature (B-38).
 
@@ -209,12 +210,13 @@ Two static SPAs served directly by FastAPI (`main.py` mounts `app/static/` and a
 
 Both talk to the same JSON API; there's no admin/user API split beyond `require_admin`.
 
-## Internationalization (`/` only)
+## Internationalization (`/` and `/report-bug`)
 
-`app/static/i18n.js` holds every user-facing string of `/` in 7 languages (en, it, es, fr, de, ru, zh) as one flat `TRANSLATIONS` table — no build step, no fetch, loaded before `app.js` so `t()` is always available. Language: `localStorage.plm_lang` → `navigator.language` → `en`. The switcher sits in the **chain-bar, not the navbar**, deliberately: the navbar is hidden until login, which would leave the landing page and login form untranslatable for exactly the users who need it.
+`app/static/i18n.js` holds every user-facing string of `/` and `/report-bug` in 7 languages (en, it, es, fr, de, ru, zh) as one flat `TRANSLATIONS` table — no build step, no fetch. `/` loads it before `app.js`; `/report-bug` loads it before its own inline script — either way `t()` is always available by the time it's called. Language: `localStorage.plm_lang` → `navigator.language` → `en`, shared across both pages since they read/write the same `localStorage` key. On `/` the switcher sits in the **chain-bar, not the navbar**, deliberately: the navbar is hidden until login, which would leave the landing page and login form untranslatable for exactly the users who need it. `/report-bug` has no navbar at all, so its switcher is just a top-right bar of its own.
 
-- Static markup is translated by attribute (`data-i18n`, plus `-html`, `-placeholder`, `-title`, `-aria-label`, `-alt`) via `applyStaticTranslations(root?)`; anything rendered from server data uses `t()` in `app.js` and is re-rendered by `onLanguageChange()`. An element belongs to one camp or the other, **never both**, or the two mechanisms overwrite each other — that's why `#bet-btn` has no `data-i18n`: its label carries the configurable bet amount, so `renderBetButton()` owns it.
+- Static markup is translated by attribute (`data-i18n`, plus `-html`, `-placeholder`, `-title`, `-aria-label`, `-alt`) via `applyStaticTranslations(root?)`; anything rendered from server data uses `t()` directly (`app.js`'s `onLanguageChange()`, `report-bug.html`'s own inline equivalent) and is re-rendered on a language switch. An element belongs to one camp or the other, **never both**, or the two mechanisms overwrite each other — that's why `#bet-btn` has no `data-i18n`: its label carries the configurable bet amount, so `renderBetButton()` owns it.
 - **Every language must have exactly the same key set.** There is no fallback beyond `en`; a missing key renders as the raw key string.
+- `/report-bug`'s `bugReport.englishNotice` string is itself translated into all 7 languages — it just always *says*, in whichever language the visitor reads, to write the actual bug description in English (so the admin panel, which is Italian-operator-facing and untranslated, doesn't end up with reports in 7 different languages).
 - `/admin` is intentionally untranslated (operator-facing, Italian), as is `/guida`.
 
 **API error contract** (`app/api/errors.py`) — the API is single-language by design. Failures answer with a structured `detail`: `{"code", "message", "params"}`, where `message` is English for non-dashboard consumers and `code` is what the frontend maps to `error.<code>` in `i18n.js` (falling back to `message` for an unknown code). `BetError`/`WithdrawalError` subclass `ApiError` and carry the code from where the failure happens. Even the catch-all 500 handler answers in that shape (`internal_error`), so clients never special-case unexpected errors, and the exception text stays in `logs/app.log`. Adding a user-facing error: give it a code, add `error.<code>` to all 7 languages, and pass values through `params` (amounts as `*_sats` — the frontend derives a `*_plm` sibling) instead of baking them into English text.
@@ -233,7 +235,7 @@ Explicit design choices, not derivable from any single file — respect them:
 
 ## Known gaps / TODO
 
-Accepted **by design**. For actual bugs see [BUGS.md](BUGS.md) (2 open) — not duplicated here.
+Accepted **by design** — distinct from the audit findings above (all fixed), which are not duplicated here.
 
 - **`drawing` doesn't resume after a restart.** `_tick()` handles `open`, `closing` and `paying_out` (the last via `_retry_payout_if_due`); nothing re-enters `_wait_for_next_block` after a crash. That wait is unbounded by design (the draw's entropy genuinely depends on a future block) but no longer silent — past `_DRAW_STALL_THRESHOLD_SECONDS` it logs progress and writes a `draw_stalled` audit entry, and `GET /rounds/current`'s `draw_waiting_since` surfaces it live (B-36). Restart-resumption itself remains the last prerequisite for running unattended.
 - **RBF handles one shape only**: a single change output, back to the tx's own sender, big enough to absorb the increase. No extra-input fallback — an exact-amount tx or too-small change raises `RbfError`. Not permanent, though: an unbumpable tx that never confirms is eventually abandoned and its UTXOs released.

app/api/routes/admin.py

@@ -10,7 +10,7 @@ from app.api.timeutil import isoformat_utc
 from app.audit.log import write_audit_log
 from app.auth.security import hash_password
 from app.config import settings
-from app.db.models import AuditLog, PendingTransaction, Round, User
+from app.db.models import AuditLog, BugReport, PendingTransaction, Round, User
 from app.db.session import get_session
 from app.rounds.config import get_round_config
 from app.wallet.address import is_valid_plm_address
@@ -346,3 +346,74 @@ async def list_pending_transactions(
         )
         for p in entries
     ]
+
+
+_BUG_REPORT_STATUSES = ("open", "read", "resolved")
+
+
+class AdminBugReportResponse(BaseModel):
+    id: int
+    description: str
+    contact: str | None
+    user_id: int | None
+    username: str | None
+    status: str
+    created_at: str
+
+
+def _bug_report_response(report: BugReport, username: str | None) -> AdminBugReportResponse:
+    return AdminBugReportResponse(
+        id=report.id,
+        description=report.description,
+        contact=report.contact,
+        user_id=report.user_id,
+        username=username,
+        status=report.status,
+        created_at=isoformat_utc(report.created_at),
+    )
+
+
+@router.get(
+    "/bug-reports", response_model=list[AdminBugReportResponse], dependencies=[Depends(require_admin)]
+)
+async def list_bug_reports(
+    session: AsyncSession = Depends(get_session), limit: int = Query(default=200, ge=1, le=500)
+) -> list[AdminBugReportResponse]:
+    reports = (await session.scalars(select(BugReport).order_by(BugReport.id.desc()).limit(limit))).all()
+    user_ids = {r.user_id for r in reports if r.user_id is not None}
+    usernames = {}
+    if user_ids:
+        users = (await session.scalars(select(User).where(User.id.in_(user_ids)))).all()
+        usernames = {u.id: u.username for u in users}
+
+    return [
+        _bug_report_response(r, usernames.get(r.user_id) if r.user_id is not None else None)
+        for r in reports
+    ]
+
+
+class BugReportStatusUpdate(BaseModel):
+    status: str = Field(pattern="^(open|read|resolved)$")
+
+
+@router.post(
+    "/bug-reports/{report_id}/status",
+    response_model=AdminBugReportResponse,
+    dependencies=[Depends(require_admin)],
+)
+async def update_bug_report_status(
+    report_id: int, body: BugReportStatusUpdate, session: AsyncSession = Depends(get_session)
+) -> AdminBugReportResponse:
+    report = await session.get(BugReport, report_id)
+    if report is None:
+        raise HTTPException(status.HTTP_404_NOT_FOUND, "bug report not found")
+
+    report.status = body.status
+    await session.commit()
+
+    username = None
+    if report.user_id is not None:
+        user = await session.get(User, report.user_id)
+        username = user.username if user is not None else None
+
+    return _bug_report_response(report, username)

app/api/routes/bug_reports.py

@@ -0,0 +1,79 @@
+from fastapi import APIRouter, Depends, status
+from pydantic import BaseModel, Field, field_validator
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.api.timeutil import isoformat_utc
+from app.auth.dependencies import get_current_user, get_optional_user
+from app.db.models import BugReport, User
+from app.db.session import get_session
+
+router = APIRouter(prefix="/bug-reports", tags=["bug-reports"])
+
+
+class BugReportCreate(BaseModel):
+    description: str = Field(min_length=1, max_length=2000)
+    contact: str | None = Field(default=None, max_length=256)
+
+    @field_validator("description")
+    @classmethod
+    def _description_not_blank(cls, value: str) -> str:
+        value = value.strip()
+        if not value:
+            raise ValueError("description must not be blank")
+        return value
+
+    @field_validator("contact")
+    @classmethod
+    def _contact_stripped(cls, value: str | None) -> str | None:
+        if value is None:
+            return None
+        value = value.strip()
+        return value or None
+
+
+class BugReportResponse(BaseModel):
+    id: int
+
+
+@router.post("", response_model=BugReportResponse, status_code=status.HTTP_201_CREATED)
+async def create_bug_report(
+    body: BugReportCreate,
+    user: User | None = Depends(get_optional_user),
+    session: AsyncSession = Depends(get_session),
+) -> BugReportResponse:
+    report = BugReport(
+        description=body.description,
+        contact=body.contact,
+        user_id=user.id if user is not None else None,
+    )
+    session.add(report)
+    await session.commit()
+    return BugReportResponse(id=report.id)
+
+
+class MyBugReportResponse(BaseModel):
+    id: int
+    description: str
+    status: str
+    created_at: str
+
+
+@router.get("/mine", response_model=list[MyBugReportResponse])
+async def list_my_bug_reports(
+    user: User = Depends(get_current_user),
+    session: AsyncSession = Depends(get_session),
+) -> list[MyBugReportResponse]:
+    """The one user-facing history view for bug reports (anonymous submissions have
+    no user to attribute this to, so this only ever covers ones filed while logged in)."""
+    reports = (
+        await session.scalars(
+            select(BugReport).where(BugReport.user_id == user.id).order_by(BugReport.id.desc())
+        )
+    ).all()
+    return [
+        MyBugReportResponse(
+            id=r.id, description=r.description, status=r.status, created_at=isoformat_utc(r.created_at)
+        )
+        for r in reports
+    ]

app/api/routes/rounds.py

@@ -15,7 +15,7 @@ from app.db.models import RoundParticipant, User
 from app.db.session import get_session
 from app.rounds.config import get_round_config
 from app.rounds.events import EVICTED, RoundEventCapacityError, broadcaster
-from app.rounds.service import get_active_round
+from app.rounds.service import get_active_round, winner_share
 
 router = APIRouter(prefix="/rounds", tags=["rounds"])
 
