fix(reliability): permanently reserve conversion job identifiers

[seonghobae]

Objective

Reconcile the immutable conversion-job identifier ownership semantic from stale descendant #268 without copying stale ancestry. A job UUID must never be rebound to a different job object during the lifetime of a repository adapter, including after deletion, because delayed/retried asynchronous work can otherwise resolve an old identifier to a different tenant or lifecycle instance.

Fresh exact stack state — 2026-08-10

• exact child head: 3b2a8ee967461666e81db710d2d92996dfb9f5c0;
• exact parent fix(security): push analytics tenant isolation into repository query #342 head/base: 4eeba73d70db172e44062891c01273efc4109d93, still directly based on protected main 55d7ae8647208e301f282350f076eeddaba61d11;
• child is deliberately based on fix(security): push analytics tenant isolation into repository query #342 because both slices touch the process-local repository adapter;
• exact-head CI 31403344717: success;
• exact-head fuzz 31403344580: success;
• Maven exact checkout was 3b2a8ee967461666e81db710d2d92996dfb9f5c0; 504 tests ran with 0 failures, 0 errors and 0 skips, all JaCoCo coverage checks passed, public Javadocs passed, and synthetic parent-merge compatibility passed;
• no formal reviews or unresolved review threads at the latest direct refetch.

The security/SAST workflows that run on main-targeted PRs are not synthesized as passing evidence here: this stacked PR targets the parent branch and only its directly emitted exact-head workflow evidence is counted. After parent #342 lands and this child is reconciled onto the new protected main, base-sensitive required security/review evidence must be regenerated before any final merge.

Test-first evidence

RED

Test-only head 6f52863aade7a55c89876dce41249dc102fde36a added InMemoryConversionJobRepositoryIdentifierReservationTest before changing production. Exact-head CI 31402884910 checked out that SHA and failed with three intended regressions:

• a distinct object could replace a live UUID without an exception;
• a deleted UUID could be rebound to a later replacement;
• collision handling read candidate content-hash metadata before rejecting the UUID, surfacing the deliberate candidate content hash was accessed first failure instead of the collision boundary.

The already-live exact-object idempotency case was green, isolating the defect to identifier ownership/reuse.

GREEN

The process-local adapter now maintains a lifetime reservedJobIdentifiers set and serializes the coupled primary/secondary-index mutation boundary. save(...) and findOrStoreByContentHash(...) reject a distinct live or reserved UUID before reading candidate secondary-index metadata. The exact currently stored object remains an idempotent hit. Deletion removes the live primary and content-hash index but deliberately keeps the UUID reservation.

Focused GREEN tests prove:

• exact live-object idempotency;
• distinct live-UUID replacement rejection without changing canonical ownership;
• collision rejection before candidate content-hash access;
• post-deletion UUID reuse rejection while the deleted live record stays absent.

Scope boundary

This is an in-memory adapter integrity/fencing primitive, not durable persistence. Identifier reservations do not survive process restart. This PR does not claim transactional outbox acceptance, worker lease generations, durable deletion receipts, cancellation, backpressure, restart recovery or completion of issue #312. It also does not duplicate #342's tenant-list query semantics.

Dependency gate

Keep this PR Draft while parent #342 is still open. Merging this child into the parent branch first would move #342's exact reviewed/verified identity and collapse two independently reviewable semantics. After #342 reaches protected main, rebuild/reconcile this unique delta onto that new exact protected base, regenerate all base-sensitive checks/reviews/security evidence, and only then move the child toward merge.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: afbbec11-391e-4ba6-a63a-db189ef60be8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Superseded by clean current-parent reconstruction #443. #443 is based on exact current analytics replacement #432 head e0c02dc3305020ae1ad6900d0a04790aee7104d3, begins with a test-only RED commit, and restores this PR's two-file immutable identifier-ownership delta without importing stale #342 ancestry. Its exact GREEN candidate head is d5a57a7f4e97467bb2fb163f37e4de5691d7ba31; emitted child checks are being regenerated. Closing this stale stacked PR prevents ambiguous parent lineage and duplicate review. No predecessor check or approval evidence transfers.