## Review

- **Correct — Finding 1 (P1): Resolved.** Failed initial progress/detail retrieval now shows **Retry resume**, not Start (`frontend/src/pages/QuizPage.jsx:647–665,881`). Resume installs answers only after detail succeeds (`:591–615`). Start rechecks progress before initializing an empty answer map; lookup/resume failures exit before that write (`:672–714`). Autosave requires both attempt and mode (`:732–746`), preventing premature saves during recovery. Redis failures return 503 rather than empty progress or false success (`backend/app/routers/attempts.py:283–285,377–379`). Failed suspension retains the player and answers instead of navigating (`frontend/src/pages/QuizPage.jsx:1000–1024`). Behavioral coverage verifies failed-detail recovery, failed lookup, reused attempts, and suspension retry (`frontend/src/pages/QuizPage.test.jsx:58–106,120–136`; `backend/tests/test_study_tools.py:99–114`).

- **Correct — Finding 2 (P2): Resolved.** `allow_review` now accepts NULL (`backend/app/schemas/quiz.py:63`), matching the ORM and existing DDL. Course startup treats anything other than `1` as review-disabled (`frontend/src/pages/QuizPage.jsx:285`); backend mode selection remains fail-closed (`backend/app/routers/attempts.py:49–51`). Review authorization is unchanged (`backend/app/utils/quiz_access.py:47–51`). Tests cover NULL listing/detail serialization, exam-only course startup, hidden answers, and denied study override (`backend/tests/test_study_tools.py:80–97`; `frontend/src/pages/QuizPage.test.jsx:108–118`).

- **Correct — Finding 3 (P2): Resolved.** Importing `app.models` now registers `LabReference` (`backend/app/models/__init__.py:11`), so Alembic’s existing package import populates its target metadata (`backend/alembic/env.py:24–27`). The fresh-process regression checks registration without router-import contamination (`backend/tests/test_study_tools_migration.py:18–22`).

- **Blocker:** None identified in the three fixes or their directly affected paths.

- **Note:** Review was read-only. Test/build and PostgreSQL successes are parent-attested, not independently rerun. Existing tutor/private-image authorization issues remain a separate before-release task. This review makes no completion claim for later articles/cards/comments work.