harden(worker): validate claimed job rows and enrichment read-backs against Zod row contracts (#212 T4)

docs/branch-review-records/da99c19c3dd97371833d588e531db66c29c2d5e5fbeb467f26082b87ad7c1c91.record.md

@@ -0,0 +1 @@
+| 2026-08-17 | claude/ledger-212-tranche-4-worker-q3y6i4 | 0e6e58ca4ac59768658ae4ad5b37a1266a09109b | worker/row-contracts.ts, worker/main.ts, tests/worker-row-contract.test.ts | approved — no defects found; concurrency/lease fencing, schema-constraint-backed contract pins, and safe-logging discipline all verified | npx vitest run tests/worker-row-contract.test.ts (28 passed); npx tsc -p tsconfig.json --noEmit (0 errors) |

docs/outstanding-issues-inbox/2bfae2cf-d91e-4617-a0cb-bb8adbbad4fc.json

@@ -0,0 +1,10 @@
+{
+  "version": 2,
+  "id": "2bfae2cf-d91e-4617-a0cb-bb8adbbad4fc",
+  "createdOn": "2026-08-17",
+  "action": "cancel",
+  "payload": {
+    "requestId": "2f5fbcde-438b-47ab-a1b7-01309802d935",
+    "reason": "Superseded in PR #2037: tranche 3's row correction is folded into the single #212 closure request queued there, so the ledger keeps one pending mutation for #212."
+  }
+}

docs/outstanding-issues-inbox/38e53f36-b48f-4607-b5a0-56efde6dbb3b.json

@@ -0,0 +1,10 @@
+{
+  "version": 2,
+  "id": "38e53f36-b48f-4607-b5a0-56efde6dbb3b",
+  "createdOn": "2026-08-17",
+  "action": "cancel",
+  "payload": {
+    "requestId": "6602201c-14f2-46e9-9407-36e56efe13d5",
+    "reason": "Replaced in PR #2037 by a single #212 closure request that also carries tranche 3's row correction, resolving the multiple-pending-mutations conflict."
+  }
+}

docs/outstanding-issues-inbox/52d0dbcc-43e0-4660-89c5-9dbd6e080910.json

@@ -0,0 +1,11 @@
+{
+  "version": 2,
+  "id": "52d0dbcc-43e0-4660-89c5-9dbd6e080910",
+  "createdOn": "2026-08-17",
+  "action": "done",
+  "payload": {
+    "id": "#212",
+    "outcome": "Closed 2026-08-17 by tranche 4 PR #2037 (worker/main.ts), completing the four-tranche sweep: T1 PR #1946 (src/lib/rag/rag.ts via rag-row-contracts.ts, live-verified), T2 PR #1981 (rag-candidate-sources.ts), T3 PR #2023 (src/app/api/** via src/lib/validation/row-contracts.ts, squash 440a34f71), T4 PR #2037 (worker/row-contracts.ts). Corrected population baseline from the T3 audit (folding in its queued row correction, superseded request 2f5fbcde): measured on main at d0276718 across src/, worker/ and scripts/ there were 80 'as unknown as' and 60 JSON.parse occurrences, but most are legitimate outbound serialization (pgvector query_embedding args, telemetry inserts cast to Json) or client handles, so the remediable number was far lower; src/lib/rag retains 5 deliberate outbound/client-handle casts; T3's audit of all 41 API route files found only 3 'as unknown as' (outbound telemetry, correctly left) and zero JSON.parse, with every request body already Zod-validated via parseJsonBody - the 4 genuine inbound targets (search_document_chunks RPC rows, document_chunks table fallback, document_labels rows, search_schema_health payload) got row contracts. T4 audit of the final 12-cast worker population: 1 inbound cast (claim_ingestion_jobs rows incl. documents to_jsonb payload) replaced with per-row fail-soft validation that terminally fails malformed rows through fail_or_retry_ingestion_job instead of throwing outside the job lifecycle; 2 deep-memory parameter casts replaced by asserting loadEnrichmentRows read-backs (contained by the inline-enrichment try, record-and-skip); 9 outbound insert/Json/CJS-interop casts deliberately left with per-site reasons in the PR. Scripts are not production paths. Residual, distinct population outside this item's inventory: unguarded bare-as casts on extractor tableRows (worker/main.ts:693/1004) and OpenAI vision classification widening (worker/main.ts:798-800/1100/1115) - raise separately if they warrant their own item.",
+    "baseRowFingerprint": "dedd174f2b02a088373c871be74319581729f1fa4d737d84a6cbbf49498932fe"
+  }
+}

