Test: lib.backup() takes no new original once onProgress has thrown or its lock is lost

The onProgress test now runs eight photos with a pool of five and holds
only the first five downloads, so a backup that went on after the throw
would download and store the other three. The end-to-end test of a
removed backup.lock expects the backup to stop after its three originals,
before it fetches ML data.

Model: opus-5-5

TODO.md

@@ -32,10 +32,8 @@ declares one.
   the work for one original, its `--verify` hashing included, so no more
   originals than that are open at once. `BackupLibrary` says the limit as
   `contentConcurrency`. A test holds each download at the fake Ente server to
-  count those in flight. Once a worker has thrown, as one does when `onProgress`
-  throws, or the lock is lost, no worker takes another file; the backup fails
-  once the originals under way are in place, and a lost lock stops it before it
-  fetches ML data.
+  count those in flight. Each worker checks the backup's lock before it takes
+  the next file, so once the lock is lost no further original starts.
 
 - 2026-10-14: Next Step said the cache design, issue 36, waits on sneak's
   review, though that issue closed on 2026-10-03 (issue 194). It now names the

src/backup.ts

@@ -730,24 +730,16 @@ const runLockedBackup = async (
     // Up to the content pool's limit of originals are worked on at once,
     // their `verify` hashing included, so however large the account is, no
     // more than that many are open. Each worker takes the next file from the
-    // iterator they all share until none is left. Once a worker has thrown,
-    // as one does when `onProgress` throws, or the lock is lost, no worker
-    // takes another file. The backup fails only once every worker has
-    // stopped, so none writes into the backup after it has ended. It checks
-    // the lock then too, so it does not go on to the thumbnails or the ML
-    // data fetch without it.
+    // iterator they all share until none is left, and throws instead once the
+    // lock is lost. A worker that throws, as one also does when `onProgress`
+    // throws, fails the backup only once every worker has stopped, so none
+    // writes into the backup after it has ended.
     if (includeOriginals) {
         const pending = distinct.values();
-        let workerThrew = false;
         const worker = async (): Promise<void> => {
             for (const file of pending) {
-                if (workerThrew || lock.lost) return;
-                try {
-                    await storeOriginal(file);
-                } catch (err) {
-                    workerThrew = true;
-                    throw err;
-                }
+                if (lock.lost) throw lock.lost;
+                await storeOriginal(file);
             }
         };
         const workers = await Promise.allSettled(
@@ -756,7 +748,6 @@ const runLockedBackup = async (
         for (const w of workers) {
             if (w.status === "rejected") throw w.reason;
         }
-        if (lock.lost) throw lock.lost;
     }
 
     if (includeThumbnails) {

test/cli/backup-end-to-end.test.ts

@@ -704,8 +704,8 @@ describe("a backup whose lock is lost", () => {
         }
     };
 
-    // The backup downloads up to five originals at once, so it has started
-    // all three when the lock is lost, and beach.jpg is stored. The backup
+    // The backup downloads up to five originals at once, so all three are
+    // under way when the lock is lost, and beach.jpg is stored. The backup
     // then stops before it fetches ML data. `quak backup` prints why as one
     // line, with no stack trace, and exits 1.
     it("stops quak backup before it fetches ML data when backup.lock is removed, and exits 1", async () => {