@@ -165,7 +165,7 @@ async def current_round(
     # upper bound by the payout tx's own fee, which is deducted from the winner's
     # share and isn't knowable until the payout is built — a few hundred sat on a
     # 1 sat/vB payout, i.e. invisible at PLM amounts, but it is not exact.
-    jackpot_sats = pool_amount_sats * 70 // 100
+    jackpot_sats = winner_share(pool_amount_sats)
 
     return CurrentRoundResponse(
         server_time=datetime.now(timezone.utc).isoformat(),

app/bets/service.py

@@ -62,7 +62,7 @@ async def place_bet(session: AsyncSession, client: ElectrumClient, user: User) -
             fee_rate_sat_vb=config.fee_rate_sat_vb,
         )
     except InsufficientFundsError as exc:
-        raise BetError(exc.code, str(exc)) from exc
+        raise BetError(exc.code, str(exc), **exc.params) from exc
 
     # --- Phase 1: record the intent, *then* broadcast (B-08) --------------------
     # Broadcasting first meant a failure (or a crash) between the broadcast and the
@@ -144,6 +144,11 @@ async def _release_failed_bet(
         user_id=user_id,
     )
     await session.commit()
+    # The rollback moved as much state as the successful path did — the balance is
+    # back, the participant is gone, so participant_count and jackpot shrank again.
+    # Without this the dashboards kept showing the phantom bet until their next poll
+    # (B-49); the reconciler's own abandon path has always published here.
+    broadcaster.publish()
 
 
 def _pending_transaction(

app/db/models.py

@@ -188,6 +188,24 @@ class Withdrawal(Base):
     confirmed_at: Mapped[datetime | None] = mapped_column(default=None)
 
 
+class BugReport(Base):
+    __tablename__ = "bug_reports"
+
+    id: Mapped[int] = mapped_column(primary_key=True)
+    description: Mapped[str] = mapped_column(Text)
+    contact: Mapped[str | None] = mapped_column(String(256), default=None)
+    # Set when the reporter was logged in at submission time; the report page is
+    # reachable both logged-in and logged-out (like GET /rounds/current), so this
+    # stays nullable rather than requiring auth just to file a report.
+    user_id: Mapped[int | None] = mapped_column(ForeignKey("users.id"), default=None)
+    # open -> read -> resolved, admin-driven (app/api/routes/admin.py). "read" is a
+    # distinct step from "resolved" so a reporter checking their own status (only
+    # possible when logged in — see GET /bug-reports/mine) can tell "an admin has
+    # seen this" apart from "this has actually been fixed".
+    status: Mapped[str] = mapped_column(String(16), default="open")
+    created_at: Mapped[datetime] = mapped_column(default=utcnow)
+
+
 class AuditLog(Base):
     __tablename__ = "audit_log"
 

app/main.py

@@ -15,6 +15,7 @@ import app.rounds.confirmation  # noqa: F401  (registers the "payout" confirmati
 import app.withdrawals.confirmation  # noqa: F401  (registers the "withdrawal" confirmation handler)
 from app.api.routes.admin import router as admin_router
 from app.api.routes.bets import router as bets_router
+from app.api.routes.bug_reports import router as bug_reports_router
 from app.api.routes.qr import router as qr_router
 from app.api.routes.rounds import router as rounds_router
 from app.api.routes.users import router as users_router
@@ -41,7 +42,7 @@ def _make_electrum_client(endpoint: ElectrumEndpoint) -> ElectrumClient:
 
 @asynccontextmanager
 async def lifespan(app: FastAPI):
-    # Refuses to serve rather than starting up half-configured — see B-15 in BUGS.md.
+    # Refuses to serve rather than starting up half-configured (B-15).
     validate_runtime_secrets()
 
     endpoints = parse_endpoints(
@@ -99,6 +100,7 @@ app.include_router(users_router)
 app.include_router(bets_router)
 app.include_router(withdrawals_router)
 app.include_router(admin_router)
+app.include_router(bug_reports_router)
 app.include_router(qr_router)
 app.include_router(rounds_router)
 

app/rounds/scheduler.py

@@ -14,7 +14,7 @@ from app.electrum.scripthash import address_to_scripthash
 from app.rounds.config import get_round_config
 from app.rounds.draw import draw_winner, header_hex_to_block_hash
 from app.rounds.events import broadcaster
-from app.rounds.service import open_new_round_if_needed
+from app.rounds.service import open_new_round_if_needed, winner_share
 from app.wallet.hd import derive_pool_key
 from app.wallet.plm_network import PLM_MAINNET
 from app.wallet.psbt_builder import InsufficientFundsError, Utxo, build_payout_transaction
@@ -338,8 +338,8 @@ class RoundScheduler:
             await self._log_payout_failure(round_id, winner_user_id, "winner user not found")
             return
 
-        winner_share = pool_amount_sats * 70 // 100
-        commission_share = pool_amount_sats - winner_share  # remainder from rounding goes to fees
+        winner_sats = winner_share(pool_amount_sats)
+        commission_share = pool_amount_sats - winner_sats  # remainder from rounding goes to fees
 
         # --- Phase 2: build (network read only, no DB write yet) -----------------
         try:
@@ -358,15 +358,18 @@ class RoundScheduler:
                 from_script=pool_script_obj,
                 utxos=utxos,
                 winner_address=winner_address,
-                winner_share_sats=winner_share,
+                winner_share_sats=winner_sats,
                 fee_address=fee_address,
                 commission_sats=commission_share,
                 change_address=pool_address,
                 fee_rate_sat_vb=fee_rate,
             )
-        except InsufficientFundsError:
-            logger.exception("round %s payout failed: insufficient pool UTXOs", round_id)
-            await self._log_payout_failure(round_id, winner_user_id, "insufficient pool UTXOs")
+        except InsufficientFundsError as exc:
+            # Includes the B-48 "too_many_inputs" case: the pool holds enough, but spread
+            # over more UTXOs than one transaction may spend, so /admin has to say which.
+            reason = "insufficient pool UTXOs" if exc.code == "insufficient_balance" else exc.code
+            logger.exception("round %s payout failed: %s", round_id, reason)
+            await self._log_payout_failure(round_id, winner_user_id, reason)
             return
         except Exception:
             # Anything else — a malformed fee_address (EmbitError) or similar. This

app/rounds/service.py

@@ -18,6 +18,14 @@ _ACTIVE_STATUSES = ("open", "closing", "drawing", "paying_out")
 # broken in a way we don't anticipate.
 _OPEN_ROUND_ATTEMPTS = 3
 
+# 70% winner / 30% fees. Hardcoded by design (see CLAUDE.md) — changing the split
+# is a code change, not an admin-editable setting. Single source of truth so the
+# advertised jackpot (rounds.py) and the actual payout (scheduler.py) can't diverge.
+
+
+def winner_share(pool_amount_sats: int) -> int:
+    return pool_amount_sats * 70 // 100
+
 
 async def get_active_round(session: AsyncSession) -> Round | None:
     """The round currently in progress (in any non-closed state), if any. Rounds

app/static/admin.css

@@ -133,6 +133,7 @@ table { width: 100%; border-collapse: collapse; font-size: 0.85rem; }
 th, td { text-align: left; padding: 8px 6px; border-bottom: 1px solid var(--color-border); vertical-align: top; }
 th { color: var(--color-muted-foreground); font-weight: 500; }
 td.addr, td.txid { font-family: 'Fira Code', monospace; word-break: break-all; max-width: 200px; }
+td.payload-cell { max-width: 360px; white-space: pre-wrap; word-break: break-word; }
 .table-wrap { overflow-x: auto; }
 
 .badge {
@@ -144,6 +145,13 @@ td.addr, td.txid { font-family: 'Fira Code', monospace; word-break: break-all; m
   background: #FEF3C7; color: #92400E; border-color: #F59E0B;
 }
 
+.badge.bug-status-open { background: #FEF3C7; color: #92400E; border-color: #F59E0B; }
+.badge.bug-status-read { background: var(--color-background); color: var(--color-muted-foreground); }
+.badge.bug-status-resolved { background: var(--color-success-bg); color: var(--color-success); border-color: var(--color-success); }
+
+.bug-actions { display: flex; flex-wrap: wrap; gap: 6px; margin-top: 6px; }
+.bug-actions button { width: auto; margin-top: 0; min-height: 30px; padding: 4px 10px; font-size: 0.78rem; }
+
 button.reveal {
   width: auto; margin-top: 0; padding: 4px 10px; min-height: 30px; font-size: 0.78rem;
   background: var(--color-destructive-bg); color: var(--color-destructive); border: 1px solid var(--color-destructive);

app/static/admin.html

@@ -30,6 +30,7 @@
     <span class="nav-tab" id="nav-round" onclick="switchView('round')">Round</span>
     <span class="nav-tab" id="nav-pending" onclick="switchView('pending')">Transazioni pendenti</span>
     <span class="nav-tab" id="nav-audit" onclick="switchView('audit')">Audit log</span>
+    <span class="nav-tab" id="nav-bugreports" onclick="switchView('bugreports')">Segnalazioni bug</span>
     <span class="spacer"></span>
     <span class="chain-status-pill">
       <span class="status-dot" id="chain-status-dot"></span>
@@ -153,6 +154,22 @@
       </div>
     </div>
 
+    <div class="view" id="view-bugreports">
+      <h2 class="section-title">Segnalazioni bug</h2>
+      <p class="hint">Segnalazioni inviate dagli utenti tramite la pagina "Segnala un bug".</p>
+
+      <div class="card">
+        <div class="table-wrap">
+          <table>
+            <thead>
+              <tr><th>ID</th><th>Descrizione</th><th>Contatto</th><th>Utente</th><th>Quando</th><th>Stato</th></tr>
+            </thead>
+            <tbody id="bugreports-tbody"></tbody>
+          </table>
+        </div>
+      </div>
+    </div>
+
   </main>
 </div>
 

app/static/admin.js

@@ -89,8 +89,8 @@ function stopChainStatusPolling() {
   chainStatusInterval = null;
 }
 
