The check before an upload's attempt ran outside the upload's error
handling, and dropped its mark first. When removing an unreferenced job
failed, the error escaped the upload worker, stopping it, and the next
attempt uploaded the discarded image. The mark now stays until the check
settles, a failed removal waits for the usual retry, and the job never
uploads in between.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>