the worker hands out keys from a snapshot of the queue, so a key whose task finished after the snapshot comes back once that task leaves in_flight. the second run wrote its stale repo state over the synced one and, with its key already gone, never sent BackfillFinished, so the repo stayed desynchronized for good. a task now checks its key is still queued before it starts. the tests that move the queue under a task now do it while the task waits on getRepo, the window their guards are for, and a deletion that lands during a successful backfill is covered too.