Committed migration 20260708120000 (NOT applied to live — operator apply per
docs/supabase-migration-reconciliation.md), schema.sql reconciled, drift manifest
regenerated (13s scratch replay, clean).

- R1/R2: complete_ingestion_job + fail_or_retry_ingestion_job take an optional
  p_worker_id lease fence. A worker reclaimed by a stale takeover now matches 0
  rows and returns ok:false lease_lost instead of clobbering the reclaimer's
  newer state (indexed->failed, completed->pending). Backward compatible
  (p_worker_id defaults null); the worker passes workerId and treats lease_lost
  as a stop, keeping the isMissingSchemaError fallback for pre-apply. This is the
  defense-in-depth complement to the lease heartbeat already in this PR.
- R7: fail_or_retry downgrades an attempt-exhausted retry to terminal 'failed'
  instead of a permanently-unclaimable 'pending' that pins its batch forever.
- R9: refresh_import_batch_status locks the import_batches row before counting,
  serializing concurrent last-job refreshes (lost-update that stuck batches as
  'processing').
- R23: cleanup_abandoned re-asserts the open-job guard immediately before the
  destructive deletes (it previously lived only in the candidate CTE, before the
  seven count statements).

HELD (evidence in PR): R17 open-jobs unique index (collides with drift backlog
#7, ingestion_jobs index reshape); R24e stage-FK removal (collides with drift
backlog #8, which plans the opposite — live has 253 orphan rows that would fail
VALIDATE); deep-memory delete-scoping (would crash — document_sections
unique(document_id,section_index)).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…on) (#380)

* fix(ingestion): R1/R2 lease fences + R7/R9/R23 RPC hardening (migration)

Committed migration 20260708120000 (NOT applied to live — operator apply per
docs/supabase-migration-reconciliation.md), schema.sql reconciled, drift manifest
regenerated (13s scratch replay, clean).

- R1/R2: complete_ingestion_job + fail_or_retry_ingestion_job take an optional
  p_worker_id lease fence. A worker reclaimed by a stale takeover now matches 0
  rows and returns ok:false lease_lost instead of clobbering the reclaimer's
  newer state (indexed->failed, completed->pending). Backward compatible
  (p_worker_id defaults null); the worker passes workerId and treats lease_lost
  as a stop, keeping the isMissingSchemaError fallback for pre-apply. This is the
  defense-in-depth complement to the lease heartbeat already in this PR.
- R7: fail_or_retry downgrades an attempt-exhausted retry to terminal 'failed'
  instead of a permanently-unclaimable 'pending' that pins its batch forever.
- R9: refresh_import_batch_status locks the import_batches row before counting,
  serializing concurrent last-job refreshes (lost-update that stuck batches as
  'processing').
- R23: cleanup_abandoned re-asserts the open-job guard immediately before the
  destructive deletes (it previously lived only in the candidate CTE, before the
  seven count statements).

HELD (evidence in PR): R17 open-jobs unique index (collides with drift backlog
#7, ingestion_jobs index reshape); R24e stage-FK removal (collides with drift
backlog #8, which plans the opposite — live has 253 orphan rows that would fail
VALIDATE); deep-memory delete-scoping (would crash — document_sections
unique(document_id,section_index)).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ingestion): rename hardening migration to 20260708130000 (version collision)

20260708120000 was already taken by 20260708120000_rag_query_misses_retention.sql
on main; two migrations sharing a version fail the schema_migrations pkey on
replay/apply. Content unchanged; schema.sql + drift manifest unaffected (manifest
keys on schema.sql sha, not migration versions).

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>