@@ -64,6 +64,10 @@ export const SNAPSHOT_SWEEP_COUNT_FIELDS = [
   "deleted",
   "skipped",
   "pendingDeletion",
+  // Keyspaces the pass could not read. Reported because containment without a number is
+  // indistinguishable from nothing going wrong: a run that fails every pass leaks forever and the
+  // only other evidence is one log line per pass.
+  "failed",
   "nodes",
   "partial",
 ] as const;
 
@@ -466,4 +466,55 @@ describe("SnapshotOrphanSweeper", () => {
       await Promise.all([store.quit(), sweeper.quit(), probe.quit().catch(() => {})]);
     }
   });
+  containerTest(
+    "one wrong-typed keyspace costs that run its pass, not every run's",
+    async ({ prisma, redisOptions }) => {
+      // A single malformed keyspace used to abort the WHOLE pass: the Redis commands in the two
+      // rule bodies were uncaught, so a WRONGTYPE propagated out of sweep() and every later pass
+      // hit the same key. Collection stopped for every run until a human deleted it.
+      const store = new RedisSnapshotStore({ redisOptions, completedTtlMs: COMPLETED_TTL_MS });
+      const runStore = new PostgresRunStore({ prisma, readOnlyPrisma: prisma });
+      const sweeper = new SnapshotOrphanSweeper({
+        redisOptions,
+        runStore: runStore as unknown as RunStore,
+        completedTtlMs: COMPLETED_TTL_MS,
+        orphanAgeMs: ORPHAN_AGE_MS,
+        confirmOrphanAfterMs: 0,
+      });
+      const probe = createRedisClient(redisOptions, { onError: () => {} });
+      try {
+        const env = await seedSnapshotEnvironment(prisma);
+
+        // A healthy terminal run that rule 1 must still expire.
+        const healthyId = generateInternalId();
+        await store.append({
+          entry: birthEntry(healthyId, env, new Date()),
+          kind: "birth",
+          isTerminal: false,
+        });
+        await prisma.taskRun.create({
+          data: { ...buildCreateRunData(healthyId, env), status: "COMPLETED_SUCCESSFULLY" },
+        });
+
+        // A keyspace whose `seq` is a string where the code expects a hash. Discovered by the scan
+        // (it matches on `:e`), then every command against `seq` raises WRONGTYPE.
+        const brokenId = generateInternalId();
+        const brokenKeys = snapshotKeys(brokenId);
+        await probe.hset(brokenKeys.e, "s_x", JSON.stringify({ id: "s_x", runId: brokenId }));
+        await probe.set(brokenKeys.seq, "not-a-hash");
+
+        const result = await sweeper.sweep();
+
+        // The pass completes and reports the failure rather than throwing it.
+        expect(result.failed).toBe(1);
+        expect(result.partial).toBe(false);
+
+        // And the healthy run was still collected, which is the whole point.
+        expect(result.expired).toBe(1);
+        expect(await probe.pttl(snapshotKeys(healthyId).e)).toBeGreaterThan(0);
+      } finally {
+        await Promise.all([store.quit(), sweeper.quit(), probe.quit().catch(() => {})]);
+      }
+    }
+  );
 });
@@ -80,6 +80,13 @@ export type SweepResult = {
    * on an observed sweep pass, so the observation has to carry its own coverage.
    */
   nodes: number;
+  /**
+   * Keyspaces whose own Redis commands raised, so the pass acted on neither rule for them. Contained
+   * per run on purpose: a single malformed keyspace used to abort the whole pass, and because the
+   * scan restarts from the same place every time, collection then stopped for EVERY run until a
+   * human removed the key. One bad keyspace now costs itself one pass.
+   */
+  failed: number;
   /** True when the pass stopped early on its deadline or abort signal, so coverage is incomplete. */
   partial: boolean;
 };
@@ -200,6 +207,7 @@ export class SnapshotOrphanSweeper {
       deleted: 0,
       skipped: 0,
       pendingDeletion: 0,
+      failed: 0,
       nodes: 0,
       partial: false,
     };
@@ -295,18 +303,31 @@ export class SnapshotOrphanSweeper {
     for (const runId of runIds) {
       const run = rows.get(runId);
 
-      if (!run) {
-        await this.#applyRuleTwo(runId, dryRun, result);
-        continue;
-      }
+      // Per run, not per batch. The rule bodies below issue their own Redis commands, and an error
+      // from any of them used to leave the whole pass. The run-row lookup above has had its own
+      // guard from the start; this gives the Redis half the same treatment, for the same reason.
+      try {
+        if (!run) {
+          await this.#applyRuleTwo(runId, dryRun, result);
+          continue;
+        }
 
-      if (!FINAL.has(run.status)) {
-        // A live run. A SUSPENDED run can legitimately wait for weeks, so this is never touched.
-        result.skipped += 1;
-        continue;
-      }
+        if (!FINAL.has(run.status)) {
+          // A live run. A SUSPENDED run can legitimately wait for weeks, so this is never touched.
+          result.skipped += 1;
+          continue;
+        }
 
-      await this.#applyRuleOne(runId, dryRun, result);
+        await this.#applyRuleOne(runId, dryRun, result);
+      } catch (error) {
+        // Never rethrown. A keyspace this pass cannot read is a keyspace the NEXT pass can try, and
+        // the alternative is losing collection for every other run as well.
+        this.#logger.error("SnapshotOrphanSweeper skipped a keyspace after a failed command", {
+          runId,
+          error,
+        });
+        result.failed += 1;
+      }
     }
   }