Two destructive paths have only ever run in the test harness:
deletion.policy: Force — removes a cell without draining when the pool is being deleted. By design it destroys running work, which is exactly why it should be exercised deliberately once rather than first encountered by a user.- Cell replacement backoff — a failed cell occupies its index with a tombstone row and is replaced after a backoff. The harness covers the counter and the index accounting; a real failing cell (bad image, GPU that never surfaces) has not been driven end to end.
Two destructive paths have only ever run in the test harness:
deletion.policy: Force— removes a cell without draining when the pool is being deleted. By design it destroys running work, which is exactly why it should be exercised deliberately once rather than first encountered by a user.