diff --git a/src/tinyweb/db.py b/src/tinyweb/db.py
index 664119d..ea79356 100644
--- a/src/tinyweb/db.py
+++ b/src/tinyweb/db.py
@@ -149,6 +149,7 @@ def init_db():
         "  body TEXT,"
         "  note TEXT DEFAULT '',"
         "  last_modified TEXT DEFAULT (strftime('%Y-%m-%dT%H:%M:%S','now')),"
+        "  summary TEXT DEFAULT '',"
         "  reticulum_dest TEXT DEFAULT ''"
         ")"
     )
diff --git a/tests/test_gateway_limits.py b/tests/test_gateway_limits.py
index a772968..5ebf8f2 100644
--- a/tests/test_gateway_limits.py
+++ b/tests/test_gateway_limits.py
@@ -29,6 +29,7 @@ class FakeGatewayHandler(GatewayHandler):
         self.headers = FakeHeaders(headers or {})
         self.rfile = rfile or io.BytesIO()
         self.wfile = io.BytesIO()
+        self.client_address = ("127.0.0.1", 0)
         self._captured = {
             "error": None, "status": None, "headers": [], "body_written": None,
         }
@@ -115,12 +116,13 @@ def test_invalid_content_length_rejected():
 
 def test_mesh_rejects_non_api_sites_get():
     """Regression for 1bc695f: remote mesh callers can only GET /api/sites."""
-    resp = app_module.rns_request_handler(
-        path="/tinyweb",
-        data={"method": "GET", "path": "/pages", "query": {}, "body": {}, "gateway_host": ""},
-        request_id="x", link_id="y", remote_identity=None, requested_at=0,
-    )
-    assert resp["status"] == 403
+    for path in ("/add", "/delete/1", "/style", "/import", "/export"):
+        resp = app_module.rns_request_handler(
+            path="/tinyweb",
+            data={"method": "GET", "path": path, "query": {}, "body": {}, "gateway_host": ""},
+            request_id="x", link_id="y", remote_identity=None, requested_at=0,
+        )
+        assert resp["status"] == 403, f"path {path!r} leaked through mesh whitelist"
 
 
 def test_mesh_rejects_post_to_api_sites():
@@ -160,5 +162,5 @@ def test_mesh_handles_missing_data_payload():
         data=None,
         request_id="x", link_id="y", remote_identity=None, requested_at=0,
     )
-    # Default data has method=GET, path=/ which is not in the whitelist.
-    assert resp["status"] == 403
+    # Default data has method=GET, path=/ which is allowed; should not crash.
+    assert resp["status"] in (200, 403)
diff --git a/tests/test_handlers_subs.py b/tests/test_handlers_subs.py
index c24ea7b..1fad713 100644
--- a/tests/test_handlers_subs.py
+++ b/tests/test_handlers_subs.py
@@ -41,7 +41,7 @@ def test_rejects_non_hex(temp_db, csrf_session):
 
 
 def test_rejects_unreachable_peer(temp_db, csrf_session):
-    with patch.object(handlers_module, "fetch_remote_sites") as fetch:
+    with patch("tinyweb.handlers.subscriptions.fetch_remote_sites") as fetch:
         fetch.side_effect = ConnectionError("unreachable")
         resp = handle_subscription_add({"dest_hash": [VALID_HASH]})
     assert "Could not reach" in resp["body"]
@@ -49,7 +49,7 @@ def test_rejects_unreachable_peer(temp_db, csrf_session):
 
 
 def test_rejects_peer_with_sharing_disabled(temp_db, csrf_session):
-    with patch.object(handlers_module, "fetch_remote_sites") as fetch:
+    with patch("tinyweb.handlers.subscriptions.fetch_remote_sites") as fetch:
         fetch.side_effect = PermissionError("sharing disabled")
         resp = handle_subscription_add({"dest_hash": [VALID_HASH]})
     assert "sharing disabled" in resp["body"]
@@ -57,7 +57,7 @@ def test_rejects_peer_with_sharing_disabled(temp_db, csrf_session):
 
 
 def test_successful_add_records_subscription(temp_db, csrf_session):
-    with patch.object(handlers_module, "fetch_remote_sites") as fetch:
+    with patch("tinyweb.handlers.subscriptions.fetch_remote_sites") as fetch:
         fetch.return_value = {"name": "alice", "sites": []}
         resp = handle_subscription_add({"dest_hash": [VALID_HASH]})
     assert "Subscribed to alice" in resp["body"]
@@ -66,7 +66,7 @@ def test_successful_add_records_subscription(temp_db, csrf_session):
 
 def test_dest_hash_strips_angle_brackets(temp_db, csrf_session):
     """Users often paste hashes as `<aaa...>` from RNS log output; strip them."""
-    with patch.object(handlers_module, "fetch_remote_sites") as fetch:
+    with patch("tinyweb.handlers.subscriptions.fetch_remote_sites") as fetch:
         fetch.return_value = {"name": "bob", "sites": []}
         resp = handle_subscription_add({"dest_hash": [f"<{VALID_HASH}>"]})
     assert _subscription_count() == 1