-const VIEWS = ['parametri', 'utenti', 'round', 'pending', 'audit'];
-const VIEW_LOADERS = { utenti: loadUsers, round: loadRounds, pending: loadPending, audit: loadAuditLog };
+const VIEWS = ['parametri', 'utenti', 'round', 'pending', 'audit', 'bugreports'];
+const VIEW_LOADERS = { utenti: loadUsers, round: loadRounds, pending: loadPending, audit: loadAuditLog, bugreports: loadBugReports };
 let currentAdminView = 'parametri';
 
 function switchView(name) {
@@ -109,7 +109,7 @@ function showDashboard() {
 }
 
 async function loadDashboard() {
-  await Promise.all([adminLoadConfig(), loadUsers(), loadRounds(), loadPending(), loadAuditLog()]);
+  await Promise.all([adminLoadConfig(), loadUsers(), loadRounds(), loadPending(), loadAuditLog(), loadBugReports()]);
 }
 
 async function adminLogin() {
@@ -346,6 +346,49 @@ async function loadAuditLog() {
   }
 }
 
+const BUG_REPORT_STATUS_LABELS = { open: 'Da leggere', read: 'Presa in carico', resolved: 'Risolta' };
+
+function bugReportBadge(status) {
+  return `<span class="badge bug-status-${escapeHtml(status)}">${escapeHtml(BUG_REPORT_STATUS_LABELS[status] || status)}</span>`;
+}
+
+async function loadBugReports() {
+  try {
+    const reports = await callAdmin('GET', '/admin/bug-reports');
+    const tbody = document.getElementById('bugreports-tbody');
+    tbody.innerHTML = reports.map((r) => `
+      <tr>
+        <td>${r.id}</td>
+        <td class="payload-cell">${escapeHtml(r.description)}</td>
+        <td>${r.contact ? escapeHtml(r.contact) : '—'}</td>
+        <td>${r.username ? escapeHtml(r.username) : '—'}</td>
+        <td>${fmtDate(r.created_at)}</td>
+        <td>
+          ${bugReportBadge(r.status)}
+          <div class="bug-actions">
+            ${r.status === 'open' ? `<button class="secondary" onclick="setBugReportStatus(${r.id}, 'read', this)">Segna come presa in carico</button>` : ''}
+            ${r.status !== 'resolved' ? `<button class="secondary" onclick="setBugReportStatus(${r.id}, 'resolved', this)">Segna come risolta</button>` : ''}
+            ${r.status !== 'open' ? `<button class="secondary" onclick="setBugReportStatus(${r.id}, 'open', this)">Riapri</button>` : ''}
+          </div>
+        </td>
+      </tr>
+    `).join('') || '<tr><td colspan="6" class="hint">Nessuna segnalazione ricevuta.</td></tr>';
+  } catch (e) {
+    toast('Errore nel caricamento segnalazioni: ' + e.message, 'error');
+  }
+}
+
+async function setBugReportStatus(reportId, newStatus, button) {
+  await withLoading(button, '…', async () => {
+    try {
+      await callAdmin('POST', '/admin/bug-reports/' + reportId + '/status', { status: newStatus });
+      await loadBugReports();
+    } catch (e) {
+      toast('Errore: ' + e.message, 'error');
+    }
+  });
+}
+
 document.getElementById('admin-token').addEventListener('keydown', (e) => {
   if (e.key === 'Enter') adminLogin();
 });

app/static/app.js

@@ -488,11 +488,21 @@ async function refreshRound() {
       // myUserId may not be loaded yet on the very first tick after a reload
       // (refreshMe() and refreshRound() run concurrently) — fall back to the
       // persisted result rather than risk showing nothing or the wrong side.
+      // winner_user_id is committed as soon as the draw picks a winner, but
+      // winner_amount_sats isn't set until the payout tx is built afterwards
+      // (a real Electrum round-trip later) — revealing a win before then would
+      // show "+— PLM". Only the winner's own reveal needs to wait for it.
+      const iWon = myUserId != null && data.winner_user_id === myUserId;
+      const amountReady = !iWon || data.winner_amount_sats != null;
       const canReveal =
-        data.user_played && data.winner_user_id != null && (alreadyKnown || elapsedMs >= minMs) && myUserId != null;
+        data.user_played &&
+        data.winner_user_id != null &&
+        (alreadyKnown || elapsedMs >= minMs) &&
+        myUserId != null &&
+        amountReady;
 
       if (canReveal) {
-        const won = data.winner_user_id === myUserId;
+        const won = iWon;
         if (!alreadyKnown) {
           persistResult(data.round_id, won, data.winner_amount_sats);
           if (won) {

