Re-audit round 4: 5 blind reviewers over the new surface — 24 fixes, +28 tests

The findings clustered exactly where prediction said: the unreviewed web
layer. The big ones: decisions made while an extract/resolve job runs
are now refused with a 409 (the job's end-of-run rewrite from a
start-of-run snapshot would silently revert them); a cross-origin guard
blocks preflight-free mutations from hostile webpages (bodyless run
triggers, cross-site photo form posts); the JobRunner sets terminal
status in a finally catching BaseException (a greenlet death could
wedge every future run behind 409s) and writes tracebacks into the
visible job log; and a boot token lets clients accept the revision
reset after a server restart instead of freezing forever.

Even the thrice-audited core yielded one HIGH: an unvetoed bare
typo-read sibling of a confident row duplicated its add when the game
wasn't in the collection — diff now treats it as satisfied. Second-copy
adds carry a flag through to_add.csv and the upload log so verify
honestly reports them unverifiable instead of OK. Also: merged_into
chains collapse transitively; diff/enrich treat a BGG queue timeout
like a missing token; enrich prunes orphaned games.json keys; the
wizard shell-quotes .env values and creates the file 0600 from the
first byte; fsio stats the tmp inode before replace and uses unique tmp
names; an explicit missing --config errors; storage state is
owner-only; extract re-extracts corrupt caches, aborts on 3 identical
failures, and exits nonzero when nothing succeeded; torn JSON artifacts
degrade with in-browser warnings instead of 500ing every page; photo
uploads are atomic with cache-invalidation ordered first; the pipeline
page computes `running` before the buttons that depend on it; the
photo dropzone alerts on network failure; and lost-contact banners
clear on recovery everywhere.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/test_init.py

@@ -43,8 +43,8 @@ def test_creates_dirs_config_and_env_from_nothing(tmp_path, monkeypatch):
     assert (tmp_path / "photos").is_dir() and (tmp_path / "data").is_dir()
     assert (tmp_path / "config.toml").exists()
     env = (tmp_path / ".env").read_text()
-    assert "ANTHROPIC_API_KEY=sk-test-123" in env
-    assert "BGG_USERNAME=eric" in env
+    assert "ANTHROPIC_API_KEY='sk-test-123'" in env
+    assert "BGG_USERNAME='eric'" in env
     assert report.keys_written == ["ANTHROPIC_API_KEY", "BGG_USERNAME"]
     assert set(report.keys_missing) == {"BGG_PASSWORD", "BGG_API_TOKEN"}
 
@@ -117,3 +117,33 @@ def test_secret_values_never_appear_in_output(tmp_path, monkeypatch, capsys):
     _clear_env(monkeypatch)
     _run(tmp_path, answers={"BGG_PASSWORD": "s3cret-value-xyz"})
     assert "s3cret-value-xyz" not in capsys.readouterr().out
+
+
+def test_values_are_shell_quoted_for_source(tmp_path, monkeypatch):
+    # a password with spaces, $, and quotes must survive `source .env`
+    _clear_env(monkeypatch)
+    _run(tmp_path, answers={"BGG_PASSWORD": "pa$s wo'rd"})
+    env = (tmp_path / ".env").read_text()
+    assert "BGG_PASSWORD='pa$s wo'\\''rd'" in env
+
+
+def test_env_parsing_negatives(tmp_path, monkeypatch):
+    # commented, quoted-empty, and export-prefixed lines must parse sanely
+    _clear_env(monkeypatch)
+    (tmp_path / ".env").write_text(
+        "# BGG_PASSWORD=commented-out\n"
+        'ANTHROPIC_API_KEY=""\n'
+        "export BGG_USERNAME='eric'\n"
+    )
+    report = _run(tmp_path)
+    assert "BGG_USERNAME" in report.keys_ready  # export form recognized
+    assert "ANTHROPIC_API_KEY" in report.keys_missing  # quoted-empty ≠ set
+    assert "BGG_PASSWORD" in report.keys_missing  # comments don't count
+
+
+def test_env_file_is_owner_only_from_creation(tmp_path, monkeypatch):
+    import os as _os
+
+    _clear_env(monkeypatch)
+    _run(tmp_path, answers={"BGG_API_TOKEN": "tok-123"})
+    assert _os.stat(tmp_path / ".env").st_mode & 0o777 == 0o600