A run that throws on its way back was the one failure mode with no coverage: a
rejected script call never increments the skipped count, so without both the
per-message isolation and the retry-on-error condition a transient failure
would end the sweep with those runs still admitted and still on the worker
queue. Seeds an unreturnable run alongside a healthy one and asserts the
healthy one still comes back, the failure is counted, and the pass is retried.
Matt Aitken
5f832f5ee4