Re-audit round 4: 5 blind reviewers over the new surface — 24 fixes, +28 tests

The findings clustered exactly where prediction said: the unreviewed web
layer. The big ones: decisions made while an extract/resolve job runs
are now refused with a 409 (the job's end-of-run rewrite from a
start-of-run snapshot would silently revert them); a cross-origin guard
blocks preflight-free mutations from hostile webpages (bodyless run
triggers, cross-site photo form posts); the JobRunner sets terminal
status in a finally catching BaseException (a greenlet death could
wedge every future run behind 409s) and writes tracebacks into the
visible job log; and a boot token lets clients accept the revision
reset after a server restart instead of freezing forever.

Even the thrice-audited core yielded one HIGH: an unvetoed bare
typo-read sibling of a confident row duplicated its add when the game
wasn't in the collection — diff now treats it as satisfied. Second-copy
adds carry a flag through to_add.csv and the upload log so verify
honestly reports them unverifiable instead of OK. Also: merged_into
chains collapse transitively; diff/enrich treat a BGG queue timeout
like a missing token; enrich prunes orphaned games.json keys; the
wizard shell-quotes .env values and creates the file 0600 from the
first byte; fsio stats the tmp inode before replace and uses unique tmp
names; an explicit missing --config errors; storage state is
owner-only; extract re-extracts corrupt caches, aborts on 3 identical
failures, and exits nonzero when nothing succeeded; torn JSON artifacts
degrade with in-browser warnings instead of 500ing every page; photo
uploads are atomic with cache-invalidation ordered first; the pipeline
page computes `running` before the buttons that depend on it; the
photo dropzone alerts on network failure; and lost-contact banners
clear on recovery everywhere.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/test_extract.py

@@ -317,3 +317,35 @@ def test_low_confidence_reads_are_surfaced(tmp_path, capsys):
     assert "Low-confidence reads" in out
     assert "'Patchwork' (medium)" in out
     assert "'Catan'" not in out.split("Low-confidence reads")[1]
+
+
+def test_corrupt_raw_cache_is_reextracted_not_skipped(tmp_path):
+    cfg = _cfg(tmp_path)
+    cfg.photos_dir.mkdir()
+    _write_image(cfg.photos_dir / "shelf.jpg")
+    vision, calls = _vision_stub('[{"title_raw": "Catan", "confidence": "high"}]')
+    run_extract(cfg, vision=vision)
+    raw = cfg.extract_raw_dir / "shelf.jpg.json"
+    raw.write_text("{torn")  # corrupt the cache
+    run_extract(cfg, vision=vision)
+    assert len(calls) == 2  # re-extracted, not skipped
+    json.loads(raw.read_text())  # cache healed
+
+
+def test_systemic_failures_abort_and_exit_nonzero(tmp_path):
+    import pytest
+    import typer as _typer
+
+    calls = []
+
+    def broken_vision(image_b64, media_type):
+        calls.append(1)
+        raise RuntimeError("invalid x-api-key")
+
+    cfg = _cfg(tmp_path)
+    cfg.photos_dir.mkdir()
+    for i in range(6):
+        _write_image(cfg.photos_dir / f"p{i}.jpg")
+    with pytest.raises(_typer.Exit):
+        run_extract(cfg, vision=broken_vision)
+    assert len(calls) == 3  # aborted after 3 identical failures