Look up derived feeds everywhere, not just in config

Moving OPML feeds into the database left several call sites still
searching config.toml only, so anything inside a subscription looked
unsubscribed: Download failed outright, status and the startup line
counted 3 feeds instead of 85, add could duplicate or collide with a
derived feed, and rm could not remove one.

The first grep for this missed the failing call because the method chain
spans lines; searching with newlines collapsed found all of them.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AdXho5tTkjFLeUXKbEjKBh

PROGRESS.md

@@ -56,6 +56,32 @@ and until now nothing set them.
 
 ---
 
+## 2026-09-10 — Regression: derived feeds looked "unsubscribed" to half the code
+
+Reported as `error: enclosure 235 belongs to unsubscribed feed "abort-retry-fail"`. Moving OPML
+feeds out of config.toml meant a config-only lookup no longer finds them, and `download_one` still
+did exactly that — so Download on any episode from an OPML subscription failed outright.
+
+Worse than the one bug: **my first grep for the pattern gave false confidence.** `grep -n
+'cfg\.feeds\.get'` returned three hits, all legitimate, so it looked clean — but the failing call
+was split across lines, `cfg` then `.feeds` then `.get`, and never matched. Re-searching with
+newlines collapsed found sixteen `.feeds` accesses, several of them wrong:
+
+- `download_one` — the reported failure.
+- `Status` and the daemon's startup line counted config feeds only: 3 reported where there are 85.
+- `add` deduped and slugged against config only, so adding a URL an OPML already lists would have
+  duplicated it, and a new feed could collide with a derived feed's id.
+- `rm` on a derived feed said "no feed with id".
+- The web add endpoint had the same duplicate hole.
+
+All now go through `subscriptions()`. Verified against the exact failure: enclosure 235 went
+`pending` -> `done`.
+
+Lesson recorded because it will recur: when a lookup moves, a single-line grep is not a survey.
+Collapse newlines before searching Rust method chains.
+
+---
+
 ## 2026-09-10 — OPML feeds out of the config, a real cap, and daemon output in the log
 
 Three reports in quick succession, all fair.