Audit round 5 (curation feature): 5 blind reviewers, 14 confirmed fixes

The standing post-feature audit over a7f0cfe. Correctness (data): splits
become photo-scoped store records so splitting one edition no longer
force-splits same-named editions, and renaming a split copy migrates its
protection to the corrected title instead of silently re-merging copies.
Correctness (web): edit scoping now counts siblings by NORMALIZED title
(matching how stored edits apply), same-title-same-photos edits are
refused rather than corrupting the sibling entry, split copies serve
their real per-photo cues to the edit form instead of blanks, and a
split whose row vanished underneath returns 409 instead of a false 200.
Silent failures: replay_titles refuses to rebuild from a PARTIAL raw
cache (fresh clone + one --only extract would have truncated the
committed titles.json); the edit endpoint writes in crash-safe order
(cull, record, replay); corrupt curation stores fail loud naming the
file; retried edits don't double-record. Review-decision durability:
drop_rows never drops dedupe_veto rows — a rename retitles them in
place — and writes through a no-reload path so a concurrent rewrite
can't silently discard the cull. Style: catalog action cells get their
own class (.rowactions' flex display broke table alignment), editor
inputs match the design system and stop overriding the global
focus-visible outline, EditBody's clear-semantics docstring scoped to
cue fields, "nothing to change" derived from the record itself.

Tests: 8 new (photo-scoped splits, veto preservation, photo-narrowed
drops, 409s on both curation endpoints under a running job, partial-raw
replay guard, rename-keeps-protection lifecycle, corrupt-store error,
cue-field editing) and the dead edition_hint key in the edit test now
exercises real cue fields. 259 passing.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016jXZFSTZQKzAC8fqpWSz9g

tests/test_extract.py

@@ -177,11 +177,34 @@ def test_dedupe_conflicting_years_stay_separate():
 def test_dedupe_split_titles_never_merge():
     deduped = dedupe_entries(
         [_entry("Wiz-War", "a.jpg"), _entry("Wiz-War", "b.jpg")],
-        split_titles={"wiz war"},
+        splits=[{"norm": "wiz war", "photos": None}],
     )
     assert len(deduped) == 2  # the human said: separate physical copies
 
 
+def test_photo_scoped_split_spares_other_editions():
+    # splitting the copies seen in a/b must not force-split a same-named
+    # different edition (c/d, kept separate by its conflicting cue)
+    entries = [
+        _entry("Carcassonne", "a.jpg", publisher_hint="Rio Grande"),
+        _entry("Carcassonne", "b.jpg", publisher_hint="Rio Grande"),
+        _entry("Carcassonne", "c.jpg", publisher_hint="Z-Man"),
+        _entry("Carcassonne", "d.jpg", publisher_hint="Z-Man"),
+    ]
+    splits = [{"norm": "carcassonne", "photos": {"a.jpg", "b.jpg"}}]
+    deduped = dedupe_entries(entries, splits)
+    photo_sets = [e["source_photos"] for e in deduped]
+    assert ["a.jpg"] in photo_sets and ["b.jpg"] in photo_sets  # split copies
+    assert ["c.jpg", "d.jpg"] in photo_sets  # other edition still dedupes
+
+
+def test_corrupt_store_fails_loud_with_filename(tmp_path):
+    path = tmp_path / "title_splits.json"
+    path.write_text("<<<<<<< merge conflict")
+    with pytest.raises(ValueError, match="title_splits.json"):
+        load_title_splits(path)
+
+
 def test_edits_fix_misreads_before_dedupe():
     # a corrected misspelling merges with the correctly-read sighting
     edits = [{"match": "Hebarceos", "title_raw": "Herbaceous"}]
@@ -219,12 +242,16 @@ def test_stores_roundtrip_and_replay_from_raw(tmp_path):
         (raw / f"{photo}.json").write_text(
             json.dumps({"titles": [_entry("Wiz-War", photo)], "unidentified": []})
         )
-    record_title_split(cfg.title_splits_path, "Wiz-War")
-    record_title_split(cfg.title_splits_path, "wiz war")  # dupe, normalized away
+    record_title_split(cfg.title_splits_path, "Wiz-War", ["a.jpg", "b.jpg"])
+    record_title_split(cfg.title_splits_path, "wiz war", ["a.jpg"])  # covered: no dupe
     record_title_edit(
         cfg.title_edits_path,
         {"match": "Wiz-War", "photos": ["a.jpg"], "edition_hint": "7th Edition"},
     )
+    record_title_edit(  # identical retry must not double-record
+        cfg.title_edits_path,
+        {"match": "Wiz-War", "photos": ["a.jpg"], "edition_hint": "7th Edition"},
+    )
     replay_titles(cfg)
     titles = json.loads(cfg.titles_path.read_text())
     assert [e["source_photos"] for e in titles] == [["a.jpg"], ["b.jpg"]]
@@ -242,13 +269,31 @@ def test_stores_roundtrip_and_replay_from_raw(tmp_path):
     assert len(json.loads(cfg.titles_path.read_text())) == 2
 