app/static/i18n.js

@@ -10,6 +10,26 @@ const TRANSLATIONS = {
     'nav.guideTitle': 'Guide',
     'nav.guideAria': 'Open the user guide',
     'nav.bugReport': 'Report a bug',
+    'bugReport.pageTitle': 'Report a bug',
+    'bugReport.heading': 'Report a bug',
+    'bugReport.intro': 'Found a problem? Describe it below — your report goes straight to the admin panel.',
+    'bugReport.englishNotice': "Please write your bug report in English, regardless of the language you're browsing in — this helps us handle it faster.",
+    'bugReport.descriptionLabel': 'What happened?',
+    'bugReport.descriptionPlaceholder': 'Describe the bug: what you were doing, what you expected, and what happened instead.',
+    'bugReport.contactLabel': 'Contact (optional)',
+    'bugReport.contactPlaceholder': "Email or other contact, if you'd like a reply",
+    'bugReport.submitBtn': 'Send report',
+    'bugReport.submitting': 'Sending…',
+    'bugReport.blankError': 'Describe the bug before sending.',
+    'bugReport.successToast': 'Thanks! Report sent.',
+    'bugReport.errorPrefix': 'Error sending: ',
+    'bugReport.myReportsTitle': 'Your reports',
+    'bugReport.myReportsHint': 'Only reports sent from this account, with the status set by the admin team.',
+    'bugReport.myReportsEmpty': "You haven't sent any reports yet.",
+    'bugReport.statusOpen': 'Not read yet',
+    'bugReport.statusRead': 'Acknowledged',
+    'bugReport.statusResolved': 'Resolved',
+    'bugReport.backLink': 'Back to home',
     'nav.logoutTitle': 'Log out',
     'nav.logoutAria': 'Log out of your account',
     'nav.deposit': 'Deposit',
@@ -135,6 +155,7 @@ const TRANSLATIONS = {
     'error.invalid_amount': 'Enter an amount greater than zero.',
     'error.broadcast_failed': 'The network refused the transaction. Please try again shortly.',
     'error.amount_below_dust_limit': 'The amount is too small to be sent.',
+    'error.too_many_inputs': 'Your balance is split across too many small deposits to be spent in a single transaction (max {max_inputs}). Please contact support to consolidate it.',
     'error.withdrawal_to_own_address': 'That is your own deposit address — withdraw to an external wallet.',
     'error.internal_error': 'Unexpected server error. Please try again shortly.',
     'error.guide_unavailable': 'The guide is not available right now.',
@@ -152,6 +173,26 @@ const TRANSLATIONS = {
     'nav.guideTitle': 'Guida',
     'nav.guideAria': 'Apri la guida utente',
     'nav.bugReport': 'Segnala un bug',
+    'bugReport.pageTitle': 'Segnala un bug',
+    'bugReport.heading': 'Segnala un bug',
+    'bugReport.intro': 'Hai trovato un problema? Descrivilo qui sotto: la segnalazione arriva direttamente al pannello di amministrazione.',
+    'bugReport.englishNotice': "Scrivi la segnalazione in inglese, indipendentemente dalla lingua che stai usando per navigare: questo ci aiuta a gestirla più velocemente.",
+    'bugReport.descriptionLabel': 'Cosa è successo?',
+    'bugReport.descriptionPlaceholder': 'Descrivi il bug: cosa stavi facendo, cosa ti aspettavi e cosa è successo invece.',
+    'bugReport.contactLabel': 'Contatto (opzionale)',
+    'bugReport.contactPlaceholder': 'Email o altro recapito, se vuoi essere ricontattato',
+    'bugReport.submitBtn': 'Invia segnalazione',
+    'bugReport.submitting': 'Invio…',
+    'bugReport.blankError': 'Descrivi il bug prima di inviare.',
+    'bugReport.successToast': 'Grazie! Segnalazione inviata.',
+    'bugReport.errorPrefix': "Errore nell'invio: ",
+    'bugReport.myReportsTitle': 'Le tue segnalazioni',
+    'bugReport.myReportsHint': "Solo le segnalazioni inviate da questo account, con lo stato aggiornato dall'amministrazione.",
+    'bugReport.myReportsEmpty': 'Non hai ancora inviato segnalazioni.',
+    'bugReport.statusOpen': 'Da leggere',
+    'bugReport.statusRead': 'Presa in carico',
+    'bugReport.statusResolved': 'Risolta',
+    'bugReport.backLink': 'Torna alla home',
     'nav.logoutTitle': 'Esci',
     'nav.logoutAria': "Esci dall'account",
     'nav.deposit': 'Deposito',
@@ -274,6 +315,7 @@ const TRANSLATIONS = {
     'error.invalid_amount': 'Inserisci un importo maggiore di zero.',
     'error.broadcast_failed': 'La rete ha rifiutato la transazione. Riprova tra poco.',
     'error.amount_below_dust_limit': "L'importo è troppo basso per essere inviato.",
+    'error.too_many_inputs': 'Il tuo saldo è suddiviso in troppi piccoli depositi per essere speso in una sola transazione (max {max_inputs}). Contatta l\'assistenza per consolidarlo.',
     'error.withdrawal_to_own_address': 'Questo è il tuo indirizzo di deposito — preleva verso un wallet esterno.',
     'error.internal_error': 'Errore inatteso del server. Riprova tra poco.',
     'error.guide_unavailable': 'La guida non è disponibile in questo momento.',
@@ -291,6 +333,26 @@ const TRANSLATIONS = {
     'nav.guideTitle': 'Guía',
     'nav.guideAria': 'Abrir la guía del usuario',
     'nav.bugReport': 'Reportar un error',
+    'bugReport.pageTitle': 'Reportar un error',
+    'bugReport.heading': 'Reportar un error',
+    'bugReport.intro': '¿Encontraste un problema? Descríbelo a continuación: el informe llega directamente al panel de administración.',
+    'bugReport.englishNotice': 'Escribe el informe en inglés, independientemente del idioma que estés usando para navegar: esto nos ayuda a gestionarlo más rápido.',
+    'bugReport.descriptionLabel': '¿Qué pasó?',
+    'bugReport.descriptionPlaceholder': 'Describe el error: qué estabas haciendo, qué esperabas y qué sucedió en su lugar.',
+    'bugReport.contactLabel': 'Contacto (opcional)',
+    'bugReport.contactPlaceholder': 'Correo u otro contacto, si quieres que te respondamos',
+    'bugReport.submitBtn': 'Enviar informe',
+    'bugReport.submitting': 'Enviando…',
+    'bugReport.blankError': 'Describe el error antes de enviarlo.',
+    'bugReport.successToast': '¡Gracias! Informe enviado.',
+    'bugReport.errorPrefix': 'Error al enviar: ',
+    'bugReport.myReportsTitle': 'Tus informes',
+    'bugReport.myReportsHint': 'Solo los informes enviados desde esta cuenta, con el estado actualizado por el equipo de administración.',
+    'bugReport.myReportsEmpty': 'Todavía no has enviado ningún informe.',
+    'bugReport.statusOpen': 'Sin leer',
+    'bugReport.statusRead': 'En curso',
+    'bugReport.statusResolved': 'Resuelto',
+    'bugReport.backLink': 'Volver al inicio',
     'nav.logoutTitle': 'Salir',
     'nav.logoutAria': 'Cerrar sesión',
     'nav.deposit': 'Depósito',
@@ -413,6 +475,7 @@ const TRANSLATIONS = {
     'error.invalid_amount': 'Introduce un importe mayor que cero.',
     'error.broadcast_failed': 'La red rechazó la transacción. Inténtalo de nuevo en un momento.',
     'error.amount_below_dust_limit': 'El importe es demasiado pequeño para enviarse.',
+    'error.too_many_inputs': 'Tu saldo está repartido en demasiados depósitos pequeños para gastarse en una sola transacción (máx. {max_inputs}). Contacta con soporte para consolidarlo.',
     'error.withdrawal_to_own_address': 'Esa es tu propia dirección de depósito — retira a una cartera externa.',
     'error.internal_error': 'Error inesperado del servidor. Inténtalo de nuevo en un momento.',
     'error.guide_unavailable': 'La guía no está disponible en este momento.',
@@ -430,6 +493,26 @@ const TRANSLATIONS = {
     'nav.guideTitle': 'Guide',
     'nav.guideAria': "Ouvrir le guide de l'utilisateur",
     'nav.bugReport': 'Signaler un bug',
+    'bugReport.pageTitle': 'Signaler un bug',
+    'bugReport.heading': 'Signaler un bug',
+    'bugReport.intro': "Vous avez trouvé un problème ? Décrivez-le ci-dessous : le signalement arrive directement dans le panneau d'administration.",
+    'bugReport.englishNotice': "Rédigez votre signalement en anglais, quelle que soit la langue que vous utilisez pour naviguer : cela nous aide à le traiter plus rapidement.",
+    'bugReport.descriptionLabel': "Que s'est-il passé ?",
+    'bugReport.descriptionPlaceholder': "Décrivez le bug : ce que vous faisiez, ce que vous attendiez et ce qui s'est passé à la place.",
+    'bugReport.contactLabel': 'Contact (facultatif)',
+    'bugReport.contactPlaceholder': 'Email ou autre contact, si vous souhaitez une réponse',
+    'bugReport.submitBtn': 'Envoyer le signalement',
+    'bugReport.submitting': 'Envoi…',
+    'bugReport.blankError': "Décrivez le bug avant d'envoyer.",
+    'bugReport.successToast': 'Merci ! Signalement envoyé.',
+    'bugReport.errorPrefix': "Erreur lors de l'envoi : ",
+    'bugReport.myReportsTitle': 'Vos signalements',
+    'bugReport.myReportsHint': "Seulement les signalements envoyés depuis ce compte, avec le statut mis à jour par l'équipe d'administration.",
+    'bugReport.myReportsEmpty': "Vous n'avez encore envoyé aucun signalement.",
+    'bugReport.statusOpen': 'Non lu',
+    'bugReport.statusRead': 'Prise en charge',
+    'bugReport.statusResolved': 'Résolu',
+    'bugReport.backLink': "Retour à l'accueil",
     'nav.logoutTitle': 'Se déconnecter',
     'nav.logoutAria': 'Se déconnecter du compte',
     'nav.deposit': 'Dépôt',
@@ -552,6 +635,7 @@ const TRANSLATIONS = {
     'error.invalid_amount': 'Saisissez un montant supérieur à zéro.',
     'error.broadcast_failed': 'Le réseau a refusé la transaction. Veuillez réessayer dans un instant.',
     'error.amount_below_dust_limit': "Le montant est trop faible pour être envoyé.",
+    'error.too_many_inputs': 'Votre solde est réparti sur trop de petits dépôts pour être dépensé en une seule transaction (max {max_inputs}). Contactez le support pour le consolider.',
     'error.withdrawal_to_own_address': "C'est votre propre adresse de dépôt — retirez vers un portefeuille externe.",
     'error.internal_error': 'Erreur inattendue du serveur. Veuillez réessayer dans un instant.',
     'error.guide_unavailable': "Le guide n'est pas disponible pour le moment.",
@@ -569,6 +653,26 @@ const TRANSLATIONS = {
     'nav.guideTitle': 'Anleitung',
     'nav.guideAria': 'Benutzerhandbuch öffnen',
     'nav.bugReport': 'Fehler melden',
+    'bugReport.pageTitle': 'Fehler melden',
+    'bugReport.heading': 'Fehler melden',
+    'bugReport.intro': 'Ein Problem gefunden? Beschreibe es unten — die Meldung geht direkt an das Admin-Panel.',
+    'bugReport.englishNotice': 'Bitte schreibe die Fehlermeldung auf Englisch, unabhängig von der Sprache, die du gerade verwendest — das hilft uns, sie schneller zu bearbeiten.',
+    'bugReport.descriptionLabel': 'Was ist passiert?',
+    'bugReport.descriptionPlaceholder': 'Beschreibe den Fehler: was du getan hast, was du erwartet hast und was stattdessen passiert ist.',
+    'bugReport.contactLabel': 'Kontakt (optional)',
+    'bugReport.contactPlaceholder': 'E-Mail oder anderer Kontakt, falls du eine Antwort möchtest',
+    'bugReport.submitBtn': 'Meldung senden',
+    'bugReport.submitting': 'Senden…',
+    'bugReport.blankError': 'Beschreibe den Fehler, bevor du sendest.',
+    'bugReport.successToast': 'Danke! Meldung gesendet.',
+    'bugReport.errorPrefix': 'Fehler beim Senden: ',
+    'bugReport.myReportsTitle': 'Deine Meldungen',
+    'bugReport.myReportsHint': 'Nur Meldungen, die von diesem Konto gesendet wurden, mit dem vom Admin-Team aktualisierten Status.',
+    'bugReport.myReportsEmpty': 'Du hast noch keine Meldungen gesendet.',
+    'bugReport.statusOpen': 'Ungelesen',
+    'bugReport.statusRead': 'In Bearbeitung',
+    'bugReport.statusResolved': 'Gelöst',
+    'bugReport.backLink': 'Zurück zur Startseite',
     'nav.logoutTitle': 'Abmelden',
     'nav.logoutAria': 'Vom Konto abmelden',
     'nav.deposit': 'Einzahlung',
@@ -691,6 +795,7 @@ const TRANSLATIONS = {
     'error.invalid_amount': 'Gib einen Betrag größer als null ein.',
     'error.broadcast_failed': 'Das Netzwerk hat die Transaktion abgelehnt. Bitte versuche es in Kürze erneut.',
     'error.amount_below_dust_limit': 'Der Betrag ist zu klein, um gesendet zu werden.',
+    'error.too_many_inputs': 'Ihr Guthaben ist auf zu viele kleine Einzahlungen verteilt, um in einer einzigen Transaktion ausgegeben zu werden (max. {max_inputs}). Bitte wenden Sie sich an den Support, um es zusammenzufassen.',
     'error.withdrawal_to_own_address': 'Das ist deine eigene Einzahlungsadresse — zahle auf eine externe Wallet aus.',
     'error.internal_error': 'Unerwarteter Serverfehler. Bitte versuche es in Kürze erneut.',
     'error.guide_unavailable': 'Die Anleitung ist derzeit nicht verfügbar.',
@@ -708,6 +813,26 @@ const TRANSLATIONS = {
     'nav.guideTitle': 'Инструкция',
     'nav.guideAria': 'Открыть руководство пользователя',
     'nav.bugReport': 'Сообщить об ошибке',
+    'bugReport.pageTitle': 'Сообщить об ошибке',
+    'bugReport.heading': 'Сообщить об ошибке',
+    'bugReport.intro': 'Нашли проблему? Опишите её ниже — сообщение сразу попадёт в панель администратора.',
+    'bugReport.englishNotice': 'Пожалуйста, опишите ошибку на английском языке, независимо от языка интерфейса — это поможет нам обработать её быстрее.',
+    'bugReport.descriptionLabel': 'Что произошло?',
+    'bugReport.descriptionPlaceholder': 'Опишите ошибку: что вы делали, что ожидали и что произошло вместо этого.',
+    'bugReport.contactLabel': 'Контакт (необязательно)',
+    'bugReport.contactPlaceholder': 'Email или другой контакт, если хотите получить ответ',
+    'bugReport.submitBtn': 'Отправить сообщение',
+    'bugReport.submitting': 'Отправка…',
+    'bugReport.blankError': 'Опишите ошибку перед отправкой.',
+    'bugReport.successToast': 'Спасибо! Сообщение отправлено.',
+    'bugReport.errorPrefix': 'Ошибка отправки: ',
+    'bugReport.myReportsTitle': 'Ваши сообщения',
+    'bugReport.myReportsHint': 'Только сообщения, отправленные с этого аккаунта, со статусом, обновлённым администрацией.',
+    'bugReport.myReportsEmpty': 'Вы ещё не отправляли сообщений.',
+    'bugReport.statusOpen': 'Не прочитано',
+    'bugReport.statusRead': 'В обработке',
+    'bugReport.statusResolved': 'Решено',
+    'bugReport.backLink': 'Назад на главную',
     'nav.logoutTitle': 'Выйти',
     'nav.logoutAria': 'Выйти из аккаунта',
     'nav.deposit': 'Депозит',
@@ -830,6 +955,7 @@ const TRANSLATIONS = {
     'error.invalid_amount': 'Введите сумму больше нуля.',
     'error.broadcast_failed': 'Сеть отклонила транзакцию. Попробуйте ещё раз через минуту.',
     'error.amount_below_dust_limit': 'Сумма слишком мала для отправки.',
+    'error.too_many_inputs': 'Ваш баланс разбит на слишком много мелких депозитов, чтобы потратить его одной транзакцией (максимум {max_inputs}). Обратитесь в поддержку для консолидации.',
     'error.withdrawal_to_own_address': 'Это ваш собственный адрес для депозита — выводите на внешний кошелёк.',
     'error.internal_error': 'Непредвиденная ошибка сервера. Попробуйте ещё раз через минуту.',
     'error.guide_unavailable': 'Руководство сейчас недоступно.',
@@ -847,6 +973,26 @@ const TRANSLATIONS = {
     'nav.guideTitle': '指南',
     'nav.guideAria': '打开用户指南',
     'nav.bugReport': '报告问题',
+    'bugReport.pageTitle': '报告问题',
+    'bugReport.heading': '报告问题',
+    'bugReport.intro': '发现问题了吗？请在下面描述——您的反馈会直接发送到管理员面板。',
+    'bugReport.englishNotice': '请用英文描述问题，无论您当前使用的是哪种语言界面——这有助于我们更快处理。',
+    'bugReport.descriptionLabel': '发生了什么？',
+    'bugReport.descriptionPlaceholder': '描述问题：您当时在做什么、期望的结果是什么，以及实际发生了什么。',
+    'bugReport.contactLabel': '联系方式（可选）',
+    'bugReport.contactPlaceholder': '如果希望得到回复，请留下邮箱或其他联系方式',
+    'bugReport.submitBtn': '发送反馈',
+    'bugReport.submitting': '发送中…',
+    'bugReport.blankError': '请先描述问题再发送。',
+    'bugReport.successToast': '谢谢！反馈已发送。',
+    'bugReport.errorPrefix': '发送出错：',
+    'bugReport.myReportsTitle': '您的反馈',
+    'bugReport.myReportsHint': '仅显示此账户发送的反馈，状态由管理团队更新。',
+    'bugReport.myReportsEmpty': '您还没有发送过反馈。',
+    'bugReport.statusOpen': '待处理',
+    'bugReport.statusRead': '处理中',
+    'bugReport.statusResolved': '已解决',
+    'bugReport.backLink': '返回首页',
     'nav.logoutTitle': '退出登录',
     'nav.logoutAria': '退出账户',
     'nav.deposit': '存款',
@@ -969,6 +1115,7 @@ const TRANSLATIONS = {
     'error.invalid_amount': '请输入大于零的金额。',
     'error.broadcast_failed': '网络拒绝了该交易，请稍后重试。',
     'error.amount_below_dust_limit': '金额过小，无法发送。',
+    'error.too_many_inputs': '您的余额分散在过多的小额存款中，无法在一笔交易中花费（最多 {max_inputs} 笔）。请联系客服进行归集。',
     'error.withdrawal_to_own_address': '这是你自己的充值地址 — 请提现到外部钱包。',
     'error.internal_error': '服务器发生意外错误，请稍后重试。',
     'error.guide_unavailable': '指南当前不可用。',

app/static/report-bug.html

@@ -1,16 +1,169 @@
 <!DOCTYPE html>
-<html lang="it">
+<html lang="en">
 <head>
   <meta charset="UTF-8">
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
-  <title>Segnala un bug — PLM Lottery</title>
+  <title data-i18n="bugReport.pageTitle">Report a bug</title>
+  <link rel="icon" type="image/svg+xml" href="/logo.svg">
   <link rel="stylesheet" href="/style.css">
 </head>
 <body>
-  <div class="app-shell">
-    <h1>Segnala un bug</h1>
-    <p>Questa pagina è un placeholder. Il modulo per la segnalazione dei bug sarà disponibile qui a breve.</p>
-    <p><a class="link" href="/">&larr; Torna alla home</a></p>
+  <div class="app-shell app-shell-bugreport">
+
+    <div class="bugreport-topbar">
+      <a class="brand" href="/">
+        <img class="brand-mark" src="/logo.svg" alt="">
+        PLM Lottery
+      </a>
+      <div class="bugreport-topbar-right">
+        <a class="back-home-btn" href="/">
+          <svg class="icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="19" y1="12" x2="5" y2="12"/><polyline points="12 19 5 12 12 5"/></svg>
+          <span data-i18n="bugReport.backLink">Back to home</span>
+        </a>
+        <select id="lang-switcher" class="lang-switcher" onchange="setLanguage(this.value)" aria-label="Language">
+          <option value="en">English</option>
+          <option value="it">Italiano</option>
+          <option value="es">Español</option>
+          <option value="fr">Français</option>
+          <option value="de">Deutsch</option>
+          <option value="ru">Русский</option>
+          <option value="zh">中文</option>
+        </select>
+      </div>
+    </div>
+
+    <div class="bugreport-hero">
+      <div class="bugreport-hero-icon">
+        <svg class="icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><path d="M12 8v5"/><path d="M12 16h.01"/></svg>
+      </div>
+      <div>
+        <h1 data-i18n="bugReport.heading">Report a bug</h1>
+        <p data-i18n="bugReport.intro">Found a problem? Describe it below — your report goes straight to the admin panel.</p>
+      </div>
+    </div>
+
+    <div class="card" id="report-form">
+      <div class="field-note" id="english-notice">
+        <svg class="icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><line x1="2" y1="12" x2="22" y2="12"/><path d="M12 2a15.3 15.3 0 0 1 4 10 15.3 15.3 0 0 1-4 10 15.3 15.3 0 0 1-4-10 15.3 15.3 0 0 1 4-10z"/></svg>
+        <span data-i18n="bugReport.englishNotice">Please write your bug report in English, regardless of the language you're browsing in — this helps us handle it faster.</span>
+      </div>
+
+      <label for="bug-description" data-i18n="bugReport.descriptionLabel">What happened?</label>
+      <textarea id="bug-description" rows="6" maxlength="2000" data-i18n-placeholder="bugReport.descriptionPlaceholder" oninput="updateCharCount()"></textarea>
+      <div class="char-count" id="char-count">0 / 2000</div>
+
+      <label for="bug-contact" data-i18n="bugReport.contactLabel">Contact (optional)</label>
+      <input id="bug-contact" type="text" maxlength="256" data-i18n-placeholder="bugReport.contactPlaceholder">
+
+      <button onclick="submitBugReport()" id="bug-submit-btn" data-i18n="bugReport.submitBtn">Send report</button>
+    </div>
+
+    <div class="hidden" id="my-reports-section">
+      <p class="section-label" data-i18n="bugReport.myReportsTitle">Your reports</p>
+      <div class="card">
+        <p class="hint" data-i18n="bugReport.myReportsHint">Only reports sent from this account, with the status set by the admin team.</p>
+        <div id="my-reports-list"></div>
+      </div>
+    </div>
+
   </div>
+
+  <div id="toast-container" aria-live="polite"></div>
+
+  <script src="/i18n.js"></script>
+  <script>
+    function toast(message, type) {
+      const container = document.getElementById('toast-container');
+      const el = document.createElement('div');
+      el.className = 'toast ' + type;
+      el.textContent = message;
+      container.appendChild(el);
+      setTimeout(() => el.remove(), 4000);
+    }
+
+    function escapeHtml(s) {
+      return String(s).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+    }
+
+    function updateCharCount() {
+      const field = document.getElementById('bug-description');
+      document.getElementById('char-count').textContent = field.value.length + ' / ' + field.maxLength;
+    }
+
+    async function submitBugReport() {
+      const btn = document.getElementById('bug-submit-btn');
+      const description = document.getElementById('bug-description').value.trim();
+      const contact = document.getElementById('bug-contact').value.trim();
+      if (!description) {
+        toast(t('bugReport.blankError'), 'error');
+        return;
+      }
+
+      const headers = { 'Content-Type': 'application/json' };
+      const token = localStorage.getItem('plm_token');
+      if (token) headers['Authorization'] = 'Bearer ' + token;
+
+      btn.disabled = true;
+      const original = btn.textContent;
+      btn.textContent = t('bugReport.submitting');
+      try {
+        const res = await fetch('/bug-reports', {
+          method: 'POST',
+          headers,
+          body: JSON.stringify({ description, contact: contact || null }),
+        });
+        const data = await res.json().catch(() => ({}));
+        if (!res.ok) throw new Error(data.detail?.message || data.detail || res.statusText);
+        document.getElementById('bug-description').value = '';
+        document.getElementById('bug-contact').value = '';
+        updateCharCount();
+        toast(t('bugReport.successToast'), 'success');
+        loadMyBugReports();
+      } catch (e) {
+        toast(t('bugReport.errorPrefix') + e.message, 'error');
+      } finally {
+        btn.disabled = false;
+        btn.textContent = original;
+        applyStaticTranslations(btn);
+      }
+    }
+
+    async function loadMyBugReports() {
+      const token = localStorage.getItem('plm_token');
+      const section = document.getElementById('my-reports-section');
+      if (!token) {
+        section.classList.add('hidden');
+        return;
+      }
+      try {
+        const res = await fetch('/bug-reports/mine', { headers: { Authorization: 'Bearer ' + token } });
+        if (!res.ok) {
+          section.classList.add('hidden');
+          return;
+        }
+        const reports = await res.json();
+        section.classList.remove('hidden');
+        const list = document.getElementById('my-reports-list');
+        list.innerHTML = reports.map((r) => `
+          <div class="report-row">
+            <span class="badge bug-status-${escapeHtml(r.status)}">${escapeHtml(t('bugReport.status' + r.status.charAt(0).toUpperCase() + r.status.slice(1)))}</span>
+            <span class="report-row-desc" title="${escapeHtml(r.description)}">${escapeHtml(r.description)}</span>
+            <span class="report-row-date">${new Date(r.created_at).toLocaleDateString(currentDateLocale(), { day: 'numeric', month: 'short', year: 'numeric' })}</span>
+          </div>
+        `).join('') || `<p class="hint report-empty">${escapeHtml(t('bugReport.myReportsEmpty'))}</p>`;
+      } catch (e) {
+        section.classList.add('hidden');
+      }
+    }
+
+    // Re-renders server-rendered content (my reports list) on a language switch,
+    // the same split app.js uses between data-i18n (static markup) and t() (data).
+    function onLanguageChange() {
+      loadMyBugReports();
+    }
+
+    updateCharCount();
+    loadMyBugReports();
+  </script>
 </body>
 </html>

app/static/style.css

@@ -74,16 +74,17 @@ h1, h2, h3 { font-family: inherit; letter-spacing: -0.01em; }
 label { display: block; font-size: 0.85rem; font-weight: 500; color: var(--color-muted-foreground); margin-top: 14px; margin-bottom: 6px; }
 label:first-child { margin-top: 0; }
 
