[AnnieIj]

Closes #1454

Summary

vote and place_bet are the two exported ways to put tokens into a market. They wrote overlapping state (market.votes, market.stakes, market.total_staked) but checked different things: a vote followed by a bet silently overwrote the first stake (stranding those tokens — no claim path could reach them), and vote skipped the circuit breaker, stake validation, min/max bet limits, the max-participants accounting used by bets, and the per-ledger bet cap.

Both entrypoints now delegate to one validated stake ledger, bets::BetManager::record_stake(env, user, market_id, outcome, amount, source: StakeSource).

What changed

• record_stake (bets.rs) runs, in this exact order: circuit breaker ("betting") → global per-ledger bet cap → market state (Active) → bet deadline → outcome validity → amount bounds (BetValidator, incl. per-market cap) → duplicate stake across both ledgers → max_participants capacity → per-user cap → checked total_staked (Error::Overflow, no trap) → lock_funds → state writes. No state is written before the transfer succeeds.
• vote (lib.rs) keeps a single require_auth(), its voting rate limit, and now calls record_stake; the unchecked market.total_staked += stake is gone (grep -n 'total_staked +=' contracts/predictify-hybrid/src/lib.rs returns nothing).
• place_bet_inner delegates to record_stake for validation/ledger writes and only stores bet-specific state after lock_funds succeeds. The batch place_bets loop also rejects vote-ledger stakes.
• Duplicates: repeat vote → AlreadyVoted; repeat bet → AlreadyBet; cross-entrypoint stake (vote → bet or bet → vote) → AlreadyBet (single documented unified-ledger error, documented on Error::AlreadyBet in err.rs). The first stake is never overwritten.
• cancel_bet only removes ledger entries the bet created (its exact mirror in market.stakes); a mismatched entry (pre-unification vote residue) is left claimable.

Regression proof (master, d806a26)

Replayed row 1 on master: vote(1_000_000) then place_bet(2_000_000) by the same user succeeds — stakes[user] is overwritten to 2_000_000, total_staked becomes 3_000_000, and 1_000_000 stroops are stranded (locked in the contract, unreachable by any claim or cancel path). Under this fix the second call is rejected atomically and the stranded amount can no longer be created.

Legacy (pre-fix) markets — storage compatibility

No Market layout change. Existing markets where one user already has both a vote and a bet (the master bug state) remain claimable: the bet-side mirror in market.stakes is authoritative for claims and cancels — exactly what claim_winnings/cancel_bet have always paid from. Tested in test_legacy_dual_entry_market_remains_claimable (legacy claim pays out; the master residue inflates the pool and accrues to claimants instead of being stranded) and test_legacy_cancel_only_removes_bet_owned_entries (cancel refunds the bet amount; residue stays in totals for admin remediation).

Test output

cargo test -p predictify-hybrid --lib
test result: ok. 739 passed; 0 failed; 203 ignored

New module contracts/predictify-hybrid/src/stake_ledger_unification_tests.rs (13 tests) covers all 9 issue rows: vote-then-bet rejection, bet-then-vote same error, circuit breaker parity (CBOpen, no token transfer), identical amount-bound errors for both entrypoints, participant capacity, typed overflow near i128::MAX, cancel/refund/restore, conservation (balance minus fees == outstanding claimable), and pinned error precedence for both entrypoints — plus legacy compatibility and the vote rate-limit path.

Coverage (cargo-llvm-cov, --lib)

Function	Coverage
vote (lib.rs)	96.3%
place_bet_inner (bets.rs)	96.4%
record_stake (bets.rs)	100%
require_no_existing_stake (bets.rs)	100%

WASM size delta (slim build, scripts/build_testnet_wasm.sh)

Build	Size
master	129,898 bytes
this PR	129,567 bytes
delta	−331 bytes

Limit 131,072 bytes (128 KiB) — within budget. cargo check -p predictify-hybrid --no-default-features passes.