ML data that does not decrypt is recorded with its reason (closes #198)

`fetchMLDataBatch` dropped an entry that did not decrypt, gunzip or parse,
so the file looked like one with no ML data and the run exited 0. It now
returns the reason beside the payloads. The library keeps the reasons from
its last ML data fetch in memory only and gives them in
`status().mlDataErrors` and the `fetchMLData` "done" event. `quak backup`
writes the reason as `mlDataError` for a file with no ML data cached and
records the file in `failures.json` as `ML data: REASON`. `backup-metadata`
writes `mlDataError` for it and exits 1; `runMetadataBackup` now returns how
many files have `mlDataError`.

Judgement call: a file whose ML data is cached keeps it in its JSON when a
newer copy does not decode, as when the fetch fails.

Model: opus-5-5

TODO.md

@@ -17,8 +17,7 @@ pre-1.0
 
 # Next Step
 
-Four bugs are open: https://git.eeqj.de/sneak/quak/issues/197,
-https://git.eeqj.de/sneak/quak/issues/198,
+Three bugs are open: https://git.eeqj.de/sneak/quak/issues/197,
 https://git.eeqj.de/sneak/quak/issues/199 and
 https://git.eeqj.de/sneak/quak/issues/205. The check of quak against a live Ente
 account, https://git.eeqj.de/sneak/quak/issues/187, needs an account only sneak
@@ -29,6 +28,16 @@ declares one.
 
 # Completed Steps
 
+- 2026-10-16: ML data the server sends that does not decrypt, gunzip or parse is
+  no longer taken for no ML data (issue 198). `fetchMLDataBatch` returns why for
+  each such file beside the payloads. The library keeps those reasons from its
+  last ML data fetch in memory, not in the cache, and gives them in
+  `status().mlDataErrors` and in the `fetchMLData` event with status `"done"`.
+  `quak backup` writes the reason as `mlDataError` in the file's JSON when no ML
+  data is cached for it, and records the file in `failures.json` with an error
+  starting `ML data: `; `backup-metadata` writes `mlDataError` too. Both exit 1.
+  Tests serve ML data encrypted under a key that is not the file's.
+
 - 2026-10-16: The `~/bin/quak` that `make install` builds retries a refused
   connection and a name that does not resolve, and the backup records either as
   transient (issue 206). Bun's `fetch` reports them with codes of its own,