[P0] Stabilize analysis recovery, inflight dedup and post-sync drain regressions

[fxbin]

Context

Bounded full PostgreSQL suite run from diagnostic PR #34 (after composing the verified #22 and #27 isolation fixes) progressed past the previous hang boundaries and exposed a coherent Analysis/Recovery failure cluster before 9% of the suite.

Observed failing tests:

1. tests/test_analysis_notification_permissions.py::test_analysis_and_notifications_require_login
2. tests/test_analysis_recovery.py::test_analyze_pending_deduplicates_inflight_background_jobs
3. tests/test_analysis_recovery.py::test_analysis_job_inflight_ttl_releases_stuck_ids
4. tests/test_analysis_recovery.py::test_post_sync_drain_processes_backlog_and_stale_analyzing
5. tests/test_analysis_recovery.py::test_post_sync_drain_uses_configured_default_batch_size
6. tests/test_analysis_recovery.py::test_post_sync_drain_releases_claims_after_batch_timeout

This issue is the WorkOrder for diagnosis and root-cause decomposition, not permission to patch all six tests together.

Objective

Determine whether these failures share one production contract regression or represent multiple independent defects, then split implementation into the smallest independently verifiable Worker slices.

Required diagnostic pass

Run the six tests against PostgreSQL with:

• pytest -vv
• full traceback (--tb=long)
• bounded execution time
• no public network calls
• no test skipping or xfail conversion

For each failure capture:

• expected vs actual behavior;
• exact assertion/exception and stack;
• production call path involved;
• whether the test is stale or production behavior is incorrect;
• shared-state/background-task/transaction involvement;
• smallest repair boundary.

Decision rules

• Do not make tests pass by weakening assertions unless the current product contract explicitly changed and is independently verified.
• Do not combine unrelated failures just because they live in test_analysis_recovery.py.
• If a production lifecycle/concurrency defect is reproduced, create a dedicated child Issue before modifying behavior.
• If a test contract is stale, document the authoritative current contract before changing the test.

Acceptance criteria

• All six failures have exact tracebacks from a targeted PostgreSQL CI run.
• Failures are grouped by demonstrated root cause, not filename proximity.
• Each root-cause group has a bounded Worker Issue with acceptance criteria and verification plan.
• Any process-only diagnostic workflow/branch/PR is closed without merge.
• Durable fixes contain no planning/diagnostic artifacts.

Parent stabilization: #2
Related backend-suite recovery: #14
Related lifecycle hardening: #6 / #28

[fxbin]

Targeted PostgreSQL diagnostic evidence from PR #36 / job 95004329394 is complete.

Results: 1 passed, 5 failed in 12.44s.

Root-cause decomposition

1. Permission contract — stale test → [P1] Align analysis/notification permission regression test with admin-only analysis trigger contract #37

   • test_analysis_and_notifications_require_login
   • exact mismatch: normal user receives expected production 403 from POST /analyses/pending, old test expected 200.
   • production admin guard remains correct; test: align pending analysis admin permission contract (#37) #38 updates the durable regression test.

2. Inflight/dedup + DB lifecycle → [P0] Isolate analysis-job persistence from pytest event-loop reuse #40

   • test_analyze_pending_deduplicates_inflight_background_jobs PASSED standalone in this sequence.
   • test_analysis_job_inflight_ttl_releases_stuck_ids then failed on required job persistence with Future ... attached to a different loop, wrapped by AnalysisJobPersistenceError.
   • This strongly supports cross-function pytest event-loop reuse of the module-level SQLAlchemy/asyncpg pool as the source of the full-suite dedup/TTL instability, rather than a demonstrated dedup algorithm defect.

3. Post-sync drain — stale private symbol → [P1] Migrate post-sync drain regression tests to the extracted pipeline module #39

   • all three post-sync tests fail identically with AttributeError: module 'app.scheduler' has no attribute '_drain_pending_analysis'.
   • implementation was extracted to app._post_sync_pipeline; tests still invoke the old scheduler private symbol.

Execution order

Because #39 and #40 both modify test_analysis_recovery.py, do not run them as conflicting parallel Workers. Execute #39 first, then stack #40 on top (or rebase after #39 lands), with separate verification evidence.

Diagnostic PR #36 is process-only and can now be closed without merge.

[fxbin]

Integration dependency graph is now explicit:

1. test: align pending analysis admin permission contract (#37) #38 / [P1] Align analysis/notification permission regression test with admin-only analysis trigger contract #37 — independent permission regression update (separate test file).
2. test: migrate post-sync drain regressions to pipeline module (#39) #43 / [P1] Migrate post-sync drain regression tests to the extracted pipeline module #39 — post-sync drain tests migrate to extracted pipeline module.
3. test: isolate analysis-job persistence per pytest event loop (#40) #47 / [P0] Isolate analysis-job persistence from pytest event-loop reuse #40 — stacked on test: migrate post-sync drain regressions to pipeline module (#39) #43 because it touches the same test_analysis_recovery.py; merge/rebase only after test: migrate post-sync drain regressions to pipeline module (#39) #43 is accepted.
4. diag: prove composed Analysis/Recovery fixes (#35) #48 — process-only composed proof; re-runs the original six-test cluster using [P1] Migrate post-sync drain regression tests to the extracted pipeline module #39+[P0] Isolate analysis-job persistence from pytest event-loop reuse #40 plus the [P1] Align analysis/notification permission regression test with admin-only analysis trigger contract #37 file in the Actions workspace. MUST close without merge after evidence.

Do not merge #47 ahead of #43 or flatten the stacked review in a way that obscures the +9/-1 #40 delta. All three durable PRs remain Verifier-pending.