-input {
+input, textarea {
   width: 100%; min-height: 44px; padding: 10px 12px; font-size: 0.95rem; font-family: inherit;
   border: 1px solid var(--color-border); border-radius: var(--radius-sm); background: var(--color-surface);
   color: var(--color-foreground); transition: border-color 150ms, box-shadow 150ms;
 }
-input:focus {
+textarea { resize: vertical; }
+input:focus, textarea:focus {
   outline: none; border-color: var(--color-ring);
   box-shadow: 0 0 0 3px color-mix(in srgb, var(--color-ring) 25%, transparent);
 }
-input:disabled { background: var(--color-surface-inset); color: var(--color-muted-foreground); }
+input:disabled, textarea:disabled { background: var(--color-surface-inset); color: var(--color-muted-foreground); }
 
 button {
   display: inline-flex; align-items: center; justify-content: center; gap: 6px;
@@ -253,6 +254,93 @@ button.link:hover, a.link:hover { filter: none; color: var(--color-foreground);
 .toast.error { background: var(--color-destructive-bg); color: var(--color-destructive); }
 @keyframes toast-in { from { opacity: 0; transform: translateY(8px); } to { opacity: 1; transform: translateY(0); } }
 
+/* --- /report-bug: a standalone page (no logged-in navbar), so it gets its
+   own slim top bar rather than the app's bottom tab bar / sticky header. --- */
+.app-shell-bugreport { padding-bottom: 32px; }
+
+.bugreport-topbar {
+  display: flex; align-items: center; justify-content: space-between; gap: 12px;
+  padding: 4px 0 20px; margin-bottom: 20px; border-bottom: 1px solid var(--color-border);
+}
+.bugreport-topbar .brand {
+  display: flex; align-items: center; gap: 8px; font-weight: 700; font-size: 1rem;
+  letter-spacing: -0.01em; color: var(--color-foreground); text-decoration: none;
+}
+.bugreport-topbar .brand-mark { width: 26px; height: 26px; border-radius: 50%; flex-shrink: 0; display: block; }
+.bugreport-topbar-right { display: flex; align-items: center; gap: 12px; }
+
+/* Pill button, same idiom as .trust-pill / .chain-status-pill elsewhere on the
+   site: a bordered chip rather than a bare text link, so "go back" reads as an
+   actual control instead of fading into the surrounding copy. */
+.back-home-btn {
+  display: inline-flex; align-items: center; gap: 6px;
+  font-size: 0.8rem; font-weight: 500; color: var(--color-muted-foreground);
+  background: var(--color-surface); border: 1px solid var(--color-border);
+  padding: 6px 12px 6px 10px; border-radius: 999px; text-decoration: none;
+  transition: color 150ms, border-color 150ms, background 150ms;
+}
+.back-home-btn .icon { width: 15px; height: 15px; }
+.back-home-btn:hover {
+  color: var(--color-foreground); background: var(--color-surface-inset);
+  border-color: color-mix(in srgb, var(--color-ring) 40%, var(--color-border));
+}
+.back-home-btn:focus-visible { outline: 2px solid var(--color-ring); outline-offset: 2px; }
+
+.bugreport-hero { display: flex; align-items: flex-start; gap: 14px; margin-bottom: 20px; }
+.bugreport-hero-icon {
+  width: 44px; height: 44px; flex-shrink: 0; border-radius: 999px;
+  background: color-mix(in srgb, var(--color-primary) 14%, transparent);
+  color: var(--color-primary);
+  display: flex; align-items: center; justify-content: center;
+}
+.bugreport-hero-icon .icon { width: 22px; height: 22px; }
+.bugreport-hero h1 { font-size: 1.3rem; font-weight: 700; margin: 2px 0 4px; text-wrap: balance; }
+.bugreport-hero p { color: var(--color-muted-foreground); font-size: 0.9rem; margin: 0; max-width: 46ch; }
+
+/* Info callout, anchored inside the form card right above the field it
+   applies to — not a warning (that's what the amber status badges below are
+   for), so it gets the accent hue instead, keeping the two meanings visually
+   distinct. */
+.field-note {
+  display: flex; align-items: flex-start; gap: 10px;
+  background: color-mix(in srgb, var(--color-accent) 10%, transparent);
+  border: 1px solid color-mix(in srgb, var(--color-accent) 28%, transparent);
+  color: color-mix(in srgb, var(--color-accent) 75%, var(--color-foreground));
+  border-radius: var(--radius-sm); padding: 10px 12px; font-size: 0.82rem; line-height: 1.4;
+  margin-bottom: 16px;
+}
+.field-note .icon { width: 16px; height: 16px; margin-top: 1px; flex-shrink: 0; }
+
+.char-count {
+  font-variant-numeric: tabular-nums; text-align: right;
+  font-size: 0.75rem; color: var(--color-muted-foreground); margin-top: 4px;
+}
+
+.badge {
+  display: inline-block; font-size: 0.72rem; font-weight: 600; padding: 2px 8px;
+  border-radius: 999px; background: var(--color-background); border: 1px solid var(--color-border);
+  flex-shrink: 0;
+}
+.badge.bug-status-open { background: color-mix(in srgb, var(--color-primary) 16%, transparent); color: #92400E; border-color: color-mix(in srgb, var(--color-primary) 55%, transparent); }
+.badge.bug-status-read { background: var(--color-background); color: var(--color-muted-foreground); }
+.badge.bug-status-resolved { background: var(--color-success-bg); color: var(--color-success); border-color: var(--color-success); }
+
+.report-row {
+  display: flex; flex-wrap: wrap; align-items: center; gap: 10px;
+  padding: 12px 0; border-bottom: 1px solid var(--color-border);
+}
+.report-row:first-child { padding-top: 0; }
+.report-row:last-child { padding-bottom: 0; border-bottom: none; }
+.report-row-desc {
+  flex: 1 1 200px; font-size: 0.88rem;
+  overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
+}
+.report-row-date {
+  font-size: 0.78rem; color: var(--color-muted-foreground); white-space: nowrap;
+  font-variant-numeric: tabular-nums;
+}
+.report-empty { margin: 0; }
+
 /* --- landing hero (shown only when logged out) --- */
 body {
   position: relative;

app/wallet/balance.py

@@ -38,6 +38,15 @@ async def compute_pending_balance(session: AsyncSession, user: User) -> tuple[in
     user's own address. Adding that to cached_balance_sats gives the balance the
     user will end up with once everything currently in flight confirms.
 
+    The change output's own confirmation is credited by two independent, unordered
+    paths: the Electrum listener (event-driven, near-instant — app/deposits/service.py
+    turns it into a UtxoEvent and folds it into cached_balance_sats via
+    recompute_balance) and this module's PendingTransaction.status flip
+    (app/tx/confirmation.py, polled every 10s). The listener usually wins that race,
+    so for the gap until the poller catches up the row is still "pending" here while
+    the same sats are already inside cached_balance_sats — double-counting the
+    change unless excluded below.
+
     Returns (pending_inclusive_balance_sats, has_pending) — has_pending tells the
     caller whether this differs from the confirmed-only balance at all.
     """
@@ -54,10 +63,19 @@ async def compute_pending_balance(session: AsyncSession, user: User) -> tuple[in
         )
     ).all()
 
+    already_credited = {
+        (txid, vout)
+        for txid, vout in (
+            await session.execute(select(UtxoEvent.txid, UtxoEvent.vout).where(UtxoEvent.user_id == user.id))
+        ).all()
+    }
+
     pending_change_sats = 0
     for row in pending:
         tx = Transaction.parse(bytes.fromhex(row.raw_tx_hex))
-        for out in tx.vout:
+        for vout, out in enumerate(tx.vout):
+            if (row.current_txid, vout) in already_credited:
+                continue
             if out.script_pubkey.address(network=PLM_MAINNET) == user.address:
                 pending_change_sats += out.value
 

app/wallet/psbt_builder.py

@@ -33,15 +33,30 @@ DUST_LIMIT_SATS = 294
 # eating further and further into the sender's change with no limit.
 MAX_FEE_RATE_SAT_VB = 10_000
 
+# Ceiling on how many UTXOs one transaction may spend (B-48). Every extra input costs
+# ~68 vbytes of fee, and that fee comes out of the amount being moved — so an address
+# fragmented into hundreds of small deposits would silently erode its own bet (shrinking
+# the user's share of the pool) or withdrawal, and past a few hundred inputs the tx also
+# stops being standard and gets refused at broadcast. Failing the build with a
+# translatable error is the honest outcome; consolidating the address is the way out.
+MAX_TX_INPUTS = 50
+
 
 class InsufficientFundsError(Exception):
     """`code` is the machine-readable identifier the API layer forwards to the
     client so it can translate the failure (see app/api/errors.py); the message
-    itself stays English."""
+    itself stays English, and `params` carries the values it interpolates so the
+    translation can place them wherever its own grammar needs them."""
 
