Function get_job_for_agent 

pub fn get_job_for_agent(
    config: &Config,
    job_id: &str,
    agent_alias: &str,
) -> Result<CronJob>

Read a job only when agent_alias is its current owner. The ownership predicate belongs to this SELECT so an operator rename that commits before the read cannot leave the caller with a stale authorization.

A job owned by someone else reports the same error an absent one reports, so the guard cannot confirm that it exists. Rows predating the agent_alias column belong to no agent and are reachable only from the unscoped operator surfaces.