Add TestFailJob with two TDD-confirmed cases:

- ``test_fail_job_appends_reason_to_progress_errors`` — verifies the
  reason string lands in ``job.progress.errors`` (both in-memory and
  after refresh_from_db) so UI surfaces the cause of the FAILURE. The
  existing ``_fail_job`` call-site tests in
  ``TestProcessNatsPipelineResultError`` mock ``_fail_job`` entirely, so
  a regression that stops appending to ``progress.errors`` would slip
  through undetected.
- ``test_fail_job_is_noop_on_already_final_job`` — regression guard for
  the early-return branch when the job is already in a final state.

Also:
- Comment the bare ``except Exception: pass`` around the
  ``progress.errors.append`` in ``_fail_job`` to explain why we swallow
  diagnostic-write failures.
- Extend the ``AsyncJobStateManager.diagnose_missing_state`` docstring
  with a one-paragraph note about the SCAN cost (failure-path only,
  per-job fanout of at most four keys) to head off the obvious review
  question.

Co-Authored-By: Claude <noreply@anthropic.com>

Fix three inaccurate comments flagged in review:
- diagnose_missing_state() is called from update_state and the result
  handler (not _fail_job); note it can run at most twice per FAILURE.
- SCAN is O(keyspace) regardless of MATCH; acceptable only because it
  runs on the rare missing-state failure path.
- _describe_redis_target() returns a redis=... prefixed string.

… duplicate rationale [skip ci]

- async_job_state.py update_state: "previously all surfaced as..." → states the
  contract ("Distinguishes three causes that map to the same symptom")
- async_job_state.py diagnose_missing_state: remove inline SCAN/MATCH cost
  duplicate that repeated the docstring verbatim; keep the docstring
- tasks.py _fail_job: "Previously the reason lived only in job.logger..." →
  states what the code does ("Operators can see the cause in the job detail view")

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…peline_result

Adds test_genuinely_missing_state_results_stage_acks_and_fails_job to
TestProcessNatsPipelineResultError, mirroring the existing process-branch test
for the results-stage missing-state path (tasks.py lines 378-388). Verifies
that when update_state returns None at stage=results, the task acks NATS (to
stop redelivery) and calls _fail_job with a reason string containing "stage=results".

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

diagnose_missing_state() embedded the Redis host:port in the string that becomes
the job's public progress.errors / failure reason, leaking the internal Redis
hostname into a user-visible surface. The DB index is the load-bearing diagnostic
(the missing-state incidents were a db0-vs-db1 mismatch across processes), so the
public string now reports only "redis db{N}: keys_for_job=...". The host:port
moves to a new connection_target() used solely in the server-side warning logged
by update_state, where operators see it without it reaching the public job log.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The earlier fix sanitized diagnose_missing_state()/progress.errors but missed the other
public surface: run_job's start log line `Running job ... on redis=host:port/dbN` goes
through job.logger into the JobLog table, which the UI shows — so the internal Redis host
leaked into every job's public log on the success path, not just failures.

Split the helpers: _redis_db_index() returns only the DB index for the public job log
(the load-bearing signal for cross-host DB-drift), and _describe_redis_target() (host:port)
now logs to the server logger only. Also stop _fail_job silently swallowing a failed
progress.errors append — log a warning so the swallow is observable — and correct the
run_job comment that overstated the DB-0-vs-DB-1 convention. Adds TestRedisTargetLogging
pinning that the public string omits host:port while the server string keeps it.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Cut the over-long diagnose_missing_state docstring (dropped the SCAN-cost and
standalone defensive paragraphs) and the run_job DB-index comment, and removed
changelog-style references to the prior hardcoded reason string. Behavior
unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>