袁聪的第二次提交，项目已完整

app/worker/__main__.py

@@ -7,15 +7,30 @@ from app.infrastructure.db import engine
 from app.worker.offsite_mail_worker import OffsiteMailWorker
 from app.worker.runtime import WorkerRuntime
 
+logger = logging.getLogger(__name__)
+
 
 async def serve(*, once: bool = False) -> None:
     settings = get_settings()
     runtime = WorkerRuntime(settings=settings)
+    # 场外收件 Worker 必须与底座 Worker 同进程同入口：2026-09-11 01:45 的一次批量
+    # 文件覆盖把这处接线删掉了，导致邮件 Worker 完全不再运行、邮箱无人收取。
     offsite_worker = OffsiteMailWorker(settings)
     try:
         while True:
-            worked = await runtime.run_once()
-            worked = await offsite_worker.run_once() or worked
+            try:
+                worked = await runtime.run_once()
+                worked = await offsite_worker.run_once() or worked
+            except Exception:
+                # 常驻 Worker 不能因为"某一轮"的异常就整体退出：数据库抖动、
+                # 迁移期间锁表、外部依赖瞬断都会命中这里，而 `run_once` 里的
+                # 裸查询没有兜底。单轮失败记录堆栈后退避重试；`--once` 模式
+                # 保持抛出，便于诊断一次性运行的真实问题。
+                logger.warning("worker round failed; retrying after backoff", exc_info=True)
+                if once:
+                    raise
+                await asyncio.sleep(settings.worker_poll_seconds)
+                continue
             if once:
                 return
             if not worked: