fix(graph-buffer): log why an atomic publish failed instead of a successful dump

cbm_gbuf_dump_to_sqlite() emitted gbuf.dump regardless of the writer's
result, so a run that published nothing still logged node and edge counts
as if it had worked, and the failure reached the user only as the generic
"Pipeline failed. Check repo_path exists and contains source files."

The writer's temp -> final rename in publish_writer_output() returned a
bare ERR_WRITE_FAILED. #1628 taught cbm_rename_replace() to translate the
platform error into errno so callers could report why, and wired up the
stage -> final rename in pipeline.c. This is the other rename on that
path, and it is the one that runs first.

Preserve errno across the cleanup unlink in the publish error branches,
read it in graph_buffer.c before the profiling macro can clobber it, and
report gbuf.dump_failed with the return code and that errno. No logging is
added inside internal/cbm/, which has none today.

Refs #1620, #2001.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012FxkVF773gDGNmBmsLnzN7

Author: junk151516

internal/cbm/sqlite_writer.c

@@ -26,6 +26,7 @@
 #include <string.h>
 #include <stdint.h>
 #include <stdbool.h>
+#include <errno.h>
 
 #ifdef _WIN32
 #include <io.h>
@@ -1759,13 +1760,18 @@ static int sync_writer_output(FILE *fp) {
 }
 
 static int discard_writer_output(write_db_ctx_t *w, int rc) {
+    /* Cleanup runs after the failure that brought us here, and a library
+     * call may set errno even when it succeeds. Carry the reason across it
+     * so the caller can report WHY the publish failed. */
+    int failure_errno = errno;
     if (w->fp) {
         (void)fclose(w->fp);
         w->fp = NULL;
     }
     if (w->temp_path[0]) {
         (void)cbm_unlink(w->temp_path);
     }
+    errno = failure_errno;
     return rc;
 }
 
@@ -1774,18 +1780,25 @@ static int publish_writer_output(write_db_ctx_t *w) {
         return discard_writer_output(w, ERR_WRITE_FAILED);
     }
     if (fclose(w->fp) != 0) {
+        int failure_errno = errno;
         w->fp = NULL;
         if (w->temp_path[0]) {
             (void)cbm_unlink(w->temp_path);
         }
+        errno = failure_errno;
         return ERR_WRITE_FAILED;
     }
     w->fp = NULL;
     if (!w->temp_path[0] || !w->final_path[0]) {
         return 0;
     }
     if (cbm_rename_replace(w->temp_path, w->final_path) != 0) {
+        /* cbm_rename_replace translated the platform error into errno so the
+         * caller can say what denied the publish (#1620). Preserve it across
+         * the cleanup unlink. */
+        int rename_errno = errno;
         (void)cbm_unlink(w->temp_path);
+        errno = rename_errno;
         return ERR_WRITE_FAILED;
     }
     /* Sidecars are removed only after the replacement succeeds. On POSIX,

src/graph_buffer/graph_buffer.c

@@ -38,6 +38,7 @@ enum {
 #include "foundation/mem.h"
 #include <sqlite3.h>
 
+#include <errno.h>
 #include <stdatomic.h>
 #include <stdint.h> // int64_t
 #include <stdio.h>
@@ -1625,6 +1626,23 @@ static void log_dump_summary(int node_count, int edge_count) {
     cbm_log_info("gbuf.dump", "nodes", b1, "edges", b2);
 }
 
+/* A dump that published nothing gets exactly one signature in the log.
+ * Without it the writer's return code is the only evidence, and it reaches
+ * the user as a generic pipeline failure that blames their repository
+ * (#1620, #2001). failure_errno is read by the caller at the point of
+ * failure: the value is only meaningful before the next library call. */
+static void log_dump_failed(int rc, int failure_errno, int node_count, int edge_count) {
+    char b1[CBM_SZ_16];
+    char b2[CBM_SZ_16];
+    char b3[CBM_SZ_16];
+    char b4[CBM_SZ_16];
+    snprintf(b1, sizeof(b1), "%d", rc);
+    snprintf(b2, sizeof(b2), "%d", failure_errno);
+    snprintf(b3, sizeof(b3), "%d", node_count);
+    snprintf(b4, sizeof(b4), "%d", edge_count);
+    cbm_log_error("gbuf.dump_failed", "rc", b1, "errno", b2, "nodes", b3, "edges", b4);
+}
+
 static void free_dump_resources(char **url_paths, char **local_names, int edge_count,
                                 CBMDumpEdge *dump_edges, CBMDumpNode *dump_nodes,
                                 int64_t *temp_to_final) {
@@ -1710,6 +1728,7 @@ int cbm_gbuf_dump_to_sqlite(cbm_gbuf_t *gb, const char *path) {
      * uninitialized budget from ever triggering the free). */
     cbm_db_writer_t *w = cbm_writer_open(path);
     if (!w) {
+        log_dump_failed(CBM_NOT_FOUND, errno, node_idx, 0);
         free(src_nodes);
         free(dump_nodes);
         free(temp_to_final);
@@ -1759,12 +1778,19 @@ int cbm_gbuf_dump_to_sqlite(cbm_gbuf_t *gb, const char *path) {
     int frc = cbm_writer_finalize(w, gb->project, gb->root_path, indexed_at, dump_nodes, node_idx,
                                   dump_edges, edge_idx, gb->dump_vectors, gb->dump_vector_count,
                                   gb->dump_token_vecs, gb->dump_token_vec_count);
+    /* Read errno before anything else can touch it: the profiling macro
+     * below is already one library call away from losing the reason. */
+    int finalize_errno = errno;
     CBM_PROF_END_N("dump", "6_write_db_finalize", t_finalize, node_idx + edge_idx);
     if (rc == 0) {
         rc = frc;
     }
 
