fix(db,runs): loop-failure error_logs fallback + don't delete a shared run log

Two MEDIUM findings from the bug hunt:

- Public failure-drawer empty for continuous-loop failures: loop runs persist per
  node ONLY to batch_results (not results/error_logs), so getNodeErrors — which
  queries error_logs⋈results with a results-table fallback — returned nothing for
  a loop-only failure, violating the failure-log MUST. Add a second fallback that
  synthesizes a failure entry from the most recent failed batch_results row (it
  stores error + error_code). Same shape/aliases as the other queries; failed-only
  (actual_mbps IS NULL OR error_code IS NOT NULL); no schema migration needed.

- deleteRun could purge a raw audit-*.log still referenced by ANOTHER saved run
  (resume reuses one log file across passes). Guard the delete with sharedByOther
  = index.runs.some(r => r.auditLog === entry.auditLog) (index.runs is post-splice)
  so a shared log isn't deleted out from under another run's Live Log.

Adversarially reviewed (runtime-verified against a live schema): columns exist via
migrations, shape parity with the primary/results queries, failed-only filter,
post-splice some() check correct. No TEST RUN paths touched. Test suite green
(188/31/45/35).

Author: Sentinel-Bluebuilder

core/db.js

@@ -1154,7 +1154,41 @@ export function getNodeErrors(addr, { limit = 50, stage = null } = {}, which) {
     ORDER BY r.tested_at DESC
     LIMIT @limit
   `).all(params);
-  return fallback;
+  if (fallback.length > 0) return fallback;
+
+  // Second fallback: continuous-loop (public) runs persist per node ONLY to
+  // batch_results — never to results/error_logs — so a node that failed only
+  // inside a loop has no row in either table queried above. batch_results does
+  // store error + error_code, so synthesize a failure entry from the most recent
+  // failed batch_results row. Without this the public failure-drawer is empty for
+  // loop-only failures, violating the failure-log MUST contract. batch_results
+  // has no `stage`, so a specific stage filter can't match here.
+  if (stage && stage !== 'unknown') return fallback; // empty — no stage in batch_results
+  const batchFallback = db.prepare(`
+    SELECT NULL AS id, NULL AS result_id,
+           'unknown'                                   AS stage,
+           COALESCE(br.error_code, 'UNKNOWN')          AS error_code,
+           COALESCE(br.error, '(no message captured)') AS error_message,
+           NULL                                        AS log_snippet,
+           br.tested_at                                AS captured_at,
+           br.tested_at, br.actual_mbps,
+           br.node_address     AS node_addr, br.moniker,
+           br.country          AS country,
+           br.city             AS city,
+           br.country_code     AS country_code,
+           br.type             AS service_type,
+           NULL AS advertised_mbps, NULL AS latency_ms,
+           NULL AS handshake_ok, NULL AS session_ok, NULL AS pass,
+           NULL AS sdk, NULL AS continent, NULL AS tester_os,
+           NULL AS run_id, NULL AS raw_json,
+           1                   AS synthesized
+    FROM batch_results br
+    WHERE br.node_address = @addr
+      AND (br.actual_mbps IS NULL OR br.error_code IS NOT NULL)
+    ORDER BY br.tested_at DESC
+    LIMIT @limit
+  `).all(params);
+  return batchFallback;
 }
 
 /**

server.js

@@ -961,7 +961,12 @@ function deleteRun(num) {
   if (entry && entry.auditLog) {
     const rawLog = path.join(__dirname, 'results', entry.auditLog);
     const isActive = state.auditLogPath && path.basename(state.auditLogPath) === entry.auditLog;
-    if (!isActive && _ex(rawLog)) {
+    // Don't delete a log file still referenced by ANOTHER saved run — resume
+    // reuses one audit-*.log across passes, so deleting this run's basename would
+    // orphan another run's Live Log. index.runs here is already post-splice (this
+    // entry removed), so .some() checks only the runs that remain.
+    const sharedByOther = index.runs.some(r => r.auditLog === entry.auditLog);
+    if (!isActive && !sharedByOther && _ex(rawLog)) {
       try { _rm(rawLog, { force: true }); }
       catch (err) { console.error(`[deleteRun] failed to remove log: ${err.message}`); }
     }