Phase 1b: authenticated idempotent ingestion