Audit: 5-reviewer sweep — 19 fixes across every stage, +24 tests

Correctness: review vetoes persist via a dedupe_veto column (resolve
re-runs no longer overturn humans); diff emits second copies whose
confident version matches no owned copy (spec: pairs own only on both
ids) and fetches the live collection with refresh; resolve pairs
titles.json entries to rows by title so a reshoot photo updates
provenance instead of duplicating rows; version lookups survive empty
/thing results; publisher tie-break now honors the mixed
base/expansion veto and refuses multi-candidate picks; empty-normalized
(non-Latin) titles never count as exact.

Upload: LoginError aborts a run instead of logging N bogus failures
(and 3 identical consecutive failures abort as systemic); Cloudflare
interstitials are detected; added-without-version gets its own logged
status that verify understands; same-game updates run one per pass so
the name-targeted row edit can't overwrite a fresh version; absent
diff outputs fail loudly; pagination clicks are paced.

Web review: a lock serializes freshen/decide (threadpool race dropped
decisions); failed saves roll memory back and always alert the browser
(non-JSON 500s included); session warnings reach the page instead of a
StringIO; state-load failures and dead servers show banners instead of
a blank page; duplicate (title, photos) rows are addressable by
ordinal.

Consistency: shared CONFIDENT_VERSION_STATUSES, client_for(),
Config paths for every artifact, one review-port constant, named
matching thresholds, strict collection-id parsing, error-doc responses
never cached, unknown config keys warn, extract reports dropped vision
entries, fixture generators share escaping + marker text.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/test_webreview.py

@@ -383,3 +383,23 @@ def test_own_saves_do_not_count_as_external_changes(tmp_path):
     write_matches(cfg.matches_path, session.rows + [_row(title_raw="X")])
     assert session.reload_if_changed() is True  # someone else's
     assert any(r["title_raw"] == "X" for r in session.rows)
+
+
+def test_session_warnings_surface_in_state(tmp_path):
+    web, cfg = make_client(tmp_path)
+    # a manual id triggers a lookup against the 401-ing client: the session
+    # degrades and the warning must reach the payload (the session console
+    # is a StringIO here — this is the only way the user ever sees it)
+    res = web.post(
+        "/api/decision",
+        json={
+            "title_raw": "Mystery",
+            "source_photos": "shelf.jpg",
+            "action": "manual",
+            "bgg_id": 42,
+        },
+    )
+    assert res.status_code == 200
+    warnings = res.json()["warnings"]
+    assert any("couldn't look up id 42" in w for w in warnings)
+    assert warnings == web.get("/api/state").json()["warnings"]