-    def __init__(self, message: str, code: str = "insufficient_balance") -> None:
+    def __init__(
+        self,
+        message: str,
+        code: str = "insufficient_balance",
+        **params: int | str,
+    ) -> None:
         super().__init__(message)
         self.code = code
+        self.params = params
 
 
 @dataclass
@@ -68,11 +83,22 @@ def estimate_vsize(n_inputs: int, n_outputs: int) -> int:
 def select_utxos(utxos: list[Utxo], target_sats: int) -> tuple[list[Utxo], int]:
     """Greedily select UTXOs (largest first, to minimize input count) covering
     target_sats — the amount deducted from the sender's balance. The fee is paid
-    out of target_sats (see build_signed_transaction), not added on top of it."""
+    out of target_sats (see build_signed_transaction), not added on top of it.
+
+    At most MAX_TX_INPUTS are ever selected (B-48): if the largest MAX_TX_INPUTS
+    UTXOs don't cover the target, the balance is there but too fragmented to spend
+    in one transaction, which is a different failure from having no funds at all
+    and gets its own code."""
     ordered = sorted(utxos, key=lambda u: u.amount_sats, reverse=True)
     selected: list[Utxo] = []
     total = 0
     for utxo in ordered:
+        if len(selected) == MAX_TX_INPUTS:
+            raise InsufficientFundsError(
+                f"balance too fragmented: more than {MAX_TX_INPUTS} inputs would be needed",
+                code="too_many_inputs",
+                max_inputs=MAX_TX_INPUTS,
+            )
         selected.append(utxo)
         total += utxo.amount_sats
         if total >= target_sats:

app/withdrawals/service.py

@@ -89,7 +89,7 @@ async def request_withdrawal(
             fee_rate_sat_vb=config.fee_rate_sat_vb,
         )
     except InsufficientFundsError as exc:
-        raise WithdrawalError(exc.code, str(exc)) from exc
+        raise WithdrawalError(exc.code, str(exc), **exc.params) from exc
 
     # Persist the intent before broadcasting, and only promote the rows once the
     # network has accepted the tx — same two-phase shape as place_bet (B-08).
@@ -173,3 +173,4 @@ async def _release_failed_withdrawal(
         user_id=user_id,
     )
     await session.commit()
+    broadcaster.publish()  # the reserved UTXOs are spendable again — refetch the balance (B-49)

migrations/versions/be71fdac734e_replace_bug_reports_resolved_with_a_.py

@@ -0,0 +1,41 @@
+"""replace bug_reports.resolved with a three-state status
+
+Revision ID: be71fdac734e
+Revises: ee8508d98d34
+Create Date: 2026-07-31 15:33:51.780062
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'be71fdac734e'
+down_revision: Union[str, Sequence[str], None] = 'ee8508d98d34'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    """Upgrade schema, preserving existing rows: resolved=True -> 'resolved', else 'open'.
+
+    'read' has no equivalent in the old boolean, so nothing backfills into it —
+    every previously-open report starts the new lifecycle at 'open', which is
+    correct (nobody had acknowledged it yet)."""
+    op.add_column('bug_reports', sa.Column('status', sa.String(length=16), nullable=True))
+    op.execute("UPDATE bug_reports SET status = CASE WHEN resolved THEN 'resolved' ELSE 'open' END")
+    with op.batch_alter_table('bug_reports') as batch_op:
+        batch_op.alter_column('status', nullable=False)
+        batch_op.drop_column('resolved')
+
+
+def downgrade() -> None:
+    """Downgrade schema. 'read' collapses back into resolved=False — the same loss
+    of information any boolean-from-enum downgrade has."""
+    op.add_column('bug_reports', sa.Column('resolved', sa.BOOLEAN(), nullable=True))
+    op.execute("UPDATE bug_reports SET resolved = (status = 'resolved')")
+    with op.batch_alter_table('bug_reports') as batch_op:
+        batch_op.alter_column('resolved', nullable=False)
+        batch_op.drop_column('status')

migrations/versions/ee8508d98d34_add_bug_reports_table.py

@@ -0,0 +1,41 @@
+"""add bug_reports table
+
+Revision ID: ee8508d98d34
+Revises: 87a0c640355c
+Create Date: 2026-07-31 15:14:14.288552
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'ee8508d98d34'
+down_revision: Union[str, Sequence[str], None] = '87a0c640355c'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    """Upgrade schema."""
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.create_table('bug_reports',
+    sa.Column('id', sa.Integer(), nullable=False),
+    sa.Column('description', sa.Text(), nullable=False),
+    sa.Column('contact', sa.String(length=256), nullable=True),
+    sa.Column('user_id', sa.Integer(), nullable=True),
+    sa.Column('resolved', sa.Boolean(), nullable=False),
+    sa.Column('created_at', sa.DateTime(), nullable=False),
+    sa.ForeignKeyConstraint(['user_id'], ['users.id'], ),
+    sa.PrimaryKeyConstraint('id')
+    )
+    # ### end Alembic commands ###
+
+
+def downgrade() -> None:
+    """Downgrade schema."""
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.drop_table('bug_reports')
+    # ### end Alembic commands ###

tests/unit/test_balance.py

@@ -91,6 +91,54 @@ async def test_pending_balance_matches_confirmed_when_nothing_in_flight(session_
     assert pending_balance == 2_000_000_000
 
 
+async def test_pending_balance_does_not_double_count_change_already_credited(session_factory):
+    """The Electrum listener (event-driven) and the confirmation poller (10s
+    cadence) independently react to the same change output confirming. When the
+    listener wins that race — the common case — the change is already a
+    UtxoEvent inside cached_balance_sats while the PendingTransaction row is
+    still "pending". compute_pending_balance must not add the change a second
+    time in that window."""
+    user_id = await _make_funded_user(session_factory, 4, 1_500_000_000)
+    client = FakeElectrumClient()
+
+    async with session_factory() as session:
+        user = await session.get(User, user_id)
+        await place_bet(session, client, user)
+
+    async with session_factory() as session:
+        pending = (await session.scalars(select(PendingTransaction))).one()
+        from embit.transaction import Transaction
+
+        from app.wallet.plm_network import PLM_MAINNET
+
+        tx = Transaction.parse(bytes.fromhex(pending.raw_tx_hex))
+        change_vout, change_out = next(
+            (i, out) for i, out in enumerate(tx.vout) if out.script_pubkey.address(network=PLM_MAINNET) == user.address
+        )
+
+        user = await session.get(User, user_id)
+        # Simulate the listener having already credited the change output as
+        # confirmed, before the poller has flipped `pending.status`.
+        session.add(
+            UtxoEvent(
+                user_id=user_id,
+                txid=pending.current_txid,
+                vout=change_vout,
+                amount_sats=change_out.value,
+                confirmed_height=101,
+            )
+        )
+        await recompute_balance(session, user_id)
+        await session.commit()
+
+    async with session_factory() as session:
+        user = await session.get(User, user_id)
+        pending_balance, has_pending = await compute_pending_balance(session, user)
+
+        assert has_pending is True  # the PendingTransaction row is still "pending"
+        assert pending_balance == user.cached_balance_sats  # already-credited change isn't added again
+
+
 async def test_pending_balance_ignores_other_users_pending_transactions(session_factory):
     user_id = await _make_funded_user(session_factory, 2, 2_000_000_000)
     other_user_id = await _make_funded_user(session_factory, 3, 1_500_000_000)

tests/unit/test_bets.py

@@ -8,8 +8,10 @@ from app.bets.service import BetError, place_bet
 from app.config import settings
 from app.db.base import Base
 from app.db.models import AuditLog, PendingTransaction, Round, RoundConfig, RoundParticipant, User, UtxoEvent
+from app.rounds.events import broadcaster
 from app.rounds.service import open_new_round_if_needed
 from app.wallet.hd import derive_user_address
+from app.wallet.psbt_builder import MAX_TX_INPUTS
 
 
 class FakeElectrumClient:
@@ -91,6 +93,35 @@ async def test_place_bet_rejects_insufficient_balance(session_factory):
             await place_bet(session, client, user)
 
 
+async def test_place_bet_reports_a_too_fragmented_balance_distinctly(session_factory):  # B-48
+    # 100 x 0.15 PLM = 15 PLM, plenty for a 10 PLM bet, but the 50 largest inputs
+    # only add up to 7.5 PLM — so the build must fail with its own code, not with
+    # the "you have no funds" one, and must carry the cap for the translation.
+    user_id = await _make_funded_user(session_factory, 20, 15_000_000)
+    async with session_factory() as session:
+        for i in range(99):
+            session.add(
+                UtxoEvent(
+                    user_id=user_id,
+                    txid=f"{i:064x}",
+                    vout=0,
+                    amount_sats=15_000_000,
+                    confirmed_height=100,
+                )
+            )
+        await session.commit()
+    client = FakeElectrumClient()
+
+    async with session_factory() as session:
+        user = await session.get(User, user_id)
+        with pytest.raises(BetError) as excinfo:
+            await place_bet(session, client, user)
+
+    assert excinfo.value.code == "too_many_inputs"
+    assert excinfo.value.params == {"max_inputs": MAX_TX_INPUTS}
+    assert not client.broadcasted
+
+
 async def test_place_bet_rejects_second_bet_same_round(session_factory):
     user_id = await _make_funded_user(session_factory, 2, 3_000_000_000)
     client = FakeElectrumClient()
@@ -166,6 +197,33 @@ async def test_failed_broadcast_leaves_nothing_behind(session_factory):
         assert "bet_placed" not in events
 
