Re-audit round 3: 5 blind reviewers, 15 fixes, +18 tests — converging

Round 3's two HIGHs: _fill_version resolved versions with the LAST
same-title entry's cues (photo-aware lookup existed since round 1 but
this caller never used it), and the round-2 diff rework let an earlier
row's disagreement consume the exact-version copy a later row matched.
Diff claims now settle strongest-first across all rows (exact matches,
then versionless upgrades, then disagreement/second-copy), unvetoed
bare duplicates stay owned per spec, and updates are withheld with a
manual-fix note whenever any copy of the game already carries a version
(the row edit targets by name and could hit the wrong copy).

Also: entry-to-row pairing matches by photo overlap before position
(titles.json order churn from reshoot filenames could swap editions);
BGGQueueTimeout defers a title like a missing token; DismissStore
writes atomically, mutates memory only after the write, and
quarantines a torn file instead of bricking the server; version-picker
page-limit exhaustion stays retryable; verify's copy-count shortfall
reports once per game (the old guard was dead code); the upload log
header is created atomically; transient version-lookup failures record
a retryable version_error, not terminal version_unknown; extract
isolates per-photo failures and salvages JSON followed by prose; a
state revision counter stops stale poll responses reverting decisions;
plus the shared-predicate/fsio/docstring consolidation and CLI wiring,
live-diff, verify-wiring, and search-guard tests.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/test_review.py

@@ -419,3 +419,71 @@ def test_every_tui_decision_after_external_rewrite_is_saved(tmp_path):
     )
     assert "Newcomer" in saved  # the external row survived too
     assert session.decisions == 3
+
+
+def test_fill_version_uses_the_approved_rows_own_cues(tmp_path):
+    # round-3 HIGH: two same-title entries are two EDITIONS; the title-only
+    # dict handed every row the LAST entry's cues, scoring the wrong version
+    import json as _json
+
+    entry_good = {
+        "title_raw": "Wingspan",
+        "publisher_hint": "Stonemaier",  # matches the fixture's version
+        "year_hint": 2019,
+        "source_photos": ["good.jpg"],
+    }
+    entry_bad = {
+        "title_raw": "Wingspan",
+        "publisher_hint": "Nobody Media",  # matches nothing
+        "edition_hint": "Imaginary edition",
+        "source_photos": ["bad.jpg"],
+    }
+    cfg = _setup(
+        tmp_path,
+        [
+            _row(
+                title_raw="Wingspan",
+                match_status="ambiguous",
+                source_photos="good.jpg",
+                candidates_json=_json.dumps(
+                    [{"bgg_id": 266192, "name": "Wingspan", "year": 2019}]
+                ),
+            )
+        ],
+    )
+    (cfg.data_dir / "titles.json").write_text(_json.dumps([entry_good, entry_bad]))
+    session = ReviewSession(
+        cfg, console=quiet_console(), input_fn=scripted(), client=fixture_client()
+    )
+    row = session.rows[0]
+    session.decide_pick(row, {"bgg_id": 266192, "name": "Wingspan", "year": 2019})
+    # with last-wins cues (entry_bad) this was version_unknown; the row's own
+    # photo (good.jpg) must select entry_good's cues and find the version
+    assert row["version_status"] == "version_auto"
+    assert row["version_id"] == "465063"
+
+
+def test_dismiss_failure_keeps_ticket_visible(tmp_path, monkeypatch):
+    import bggpipe.webreview as webreview_mod
+    from bggpipe.webreview import DismissStore
+
+    store = DismissStore(tmp_path / "dismissed.json")
+
+    def exploding(path, text):
+        raise OSError("disk full")
+
+    monkeypatch.setattr(webreview_mod, "atomic_write_text", exploding)
+    with pytest.raises(OSError):
+        store.add("photo|loc|txt|art")
+    assert store.keys == set()  # memory never claims what disk doesn't hold
+
+
+def test_corrupt_dismiss_file_is_quarantined_not_fatal(tmp_path):
+    from bggpipe.webreview import DismissStore
+
+    path = tmp_path / "dismissed.json"
+    path.write_text('["torn')
+    with pytest.warns(UserWarning, match="unreadable"):
+        store = DismissStore(path)
+    assert store.keys == set()
+    assert (tmp_path / "dismissed.json.corrupt").exists()