[n30nex]

Read-model backfills could hold a maintenance write indefinitely under load. Bound each batch with an operator-respecting statement timeout, roll back cancelled work without losing the session lock, and shrink genuinely expensive ranges before retrying. Keep upstream duty-cycle pacing, custom plans and statistics initialization.

A cycle deadline shortened by the remaining budget now yields without shrinking the next cycle’s batch. The preview exposed this distinction: treating a nearly expired cycle as a large-batch failure eventually reduced the range to one ID. The new PostgreSQL regression fails before the correction and passes afterward; existing timeout rollback, real shrink and paced-fill tests pass as well.

Rebased by merge onto current dev a51d950. Full query/schema behavior and retention are unchanged. Local unit checks and five focused PostgreSQL checks pass; current CI validates the exact head. Dev/dev1 deployment is still on the operator’s hold.