 
+async def test_failed_broadcast_publishes_an_sse_update(session_factory):  # B-49
+    """The rollback moves as much state as the successful path does, so it must ping
+    the dashboards the same way — otherwise the phantom bet stays on screen until the
+    next poll."""
+    user_id = await _make_funded_user(session_factory, 21, 3_000_000_000)
+    async with session_factory() as session:
+        # Open the round up front: place_bet would otherwise open it itself, and that
+        # publish() would satisfy the assertion below whether or not the rollback ever
+        # published one of its own.
+        await open_new_round_if_needed(session)
+        await session.commit()
+
+    queue = broadcaster.subscribe()
+    try:
+        while not queue.empty():
+            queue.get_nowait()
+
+        async with session_factory() as session:
+            user = await session.get(User, user_id)
+            with pytest.raises(BetError, match="refused"):
+                await place_bet(session, RejectingElectrumClient(), user)
+
+        assert not queue.empty()
+    finally:
+        broadcaster.unsubscribe(queue)
+
+
 async def test_failed_broadcast_reports_the_broadcast_failed_code(session_factory):
     user_id = await _make_funded_user(session_factory, 5, 3_000_000_000)
 

tests/unit/test_bug_reports.py

@@ -0,0 +1,181 @@
+import pytest
+from cryptography.fernet import Fernet
+from httpx import ASGITransport, AsyncClient
+
+from app.config import settings
+
+
+@pytest.fixture
+async def client(monkeypatch, tmp_path):
+    monkeypatch.setattr(settings, "database_url", f"sqlite+aiosqlite:///{tmp_path}/test.db")
+    monkeypatch.setattr(settings, "admin_token", "test-admin-token")
+    monkeypatch.setattr(settings, "jwt_secret", "test-jwt-secret")
+    monkeypatch.setattr(settings, "xprv_encryption_key", Fernet.generate_key().decode())
+    monkeypatch.setattr(settings, "master_key_path", str(tmp_path / "master.xprv.enc"))
+
+    import app.wallet.hd as hd
+
+    hd._account_key = None
+    hd.generate_master_key()
+
+    from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
+
+    from app.db import base as db_base
+
+    import app.db.models  # noqa: F401
+
+    db_base.engine = create_async_engine(settings.database_url)
+    db_base.AsyncSessionLocal = async_sessionmaker(db_base.engine, expire_on_commit=False)
+
+    from app.db import session as db_session
+
+    db_session.AsyncSessionLocal = db_base.AsyncSessionLocal
+
+    async with db_base.engine.begin() as conn:
+        await conn.run_sync(db_base.Base.metadata.create_all)
+
+    from fastapi import FastAPI
+
+    from app.api.routes.admin import router as admin_router
+    from app.api.routes.bug_reports import router as bug_reports_router
+    from app.auth.routes import router as auth_router
+    from app.electrum.listener import ElectrumListener
+
+    app = FastAPI()
+    app.include_router(auth_router)
+    app.include_router(bug_reports_router)
+    app.include_router(admin_router)
+    app.state.electrum_listener = ElectrumListener(lambda endpoint: None, db_base.AsyncSessionLocal)
+
+    transport = ASGITransport(app=app)
+    async with AsyncClient(transport=transport, base_url="http://test") as ac:
+        yield ac
+
+    await db_base.engine.dispose()
+
+
+_ADMIN_HEADERS = {"X-Admin-Token": "test-admin-token"}
+
+
+async def _register(client, username="alice", password="original-password"):
+    resp = await client.post("/auth/register", json={"username": username, "password": password})
+    assert resp.status_code == 201
+    return resp.json()["access_token"]
+
+
+async def test_anonymous_bug_report_has_no_user(client):
+    resp = await client.post("/bug-reports", json={"description": "the bet button does nothing"})
+    assert resp.status_code == 201
+
+    resp = await client.get("/admin/bug-reports", headers=_ADMIN_HEADERS)
+    assert resp.status_code == 200
+    reports = resp.json()
+    assert len(reports) == 1
+    assert reports[0]["description"] == "the bet button does nothing"
+    assert reports[0]["user_id"] is None
+    assert reports[0]["username"] is None
+    assert reports[0]["status"] == "open"
+
+
+async def test_logged_in_bug_report_is_attributed_to_the_user(client):
+    token = await _register(client)
+
+    resp = await client.post(
+        "/bug-reports",
+        headers={"Authorization": f"Bearer {token}"},
+        json={"description": "withdrawal amount looks wrong", "contact": "alice@example.com"},
+    )
+    assert resp.status_code == 201
+
+    resp = await client.get("/admin/bug-reports", headers=_ADMIN_HEADERS)
+    reports = resp.json()
+    assert reports[0]["username"] == "alice"
+    assert reports[0]["contact"] == "alice@example.com"
+
+
+async def test_user_can_see_own_report_status(client):
+    token = await _register(client)
+    headers = {"Authorization": f"Bearer {token}"}
+
+    resp = await client.post("/bug-reports", headers=headers, json={"description": "some bug"})
+    report_id = resp.json()["id"]
+
+    resp = await client.get("/bug-reports/mine", headers=headers)
+    assert resp.status_code == 200
+    reports = resp.json()
+    assert len(reports) == 1
+    assert reports[0]["id"] == report_id
+    assert reports[0]["status"] == "open"
+
+    await client.post(
+        f"/admin/bug-reports/{report_id}/status", headers=_ADMIN_HEADERS, json={"status": "read"}
+    )
+    resp = await client.get("/bug-reports/mine", headers=headers)
+    assert resp.json()[0]["status"] == "read"
+
+
+async def test_bug_reports_mine_requires_auth(client):
+    resp = await client.get("/bug-reports/mine")
+    assert resp.status_code == 401
+
+
+async def test_bug_reports_mine_only_returns_own_reports(client):
+    alice_token = await _register(client, username="alice")
+    bob_token = await _register(client, username="bob", password="bob-password")
+
+    await client.post(
+        "/bug-reports", headers={"Authorization": f"Bearer {alice_token}"}, json={"description": "alice's bug"}
+    )
+
+    resp = await client.get("/bug-reports/mine", headers={"Authorization": f"Bearer {bob_token}"})
+    assert resp.json() == []
+
+
+async def test_blank_description_is_rejected(client):
+    resp = await client.post("/bug-reports", json={"description": "   "})
+    assert resp.status_code == 422
+
+
+async def test_admin_bug_reports_requires_token(client):
+    resp = await client.get("/admin/bug-reports")
+    assert resp.status_code == 403
+
+
+async def test_admin_can_move_through_open_read_resolved(client):
+    resp = await client.post("/bug-reports", json={"description": "some bug"})
+    report_id = resp.json()["id"]
+
+    resp = await client.post(
+        f"/admin/bug-reports/{report_id}/status", headers=_ADMIN_HEADERS, json={"status": "read"}
+    )
+    assert resp.status_code == 200
+    assert resp.json()["status"] == "read"
+
+    resp = await client.post(
+        f"/admin/bug-reports/{report_id}/status", headers=_ADMIN_HEADERS, json={"status": "resolved"}
+    )
+    assert resp.status_code == 200
+    assert resp.json()["status"] == "resolved"
+
+    resp = await client.post(
+        f"/admin/bug-reports/{report_id}/status", headers=_ADMIN_HEADERS, json={"status": "open"}
+    )
+    assert resp.status_code == 200
+    assert resp.json()["status"] == "open"
+
+
+async def test_update_status_rejects_unknown_value(client):
+    resp = await client.post("/bug-reports", json={"description": "some bug"})
+    report_id = resp.json()["id"]
+
+    resp = await client.post(
+        f"/admin/bug-reports/{report_id}/status", headers=_ADMIN_HEADERS, json={"status": "bogus"}
+    )
+    assert resp.status_code == 422
+
+
+async def test_update_status_unknown_report_is_404(client):
+    resp = await client.post(
+        "/admin/bug-reports/999/status", headers=_ADMIN_HEADERS, json={"status": "read"}
+    )
+    assert resp.status_code == 404

tests/unit/test_psbt_builder.py

@@ -5,6 +5,7 @@ from embit.transaction import Transaction
 
 from app.wallet.plm_network import PLM_MAINNET
 from app.wallet.psbt_builder import (
+    MAX_TX_INPUTS,
     InsufficientFundsError,
     Utxo,
     build_signed_transaction,
@@ -36,6 +37,22 @@ def test_select_utxos_raises_when_insufficient():
         select_utxos(utxos, target_sats=10_000_000)
 
 
+def test_select_utxos_never_exceeds_the_input_cap(): # B-48
+    # 200 dust-ish UTXOs that together cover the target, but only past the cap.
+    utxos = [Utxo(f"{i:064x}", 0, 100_000) for i in range(200)]
+    with pytest.raises(InsufficientFundsError) as excinfo:
+        select_utxos(utxos, target_sats=100_000 * MAX_TX_INPUTS + 1)
+    assert excinfo.value.code == "too_many_inputs"
+    assert excinfo.value.params == {"max_inputs": MAX_TX_INPUTS}
+
+
+def test_select_utxos_allows_exactly_the_input_cap():
+    utxos = [Utxo(f"{i:064x}", 0, 100_000) for i in range(200)]
+    selected, total = select_utxos(utxos, target_sats=100_000 * MAX_TX_INPUTS)
+    assert len(selected) == MAX_TX_INPUTS
+    assert total == 100_000 * MAX_TX_INPUTS
+
+
 def test_build_signed_transaction_deducts_fee_from_amount_not_change():
     signer = _key(1)
     from_script = script.p2wpkh(signer.to_public())

tests/unit/test_withdrawals.py

@@ -6,6 +6,7 @@ from app.bets.service import place_bet
 from app.config import settings
 from app.db.base import Base
 from app.db.models import PendingTransaction, User, UtxoEvent, Withdrawal
+from app.rounds.events import broadcaster
 from app.wallet.hd import derive_user_address
 from app.withdrawals.service import WithdrawalError, request_withdrawal
 
@@ -171,6 +172,31 @@ async def test_withdrawal_to_own_address_is_rejected(session_factory):
         assert (await session.scalars(select(UtxoEvent).where(UtxoEvent.user_id == user_id))).one().spent_txid is None
 
 
+async def test_failed_broadcast_publishes_an_sse_update(session_factory):  # B-49
+    """The released UTXOs are spendable again and the balance changed back, so the
+    rollback must nudge the dashboard to refetch instead of leaving it stale until
+    its next poll."""
+    user_id = await _make_funded_user(session_factory, 10, 3_000_000_000)
+
+    class RejectingClient:
+        async def broadcast(self, raw_tx_hex: str) -> str:
+            raise RuntimeError("min relay fee not met")
+
+    queue = broadcaster.subscribe()
+    try:
+        while not queue.empty():
+            queue.get_nowait()
+
+        async with session_factory() as session:
+            user = await session.get(User, user_id)
+            with pytest.raises(WithdrawalError, match="refused"):
+                await request_withdrawal(session, RejectingClient(), user, derive_user_address(98), 1_000_000_000)
+
+        assert not queue.empty()
+    finally:
+        broadcaster.unsubscribe(queue)
+
+
 async def test_failed_broadcast_marks_the_withdrawal_failed_and_frees_the_coins(session_factory):
     """B-07/B-08: the Withdrawal row is kept (unlike a bet) so the user can see the
     instruction didn't go through, but the coins must come back."""