- RootScanner takes indexed_paths (store torrent keys); a candidate is
skipped only when its mtime is unchanged AND it is present in the index,
so an emptied/partial index self-heals on the next pass (non-indexable
OTHER candidates still skip on mtime alone)
- discovery: a directory that cannot be listed (transient SMB failure)
now carries its previously known paths into the Sync set instead of
dropping them, and an unreadable media root fails the whole scan —
previously both produced a partial/empty known_paths that made
sync_torrent_paths delete items that still exist on disk
- worker: broad per-directory exception guard (carry known paths, stay
hot, keep other workers running); node completion hardened against
double-decrement; backoff state not updated from cancelled walks