-    log_dump_summary(node_idx, edge_idx);
+    if (rc != 0) {
+        log_dump_failed(rc, finalize_errno, node_idx, edge_idx);
+    } else {
+        log_dump_summary(node_idx, edge_idx);
+    }
     free_dump_resources(url_paths, local_names, edge_idx, dump_edges, dump_nodes, temp_to_final);
     free(src_nodes);
     return rc;

tests/test_graph_buffer.c

@@ -7,6 +7,10 @@
 #include "test_framework.h"
 #include "graph_buffer/graph_buffer.h"
 #include "store/store.h"
+#include "../src/foundation/compat.h"
+#include "foundation/compat_fs.h"
+#include "foundation/log.h"
+#include <stdio.h>
 #include <string.h>
 
 /* ── Node operations ───────────────────────────────────────────── */
@@ -1118,6 +1122,66 @@ TEST(gbuf_flush_skips_orphan_edges) {
     PASS();
 }
 
+/* ── Publish failure reporting ───────────────────────────────── */
+
+static char g_log_capture[4096];
+static CBMLogLevel g_prev_log_level;
+
+static void capture_log_sink(const char *line) {
+    size_t used = strlen(g_log_capture);
+    size_t avail = sizeof(g_log_capture) - used;
+    if (avail <= 1) {
+        return;
+    }
+    int n = snprintf(g_log_capture + used, avail, "%s\n", line);
+    if (n < 0 || (size_t)n >= avail) {
+        g_log_capture[sizeof(g_log_capture) - 1] = '\0';
+    }
+}
+
+static void capture_logs_start(void) {
+    g_log_capture[0] = '\0';
+    g_prev_log_level = cbm_log_get_level();
+    cbm_log_set_level(CBM_LOG_DEBUG);
+    cbm_log_set_sink(capture_log_sink);
+}
+
+static const char *capture_logs_end(void) {
+    cbm_log_set_sink(NULL);
+    cbm_log_set_level(g_prev_log_level);
+    return g_log_capture;
+}
+
+/* A dump that publishes nothing has to say so, and say why. Renaming onto an
+ * existing directory is how test_sqlite_writer already forces the publish to
+ * fail; here it stands in for any host that denies the rename (#1620). */
+TEST(gbuf_dump_failure_logs_reason) {
+    char dir[256];
+    snprintf(dir, sizeof(dir), "/tmp/cbm_gbuf_pub_XXXXXX");
+    ASSERT_NOT_NULL(cbm_mkdtemp(dir));
+
+    cbm_gbuf_t *gb = cbm_gbuf_new("test", "/tmp/repo");
+    ASSERT_NOT_NULL(gb);
+    int64_t id = cbm_gbuf_upsert_node(gb, "Function", "main", "pkg.main", "main.go", 1, 10, "{}");
+    ASSERT_GT(id, 0);
+
+    capture_logs_start();
+    int rc = cbm_gbuf_dump_to_sqlite(gb, dir);
+    const char *logs = capture_logs_end();
+
+    ASSERT(rc != 0);
+    ASSERT_NOT_NULL(strstr(logs, "gbuf.dump_failed"));
+    /* The reason survived the cleanup unlink. */
+    ASSERT_NOT_NULL(strstr(logs, "errno="));
+    ASSERT(strstr(logs, "errno=0 ") == NULL);
+    /* And the run is not also reported as a successful dump. */
+    ASSERT(strstr(logs, "msg=gbuf.dump ") == NULL);
+
+    cbm_gbuf_free(gb);
+    cbm_rmdir(dir);
+    PASS();
+}
+
 /* ── Suite ─────────────────────────────────────────────────────── */
 
 SUITE(graph_buffer) {
@@ -1188,4 +1252,7 @@ SUITE(graph_buffer) {
     RUN_TEST(gbuf_shared_ids_null_fallback);
     RUN_TEST(gbuf_next_id_set_next_id_roundtrip);
     RUN_TEST(gbuf_next_id_null_safe);
+
+    /* Publish failure reporting */
+    RUN_TEST(gbuf_dump_failure_logs_reason);
 }