Re-audit round 4: 5 blind reviewers over the new surface — 24 fixes, +28 tests

The findings clustered exactly where prediction said: the unreviewed web
layer. The big ones: decisions made while an extract/resolve job runs
are now refused with a 409 (the job's end-of-run rewrite from a
start-of-run snapshot would silently revert them); a cross-origin guard
blocks preflight-free mutations from hostile webpages (bodyless run
triggers, cross-site photo form posts); the JobRunner sets terminal
status in a finally catching BaseException (a greenlet death could
wedge every future run behind 409s) and writes tracebacks into the
visible job log; and a boot token lets clients accept the revision
reset after a server restart instead of freezing forever.

Even the thrice-audited core yielded one HIGH: an unvetoed bare
typo-read sibling of a confident row duplicated its add when the game
wasn't in the collection — diff now treats it as satisfied. Second-copy
adds carry a flag through to_add.csv and the upload log so verify
honestly reports them unverifiable instead of OK. Also: merged_into
chains collapse transitively; diff/enrich treat a BGG queue timeout
like a missing token; enrich prunes orphaned games.json keys; the
wizard shell-quotes .env values and creates the file 0600 from the
first byte; fsio stats the tmp inode before replace and uses unique tmp
names; an explicit missing --config errors; storage state is
owner-only; extract re-extracts corrupt caches, aborts on 3 identical
failures, and exits nonzero when nothing succeeded; torn JSON artifacts
degrade with in-browser warnings instead of 500ing every page; photo
uploads are atomic with cache-invalidation ordered first; the pipeline
page computes `running` before the buttons that depend on it; the
photo dropzone alerts on network failure; and lost-contact banners
clear on recovery everywhere.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/test_diff.py

@@ -364,3 +364,36 @@ def test_live_diff_falls_back_to_snapshots_on_auth_failure(tmp_path, monkeypatch
     write_matches(cfg.matches_path, [_match("5 MINUTE DUNGEON", "207830")])
     result = run_diff(cfg, client=_LiveClient([], fail_auth=True))
     assert result.already_owned == ["5 MINUTE DUNGEON"]  # snapshots served
+
+
+def test_bare_sibling_of_confident_add_is_not_a_duplicate_upload():
+    # photo A reads "Wingspan" (confident version), photo B misreads
+    # "Wingspam" (bare) resolving to the same absent game: ONE add, not two
+    rows = [
+        _match("Wingspan", "266192", vstatus="version_auto", vid="1", vname="1st"),
+        _match("Wingspam", "266192"),
+    ]
+    result = compute_diff(rows, [])
+    assert len(result.to_add) == 1
+    assert result.already_owned == ["Wingspam"]
+
+
+def test_vetoed_bare_sibling_still_adds_for_absent_game():
+    vetoed = {**_match("Wingspan", "266192"), "dedupe_veto": "1"}
+    rows = [
+        _match("Wingspan", "266192", vstatus="version_auto", vid="1", vname="1st"),
+        vetoed,
+    ]
+    result = compute_diff(rows, [])
+    assert len(result.to_add) == 2
+    assert result.to_add[1]["second_copy"] == "1"
+
+
+def test_second_copy_flag_travels_on_exhausted_adds():
+    rows = [
+        _match("Catan", "13", vstatus="version_auto", vid="123", vname="3rd"),
+        _match("Catan", "13", vstatus="version_auto", vid="123", vname="3rd"),
+    ]
+    result = compute_diff(rows, [_item(13, 900, version_id=123)])
+    (added,) = result.to_add
+    assert added["second_copy"] == "1"