Constant HOLDER_BY_UID 

const HOLDER_BY_UID: &str = "(claimed_by_uid <> '' AND claimed_by_uid = ?6)";

The holder predicates, tried in order. When the row’s claimed_by_uid and the caller’s UID (?6) are both known, only the UID decides — a name two agents share no longer lets either drive the other’s item. Otherwise the name (?2) decides, as it always has: a tokenless holder keeps working. Each is its own conditional UPDATE, so each is a complete authorization on its own; the second runs only when the first matched nothing.