 
+def test_replay_ignores_partial_raw_caches(tmp_path):
+    # fresh-clone shape: committed titles.json spans two photos, but only
+    # one raw cache file exists (raw is gitignored) — replay must not
+    # rebuild from the partial raws and truncate the catalog
+    cfg = Config(data_dir=tmp_path / "data", photos_dir=tmp_path / "photos")
+    raw = cfg.extract_raw_dir
+    raw.mkdir(parents=True)
+    (raw / "a.jpg.json").write_text(
+        json.dumps({"titles": [_entry("Catan", "a.jpg")], "unidentified": []})
+    )
+    cfg.titles_path.write_text(
+        json.dumps([_entry("Catan", "a.jpg"), _entry("Wingspan", "b.jpg")])
+    )
+    replay_titles(cfg)
+    titles = {e["title_raw"] for e in json.loads(cfg.titles_path.read_text())}
+    assert titles == {"Catan", "Wingspan"}
+
+
 def test_replay_without_raw_caches_explodes_merged_entries(tmp_path):
     cfg = Config(data_dir=tmp_path / "data", photos_dir=tmp_path / "photos")
     cfg.data_dir.mkdir(parents=True)
     merged = _entry("Wiz-War", "a.jpg")
     merged["source_photos"] = ["a.jpg", "b.jpg", "c.jpg"]
     cfg.titles_path.write_text(json.dumps([merged, _entry("Catan", "a.jpg")]))
-    record_title_split(cfg.title_splits_path, "Wiz-War")
+    record_title_split(cfg.title_splits_path, "Wiz-War", ["a.jpg", "b.jpg", "c.jpg"])
     replay_titles(cfg)
     titles = json.loads(cfg.titles_path.read_text())
     by_title = {}

tests/test_resolve.py

@@ -444,7 +444,7 @@ def test_dedupe_matches_skips_split_titles():
         _mrow("Wiz-War", "94", "a.jpg"),
         _mrow("Wiz-War", "94", "b.jpg"),
     ]
-    assert dedupe_matches(rows, [], split_titles={"wiz war"}) == []
+    assert dedupe_matches(rows, [], splits=[{"norm": "wiz war", "photos": None}]) == []
     assert all(not r["merged_into"] for r in rows)
 
 

tests/test_webreview.py

@@ -477,8 +477,10 @@ def test_rowless_multiphoto_title_is_splittable(tmp_path):
     copies = [c for c in res.json()["catalog"] if c["title_raw"] == "Wiz-War"]
     assert [c["photos"] for c in copies] == [["shelf.jpg"], ["shelf2.jpg"]]
     assert all(c["can_split"] is False for c in copies)
-    # the decision persisted: the store holds it and titles.json is split
-    assert "Wiz-War" in json.loads(cfg.title_splits_path.read_text())
+    # the decision persisted: the store holds it (photo-scoped) and
+    # titles.json is split
+    (record,) = json.loads(cfg.title_splits_path.read_text())
+    assert record == {"title": "Wiz-War", "photos": ["shelf.jpg", "shelf2.jpg"]}
     per_photo = [
         e["source_photos"]
         for e in json.loads(cfg.titles_path.read_text())
@@ -510,7 +512,8 @@ def test_edit_title_corrects_read_and_requeues_row(tmp_path):
             "title_raw": "Citadels",
             "source_photos": "shelf.jpg",
             "title_new": "Citadels: Dark City",
-            "edition_hint": None,
+            "edition": "2nd Edition",
+            "publisher": "",
             "year": "2004",
         },
     )
@@ -524,10 +527,13 @@ def test_edit_title_corrects_read_and_requeues_row(tmp_path):
         if e["title_raw"] == "Citadels: Dark City"
     )
     assert corrected["year_hint"] == 2004
-    assert corrected["publisher_hint"] == "Fantasy Flight"  # untouched cue kept
+    assert corrected["edition_hint"] == "2nd Edition"
+    assert corrected["publisher_hint"] == ""  # empty string cleared the cue
+    assert not corrected.get("language_hint")  # untouched (was unset)
     assert not any(r["title_raw"] == "Citadels" for r in read_matches(cfg.matches_path))
     (record,) = json.loads(cfg.title_edits_path.read_text())
     assert record["match"] == "Citadels"
+    assert record["publisher_hint"] == ""
 
