feat(market): isolated two-identity SOLD-row A/B harness (staging only, not promoted)

Static RE exhausted CardsDLL on the one open question: for a closed row
IS_GLOW = (bidState != none) and INBOX = (bidState in {highest, buyNow}), so
closed/highest and closed/buyNow are BIT-IDENTICAL natively. But bidState is
published to the movie verbatim as YOURBID, so the FUT ActionScript CAN separate
them. This builds the controlled experiment that asks the client which one it
treats as the seller's sale.

PRODUCTION SAFETY IS THE FIRST CONCERN
New module openfut-utas-host/src/sold_experiment.rs. Every knob is OFF unless its
env var is set, an unrecognised value is OFF rather than a default token (silently
picking one would fabricate the answer being measured), and the host logs a startup
banner naming the active variant so a staging capture can never be mistaken for a
production one. With no env set, /tradePile and /trade/status emit only real active
auctions (the Fix A invariant) and counts still report sold: 0. The entire existing
test suite now passes SoldExperiment::OFF explicitly, making it a regression guard.

  OPENFUT_FIFA17_SOLD_EXPERIMENT      = highest | buyNow   (else OFF)
  OPENFUT_FIFA17_SOLD_COINS_PROCESSED = 1                  (else 0)
  OPENFUT_FIFA17_SOLD_COUNT_MODE      = active_plus_sold    (else active)

WHAT THE EXPERIMENT PROJECTS
Uncleared sold listings appear in /tradePile and /trade/status as tradeState
"closed" with the token under test and currentBid = the sale price; counts report
the real sold tally. There is ONE record builder, so the A/B changes only what is
passed into it, and a test asserts that EXACTLY ONE field differs between the two
variants -- without that control the client's reaction is not attributable to the
token and the whole experiment is void. coinsProcessed (Flash COINS_AWARDED) varies
independently so the third pass cannot be confounded with the first.

CLEAR-SOLD, PE-PROVEN
New EconomyRoute::MarketClearSold for DELETE .../trade/sold, classified BEFORE the
generic trade cancel arm -- a `sold` tail carries no id, so the cancel handler would
have parsed nothing and acked while clearing nothing. Builder 0x1801647c0 emits
"/sold" when the tradeId field is zero and "/%lld" otherwise; the client calls it
RemoveAllSoldFromTradePile. New market-store column cleared_at records the seller's
acknowledgement SEPARATELY from the sale, so clearing can never be mistaken for
re-settling: it is presentation only, moves no coins and no ownership, and is
idempotent for client retries.

FOUND AND FIXED A LATENT STORE BUG
Adding a column via the additive ALTER path immediately after CREATE TABLE in the
same open() desynced sqlx's per-connection schema cache: a fresh store then read a
12-column row while metadata said 13, panicking a pool worker with an index
out-of-bounds and silently returning zero listings. Declaring cleared_at in
CREATE_LISTINGS fixes it; the ALTER now only serves pre-existing stores. This would
have bitten the next column too.

STAGING, WITHOUT TOUCHING PRODUCTION
The client learns the UTAS base from BLAZE (blaze_responder_v3b.py:646 hardcodes
:8099), and it dials that port directly, so redirecting UTAS means changing Blaze or
port 8099 -- both production. 10.10.0.121 is unreachable. The compliant path is a
parallel stack on spare ports plus a one-line change to the CLIENT's own config:
  * scripts/sold-staging-up.py / sold-staging-down.py -- staging Core 18081,
    utas-host 8299, Blaze 42327/42330/42331 advertising :8299, two seeded identities,
    own DBs under /home/alex/openfut-sold-staging/. Patches a COPY of the Blaze
    responder and asserts every substitution applied, so a silent no-op cannot leave
    it pointing at production. Kills only recorded pids whose cmdline contains the
    staging dir (openfut-utas-host matches BOTH, so pkill-by-pattern is banned).
  * docs/SOLD_STAGING_RUNBOOK.md -- the exact client change and its revert.
  * src/bin/staging_sell.rs -- the synthetic Buyer B, running the REAL settlement
    (CoreEconomy::settle_sale) then mark_sold. Settle-first ordering: a failure
    leaves the listing live with nothing moved. Refuses any path containing
    openfut-promotion or the production ports.
  * scripts/sold-wire-check.py -- proves the whole flow headless before any operator
    time is spent.

WIRE CHECK: 35/35 PASS on the canonical 150-coin sale. Seller 1,000 -> 1,143 (fee 7,
proceeds 143), buyer 20,000 -> 19,850, ownership transferred, exactly ONE
authoritative instance, economy shrank by exactly the fee. Sold row: closed,
currentBid 150, expires 0, twelve atoms, counts sold 1 / selling 0, /trade/status
agreeing. Variant B differs only in bidState and coinsProcessed. Clear: 200 {}, row
gone, counts.sold 0, no coins moved, buyer keeps the item, second clear a safe no-op.

Gates: 104 host lib tests (+9), all 7 host targets green, clippy clean, zero fmt
diffs in the new code. Settlement candidate unchanged. NOT PROMOTED.

Production untouched: prod-host pid 3631953 uptime 2h44m restarts=0, coins and
/tradePile unchanged, nothing under /home/alex/openfut-promotion/state/ opened.

The A/B itself is NOT yet run: it needs a real FIFA client, which is operator work.

openfut-utas-host/src/market_store.rs

@@ -206,7 +206,11 @@ const CREATE_LISTINGS: &str = "CREATE TABLE IF NOT EXISTS listings (
     state         TEXT NOT NULL CHECK (state IN ('active','reserved','sold','cancelled')),
     created_at    TEXT NOT NULL,
     item_json     TEXT,
-    duration_secs INTEGER
+    duration_secs INTEGER,
+    -- Seller acknowledgement of a SOLD row, separate from the sale itself. Declared
+    -- here so a fresh store never needs the ALTER path below; the additive
+    -- migration exists only for stores created before this column.
+    cleared_at    TEXT
 )";
 
 fn now_millis() -> String {
@@ -284,7 +288,17 @@ impl MarketStore {
             .iter()
             .map(|r| r.get::<String, _>("name"))
             .collect();
-        for (col, decl) in [("item_json", "TEXT"), ("duration_secs", "INTEGER")] {
+        for (col, decl) in [
+            ("item_json", "TEXT"),
+            ("duration_secs", "INTEGER"),
+            // A SOLD listing is not the end of the seller's involvement: FIFA 17 has
+            // a bulk `DELETE …/trade/sold` verb (builder 0x1801647c0, request name
+            // RemoveAllSoldFromTradePile), which only makes sense if sold rows
+            // PERSIST in the seller's pile until cleared. `cleared_at` records that
+            // acknowledgement separately from the sale itself, so clearing a row can
+            // never be mistaken for re-settling it.
+            ("cleared_at", "TEXT"),
+        ] {
             if !existing.iter().any(|c| c == col) {
                 sqlx::query(&format!("ALTER TABLE listings ADD COLUMN {col} {decl}"))
                     .execute(&pool)
@@ -474,6 +488,73 @@ impl MarketStore {
         }
     }
 
+    /// Mark a live listing SOLD in one step (`active | reserved -> sold`), for a
+    /// sale driven by a counterparty rather than by this client's own buy-now.
+    /// Returns whether this call was the one that sold it, so a replay is visible
+    /// to the caller instead of silently settling twice.
+    pub async fn mark_sold(&self, listing_id: &str) -> Result<bool, MarketError> {
+        let affected = sqlx::query(
+            "UPDATE listings SET state = 'sold' \
+             WHERE listing_id = ? AND state IN ('active', 'reserved')",
+        )
+        .bind(listing_id)
+        .execute(&self.pool)
+        .await
+        .map_err(db)?
+        .rows_affected();
+        Ok(affected == 1)
+    }
+
+    /// Sold listings the seller has NOT yet cleared, newest first.
+    ///
+    /// Separate from [`Self::query_listings`] because "sold" and "still shown to
+    /// the seller" are different facts: a sold row stays in the pile until the
+    /// client acknowledges it via the bulk clear verb.
+    pub async fn uncleared_sold(&self) -> Result<Vec<Listing>, MarketError> {
+        let rows = sqlx::query(
+            "SELECT * FROM listings WHERE state = 'sold' AND cleared_at IS NULL \
+             ORDER BY created_at DESC",
+        )
+        .fetch_all(&self.pool)
+        .await
+        .map_err(db)?;
+        Ok(rows.iter().map(row_to_listing).collect())
+    }
+
+    /// Acknowledge every uncleared sold listing (the bulk `DELETE …/trade/sold`).
+    /// Returns how many rows were cleared.
+    ///
+    /// This is PRESENTATION ONLY. It records that the seller has seen the sale; it
+    /// moves no coins and no ownership, because settlement already happened when
+    /// the sale completed. Clearing must never be able to pay anyone twice.
+    pub async fn clear_sold(&self) -> Result<u64, MarketError> {
+        Ok(sqlx::query(
+            "UPDATE listings SET cleared_at = ? \
+             WHERE state = 'sold' AND cleared_at IS NULL",
+        )
+        .bind(now_millis())
+        .execute(&self.pool)
+        .await
+        .map_err(db)?
+        .rows_affected())
+    }
+
+    /// Acknowledge ONE sold listing by id (the per-id `DELETE …/trade/{id}` form,
+    /// if the client turns out to use it for sold rows). Same presentation-only
+    /// contract as [`Self::clear_sold`].
+    pub async fn clear_sold_one(&self, listing_id: &str) -> Result<u64, MarketError> {
+        Ok(sqlx::query(
+            "UPDATE listings SET cleared_at = ? \
+             WHERE listing_id = ? AND state = 'sold' AND cleared_at IS NULL",
+        )
+        .bind(now_millis())
+        .bind(listing_id)
+        .execute(&self.pool)
+        .await
+        .map_err(db)?
+        .rows_affected())
+    }
+
     /// Undo a reservation on a downstream failure (`reserved -> active`), so the
     /// listing becomes buyable again. Not in `reserved` -> [`MarketError::Conflict`].
     pub async fn rollback_reservation(&self, listing_id: &str) -> Result<(), MarketError> {