[ajaydsouza]

Fixes all 14 findings in the external review (reviews/2026-10-20-code-review.md, on the reviews/code-review-2026-10-20 branch). I checked each against the code and none turned out to be a false positive.

Fixes

#	Finding	Fix
1 (P1)	Real hostname fetches failed: with stream => true, Guzzle 8 picked its PHP-stream handler, which rejects the CURLOPT_RESOLVE pin. Guzzle 7 would have ignored the pin silently.	SafeHttpClient always uses Guzzle's cURL handler. The size cap is enforced by a progress callback that aborts the transfer. New RealTransportTest goes through the real transport: a made-up hostname is pointed at a local PHP server, which can only be reached through the pin. It covers a plain fetch, a redirect, oversized bodies (declared and undeclared) and a blocked address.
2 (P1)	Installer race, and anyone could claim a fresh deployment	One-time setup code read on the server (storage/app/install/setup-code). A non-blocking install lock with an ownership re-check inside it. createOwner() refuses once any account exists. The console installer shares the lock and the one-owner rule.
3	A database error reopened the installer	An installed marker keeps /install shut. Unexpected database errors return a 503. .env is written only after the account exists.
4	db:seed could add an account with a published password	The seeder refuses when any user exists and requires DOCKET_USER_PASSWORD; there's no fallback password any more.
5	Queue retry_after (90s) was shorter than the job timeout (300s)	retry_after is now 360s, and a WithoutOverlapping per-item lock on the job stops two fetches of the same item running at once.
6	Article bodies loaded into lists, bulk actions and exports	New withoutBodies() scope (search keeps it too). Bulk actions run in batches of 100. Exports and refetch page through items by ID.
7 + 14	Failed images didn't count towards the limit, and the lead image ignored the settings	ImageDownloads gives each article one budget shared by inline and lead images. It counts attempts, total bytes and time. The lead image follows the same on/off switch and reuses an inline copy if there is one.
8	A failed storage write left a broken local image link	The write result is checked; on failure the remote src is kept and a warning logged.
9	A failed refresh hid the saved article	hasArticle() depends only on stored content. The reader shows the saved copy with a "Could not refresh" note. A refresh that finds no article only fills in details that were missing.
10	Refetch skipped items	It now pages with lazyById().
11	Tags such as work/personal led to 404s	Tags are routed by ID.
12	CSV export kept spreadsheet formulas	New CSV for spreadsheets option (/export/csv?for=spreadsheet). The plain CSV stays lossless for re-importing.
13	Wrong restore instructions	The README now imports the SQL dump with sqlite3, checks it, and swaps it in with the site and worker stopped. I ran the steps with the real sqlite3 CLI: the FTS5 table and its triggers survive.

Tests

• New tests:
  • RealTransportTest
  • HardeningTest: one or more tests each for #5–#10, #12 and #14
  • DatabaseSeederTest
  • in WebInstallerTest: the setup code, the marker, a concurrent install refused with 409, a database error answered with 503
  • in InstallCommandTest: --force won't add a second owner
  • in OrganisingTest: tag names containing URL characters
• Updated: the installer tests send the setup code, and the tag tests use IDs.
• Each test gets its own installer-state directory, so tests can't leak install state to each other.

---

Generated by Claude Code