a backfill read its repo state before getRepo and committed records, that state and tracked = true after it, without checking it still owned the repo. an untrack, a deletion or a requeue that landed during the fetch was overwritten, and since the key was already gone nothing ever looked at the repo again. the full and sparse persists now lock the repo and check their pending key in the transaction that writes, and skip the write if it's gone. untrack takes the repo locks like track and resync do, since every other writer that takes a repo off the queue already held them. the deletion test only passed because erasing the metadata made the commit fail, it now asserts the task finished cleanly. the test pds wakes run_changing with notify_waiters, so a getRepo from an earlier run can't leave a permit that lets the change in early.