docs/outstanding-issues-inbox/6602201c-14f2-46e9-9407-36e56efe13d5.json

@@ -0,0 +1,11 @@
+{
+  "version": 2,
+  "id": "6602201c-14f2-46e9-9407-36e56efe13d5",
+  "createdOn": "2026-08-17",
+  "action": "done",
+  "payload": {
+    "id": "#212",
+    "outcome": "Closed 2026-08-17 by tranche 4 PR #2037 (worker/main.ts), completing the four-tranche sweep: T1 PR #1946 (src/lib/rag/rag.ts, rag-row-contracts.ts), T2 PR #1981 (rag-candidate-sources.ts), T3 PR #2023 (src/app/api/** via src/lib/validation/row-contracts.ts, squash 440a34f71), T4 PR #2037 (worker/row-contracts.ts). T4 audit of the final 12-cast worker population: 1 inbound cast (claim_ingestion_jobs rows incl. documents to_jsonb payload) replaced with per-row fail-soft validation that terminally fails malformed rows through fail_or_retry_ingestion_job instead of throwing outside the job lifecycle; 2 deep-memory parameter casts replaced by asserting loadEnrichmentRows read-backs (contained by the inline-enrichment try, record-and-skip); 9 outbound insert/Json/CJS-interop casts deliberately left with per-site reasons in the PR. Residual noted, distinct population outside this item's as-unknown-as inventory: unguarded bare-as casts on extractor tableRows (worker/main.ts:693/1004) and OpenAI vision classification widening (worker/main.ts:798-800/1100/1115) - raise separately if they warrant their own item.",
+    "baseRowFingerprint": "dedd174f2b02a088373c871be74319581729f1fa4d737d84a6cbbf49498932fe"
+  }
+}

docs/rag-improvement/HANDOVER.md

@@ -83,7 +83,7 @@ generation-quality verdict on fallback`), merged 2026-08-13 — structured
 | S6         | B3: Docling lab benchmark                                                                                       | `claude/rag-b3-docling-lab-<suffix>`             | —                     | Blocked on S4                                             | —                                                                                                                                                                                                                                                                                           |
 | S7+        | B4 shadow / B5 Ragas / B6 reranker / B7 DSPy                                                                    | —                                                | —                     | Gated — owner decision                                    | —                                                                                                                                                                                                                                                                                           |
 | #212 T1–T3 | Runtime row contracts (rag.ts, rag-candidate-sources.ts, src/app/api) — sibling stream sharing `src/lib/rag/**` | —                                                | #1946 / #1981 / #2023 | Merged (T3 squash `440a34f71` 2026-08-17)                 | see the #212 ledger row; RAG surface complete for the cast class                                                                                                                                                                                                                            |
-| #212 T4    | Runtime row contracts: `worker/main.ts` (11 casts) — sibling stream                                             | `claude/ledger-212-tranche-4-worker-<suffix>`    | —                     | Ready — dispatch now                                      | Clinical Governance Preflight; closes #212 if the audit supports it                                                                                                                                                                                                                         |
+| #212 T4    | Runtime row contracts: `worker/main.ts` (11 casts) — sibling stream                                             | `claude/ledger-212-tranche-4-worker-q3y6i4`      | #2037                 | PR open 2026-08-17                                        | Governance Preflight complete; audit: 1 inbound cast (claim rows, per-row fail-soft) + 2 read-back param casts contracted, 9 outbound/interop left; closes #212 (inbox `done` queued in the PR)                                                                                             |
 
 Update rule: the session that opens a packet's PR edits its row (branch, PR number,
 state) in the same PR. A later session updating another packet may also correct stale rows