[okapitula]

Stacked on #334. Review that PR first; this one retargets to dev once it merges.

Summary

Adds sportsbook/betting, a provider-settled sportsbook: a third-party provider runs odds, bet acceptance and settlement in its own widget, and core holds the money behind one command port, SPORTSBOOK_LEDGER. It also backfills the gamification product lists so ladders configured before they existed keep paying rakeback on every product.

Why

Operators want to offer sports betting through a turnkey provider without core learning any vendor's wire protocol. Every provider callback moves money, has to be idempotent against provider retries, and can be reversed after the winnings were withdrawn, so the ledger step, its lock order and its debt handling belong in core. The signature check and the codec belong in the operator's overlay. ADR-0046 records the decision.

What ships:

• Ledger port operations reserve, confirm, cancel, settle and reopen. Each runs in one transaction, is idempotent on the provider transaction id plus a request fingerprint, and follows one lock order: config, then player, then bet, then wallet and debt rows, then audit. A replay with the same content returns the first answer and moves nothing. A reused id with different content is refused and filed as a finding.
• Confirm terms: the accepted legs may change only their odds. With decimal odds the potential payout has to move the same way as the odds product.
• Sessions bind a bet to a player. Stakes are gated at session issue and again at reserve under the locks; settlement is never gated. The country list only blocks on top of the platform geo check. Cooling-off and self-exclusion revoke live sessions through a retried job. The reconcile cron retries any revoke the provider has not acknowledged and revokes the live sessions of any player play eligibility refuses.
• A reopen takes back what the settlement paid without overdrawing the balance. Any shortfall becomes per-currency sportsbook debt with a withdrawal hold. A later win offsets it, shortfall by shortfall and oldest first, in the round of the bet that owed it and as the leg type its reopen used, so RG loss nets it there. A reopen asking more than the wallet paid the round is refused and filed. An admin can collect or write off under an idempotency key.
• Reconciliation findings, admin align-with-provider (the provider's answer is applied only to the bet state it asked about), and a reconcile cron for stale reserves and overdue accepted bets.
• RG loss-limit re-evaluation on every money leg and every debt change. Each bet leg writes its audit row in its own transaction, with the player as actor.
• Every bet, debt, balance and restriction event is written to the outbox in the transaction that made the change (emitInTransaction). Its consumers (RG evaluation, session revoke) run once per event, so a redelivery adds no second job.
• A test provider plugin and three E2E suites (ledger, reconcile, routes) through bootE2e.
• fix(gamification): migration 0019 sets the rakeback and rank challenge product lists to empty (every product) on promo_rank_config rows still holding 0018's default, so a ladder that already paid on sportsbook keeps doing so. A list an operator changed is kept. New ladders keep the narrow default.

Outside the module, LanguageTagSchema (shared by the session locale and the casino category translation keys) now accepts a one-character subtag followed by another subtag, such as en-US-u-hc-h12.

Diagram

sequenceDiagram
  participant P as Provider
  participant O as Operator overlay
  participant L as SPORTSBOOK_LEDGER
  participant W as Wallet
  P->>O: signed callback
  O->>O: verify signature, decode
  O->>L: reserve / confirm / cancel / settle / reopen
  L->>W: wallet move, bet transaction row, replay answer (one tx)
  L-->>O: applied | replayed | refused(reason)
  O-->>P: provider response

Loading

Alternatives considered

• A core callback route per provider: puts vendor protocol in core and makes a second provider a core release.
• Settlement over domain events: money never travels over events (ADR-0017), and a lost or reordered event pays twice or not at all.
• A port that takes the caller's transaction, like GAMING_COMMANDS: the overlay would then own the lock order and the transaction boundary.

Risks

• Reserve does not repeat the platform geo check, which runs at session issue; a casino stake re-runs it. A country the platform blocks after a session opened keeps staking until that session expires or is revoked. The sportsbook's own blockedCountries is re-checked at reserve.
• Deploy workers before producers: older workers reject the new sportsbook.rg-revoke queue and the new RG eval trigger values.
• Gamification migration 0019 resets a product list only while it still holds 0018's default. A list an operator saved as exactly that default set cannot be told apart and is reset to every product too.
• GGR and RG spend are cash-basis for a reopened bet, so an offset can land in a later period than the payout it reverses. The loss limit is still not enforced at stake time.
• Each provider callback writes its audit_log row in its own transaction, so it holds the global audit chain lock until commit. The lock is taken last, but callbacks serialize with every other audited write while they hold it.
• Sportsbook stakes are real money only, by platform rule. Bonus money on sports bets would need a later change to core.