fix(importer): ImageProvenance (image_record_id, post_id) race-safe via savepoint + alembic 0021 UNIQUE — closes the SELECT-then-INSERT window that planted duplicates and broke .scalar_one_or_none() on every later deep-scan rederive (MultipleResultsFound). Migration dedupes existing rows (min(id) per pair); model gains __table_args__; gallery-filter test that seeded duplicates dropped.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/app/models/image_provenance.py

@@ -1,14 +1,18 @@
 """ImageProvenance — links an ImageRecord to a Post.
 
-Many-to-one (one image, many provenance rows) enables the enrich-on-duplicate
-rule (spec §3): when a downloaded image is a pHash dupe of an existing
-record, we append a new provenance row to the existing record rather than
-dropping the metadata.
+One image can have many provenance rows — different posts each contribute
+metadata (enrich-on-duplicate rule, spec §3: a downloaded image that is a
+pHash dupe of an existing record gets a NEW provenance row for the new post
+appended, rather than the metadata being dropped). But the (image, post)
+pair is unique — alembic 0021 enforces uq_image_provenance_image_post
+after operator-flagged 2026-05-26 saw _apply_sidecar's existence-check +
+INSERT race plant duplicates that then broke .scalar_one_or_none() on
+every later deep-scan rederive (MultipleResultsFound).
 """
 
 from datetime import datetime
 
-from sqlalchemy import JSON, DateTime, ForeignKey, Integer, func
+from sqlalchemy import JSON, DateTime, ForeignKey, Integer, UniqueConstraint, func
 from sqlalchemy.orm import Mapped, mapped_column
 
 from .base import Base
@@ -16,6 +20,12 @@ from .base import Base
 
 class ImageProvenance(Base):
     __tablename__ = "image_provenance"
+    __table_args__ = (
+        UniqueConstraint(
+            "image_record_id", "post_id",
+            name="uq_image_provenance_image_post",
+        ),
+    )
 
     id: Mapped[int] = mapped_column(Integer, primary_key=True)
     image_record_id: Mapped[int] = mapped_column(

backend/app/services/importer.py

@@ -784,6 +784,15 @@ class Importer:
             post.attachment_count = sd.attachment_count
         post.raw_metadata = sd.raw
 
+        # Race-safe (image_record_id, post_id) upsert — mirrors the
+        # _find_or_create_source/post savepoint pattern. The plain
+        # SELECT-then-INSERT pattern lost a race when two workers ran
+        # _apply_sidecar on the same (image, post) pair (e.g. the 5-min
+        # recovery sweep re-enqueued a still-running long import), planting
+        # duplicates that then broke .scalar_one_or_none() on every later
+        # deep-scan rederive (MultipleResultsFound). Alembic 0021 adds the
+        # uq_image_provenance_image_post UNIQUE so this savepoint actually
+        # trips on collision.
         exists = self.session.execute(
             select(ImageProvenance.id).where(
                 ImageProvenance.image_record_id == record.id,
@@ -791,14 +800,20 @@ class Importer:
             )
         ).scalar_one_or_none()
         if exists is None:
-            self.session.add(
-                ImageProvenance(
-                    image_record_id=record.id,
-                    post_id=post.id,
-                    source_id=src.id,
-                    captured_metadata=sd.raw,
+            sp = self.session.begin_nested()
+            try:
+                self.session.add(
+                    ImageProvenance(
+                        image_record_id=record.id,
+                        post_id=post.id,
+                        source_id=src.id,
+                        captured_metadata=sd.raw,
+                    )
                 )
-            )
+                self.session.flush()
+                sp.commit()
+            except IntegrityError:
+                sp.rollback()
         if record.primary_post_id is None:
             record.primary_post_id = post.id
         self.session.flush()