 
 def test_edit_title_rejects_empty_and_noop(tmp_path):
@@ -561,3 +567,162 @@ def test_edit_title_rejects_empty_and_noop(tmp_path):
         ).status_code
         == 404
     )
+
+
+def test_edit_preserves_vetoed_rows_and_renames_them(tmp_path):
+    cfg = make_cfg(tmp_path)
+    rows = read_matches(cfg.matches_path)
+    rows.append(
+        _row(
+            title_raw="Citadels",
+            match_status="approved",
+            bgg_id="478",
+            source_photos="shelf2.jpg",
+            dedupe_veto="1",
+        )
+    )
+    write_matches(cfg.matches_path, rows)
+    web = TestClient(create_app(cfg, client=unauthorized_client(tmp_path)))
+    res = web.post(
+        "/api/edit-title",
+        json={
+            "title_raw": "Citadels",
+            "source_photos": "shelf.jpg",
+            "title_new": "Citadels (2016)",
+        },
+    )
+    assert res.status_code == 200
+    after = read_matches(cfg.matches_path)
+    # the human-vetoed row survives the cull, renamed to follow the entry;
+    # the unvetoed ambiguous row is requeued (dropped)
+    veto = [r for r in after if r.get("dedupe_veto")]
+    assert len(veto) == 1
+    assert veto[0]["title_raw"] == "Citadels (2016)"
+    assert veto[0]["match_status"] == "approved"
+    assert not any(
+        r["title_raw"] == "Citadels" and not r.get("dedupe_veto") for r in after
+    )
+
+
+def test_drop_rows_photo_narrowing_spares_other_copy(tmp_path):
+    import io as _io
+
+    from rich.console import Console
+
+    from bggpipe.review import ReviewSession
+
+    cfg = make_cfg(tmp_path)
+    write_matches(
+        cfg.matches_path,
+        [
+            _row(title_raw="Wiz-War", match_status="auto", source_photos="a.jpg"),
+            _row(title_raw="Wiz-War", match_status="auto", source_photos="b.jpg"),
+        ],
+    )
+    session = ReviewSession(
+        cfg,
+        console=Console(file=_io.StringIO()),
+        input_fn=lambda prompt: "",
+        client=unauthorized_client(tmp_path),
+    )
+    assert session.drop_rows("Wiz-War", ["a.jpg"]) == 1
+    (survivor,) = read_matches(cfg.matches_path)
+    assert survivor["source_photos"] == "b.jpg"
+
+
+def test_split_and_edit_refuse_while_pipeline_rewrites(tmp_path):
+    import threading
+
+    from bggpipe.jobs import JobRunner
+
+    cfg = make_cfg(tmp_path)
+    _rowless_wizwar(cfg)
+    release = threading.Event()
+    started = threading.Event()
+
+    def blocking_extract():
+        started.set()
+        release.wait(timeout=5)
+
+    jobs = JobRunner()
+    web = TestClient(
+        create_app(
+            cfg,
+            client=unauthorized_client(tmp_path),
+            stages={"extract": blocking_extract},
+            jobs=jobs,
+        )
+    )
+    assert web.post("/api/run/extract").status_code == 200
+    assert started.wait(timeout=5)
+    try:
+        split = web.post(
+            "/api/split",
+            json={
+                "title_raw": "Wiz-War",
+                "source_photos": "shelf.jpg;shelf2.jpg",
+                "row_ix": None,
+            },
+        )
+        edit = web.post(
+            "/api/edit-title",
+            json={
+                "title_raw": "Wiz-War",
+                "source_photos": "shelf.jpg;shelf2.jpg",
+                "title_new": "Wiz-War!",
+            },
+        )
+    finally:
+        release.set()
+    assert split.status_code == 409
+    assert edit.status_code == 409
+    # neither curation store was written under the in-flight rewrite
+    assert not cfg.title_splits_path.exists()
+    assert not cfg.title_edits_path.exists()
+
+
+def test_renaming_a_split_copy_keeps_split_protection(tmp_path):
+    cfg = make_cfg(tmp_path)
+    _rowless_wizwar(cfg)
+    web = TestClient(create_app(cfg, client=unauthorized_client(tmp_path)))
+    assert (
+        web.post(
+            "/api/split",
+            json={
+                "title_raw": "Wiz-War",
+                "source_photos": "shelf.jpg;shelf2.jpg",
+                "row_ix": None,
+            },
+        ).status_code
+        == 200
+    )
+    # rename BOTH copies to the same corrected title, one at a time — the
+    # store must keep protecting them or the rebuild re-merges the copies
+    for photo in ("shelf.jpg", "shelf2.jpg"):
+        assert (
+            web.post(
+                "/api/edit-title",
+                json={
+                    "title_raw": "Wiz-War",
+                    "source_photos": photo,
+                    "title_new": "Wiz War 2000",
+                },
+            ).status_code
+            == 200
+        )
+    per_photo = [
+        e["source_photos"]
+        for e in json.loads(cfg.titles_path.read_text())
+        if e["title_raw"] == "Wiz War 2000"
+    ]
+    assert per_photo == [["shelf.jpg"], ["shelf2.jpg"]]  # still two copies
+
+
+def test_single_photo_rowless_entry_is_not_splittable(tmp_path):
+    web, _ = make_client(tmp_path)
+    line = next(
+        c
+        for c in web.get("/api/state").json()["catalog"]
+        if c["title_raw"] == "Fresh Off The Shelf"
+    )
+    assert line["can_split"] is False