fix: preserve capture creation failures

Author: DevanMetz

ROADMAP.md

@@ -60,9 +60,10 @@ Phase 0 software work is implemented and builds cleanly:
 
 Phase 1 software progress is also underway:
 
-- [x] Scope and I2C capture cleanup no longer retries publication after a rejected write or failed I2C flush/sync. I2C releases recording ownership on known SD failure; both writers preserve the first cause through close and report once. All 35 native writer/storage cases pass; the previous callbacks fail 16 controls. Exact CSV/TMP bytes, Scope filename collision, pre-flush timing and 25 independent failure/success cycles per writer are checked with closed handles. UI, data, time, mount and fault boundaries are controlled; I2C start, ADC/drivers and physical SD/panel remain separate gates. Linux CI retains source hashes and logs.
+- [x] Scope and I2C capture cleanup no longer retries publication after a rejected write or failed I2C flush/sync. I2C releases recording ownership on known SD failure; both writers preserve the first cause through close and report once. All 35 original native writer/storage cases pass; the callbacks preceding the writer fix fail 16 controls. Exact CSV/TMP bytes, Scope filename collision, pre-flush timing and 25 independent failure/success cycles per writer are checked with closed handles. UI, data, time, mount and fault boundaries are controlled; ADC/drivers and physical SD/panel remain separate gates. Linux CI retains source hashes and logs.
 - [x] Ebook library listings confirm regular-file metadata before accepting `.txt` entries and report directory setup/open/read/stat/close errors, entry capacity and skipped long paths. Failed listings no longer claim an empty library; the first failure survives close. All 28 native existing-directory/file cases pass, including unchanged bytes, callback path ownership, first-error checks and 25 reopen cycles with closed handles. The previous callback fails 18 controls. UI, timer, mount, download and error boundaries are controlled; welcome creation and physical SD/panel checks remain separate. Linux CI retains source hashes and logs.
 - [x] UART/RS-485 logging retries only filename collisions, reports the first preparation/write/sync failure, and retains rejected headers as unpublished TMPs. All 82 native start/write/Stop and storage cases pass; the previous functions fail 42 controls. Exact bytes, ten-name limits, tick wrap and 25 failure/restart pairs per link are checked with unchanged retained TMPs and closed handles. UI, clock, mount and faults are controlled; drivers and physical SD/panel remain separate checks. Linux CI retains source hashes and logs.
+- [x] Scope and I2C capture constructors stop on preparation/stream-creation failures and preserve fresh first errors through cleanup. The capture suite now passes 78 native cases: 35 writer cases plus 43 constructor cases; the previous constructors fail 14 controls. Both 100-name limits, existing bytes, empty/partial TMP recovery and 25 header-failure/restart pairs per constructor are checked with closed handles and guarded I2C watch ownership. Paths, UI, clocks, data and faults are controlled; physical SD/panel and drivers remain separate checks.
 - [x] System reports the firmware/commit, reset reason, uptime, panel, heap, storage capacity, current OTA state, and persistent last OTA result.
 - [x] Notes and ride summaries use recoverable backup replacement; rides publish only after durable sync, and health logs repair incomplete final rows.
 - [x] Notes loads complete files up to 65,535 bytes, replacing a silent 2,047-byte prefix. Recovery/read/close errors, oversized files and NUL data disable Save; byte-length and SD checks run before storage changes. Its launcher leave hook clears editor ownership. Four preceding-source controls reproduce full-note truncation; 36 native file/fault cases and five real LVGL cases pass, including maximum ASCII/UTF-8 notes and 25 reopens without retained resources in the unchanged 96 KiB pool. Linux and Windows CI retain separate source-bound evidence. Physical SD/panel and power cuts remain open.

docs/architecture.md

@@ -103,6 +103,8 @@ The ebook library verifies regular-file metadata before offering a `.txt` entry,
 
 Scope captures the first rejected header/row write before cleanup and closes an invalid temporary stream without attempting publication. I2C uses a shared finish path for explicit Stop and error cleanup: known row/flush/sync/SD failures close and release recording ownership, preserve the first cause, and report once; only a healthy Stop attempts publication. This prevents a successful retry during cleanup from turning an earlier failure into a Saved result. Native bytes and closed handles are checked with controlled UI/data/time/fault boundaries; sampling, drivers and physical SD behavior remain separate gates.
 
+Scope and I2C constructors clear errno before each directory/metadata/open/stream boundary and stop on a non-collision failure. Scope closes the descriptor, attempts to remove its new empty TMP and reports a failed stream conversion without another filename attempt. I2C retains that empty file, and clears capture paths/ownership after a rejected header. Its watch flag is enabled only after an accepted header. Native constructor checks verify both 100-name bounds, retained-TMP restart, first errors and closed handles; existing path buffers, sample data, CSV formats and watch timing remain unchanged.
+
 See [Storage and compatibility contract](compatibility.md) and [Data formats](data-formats.md).
 
 ## Network and radio

docs/data-formats.md

@@ -41,6 +41,8 @@ The ebook library accepts case-insensitive `.txt` names only after confirming re
 
 Scope and I2C capture failures never retry publication during cleanup. Rejected header/row writes and failed I2C periodic flush/sync stop recording into the current TMP, close it, preserve the first cause and report failure. Known SD unavailability also closes an active I2C capture before adding another row. Healthy explicit saves still use the existing flush/sync/close/rename helper and CSV formats. A failed TMP can contain partial or complete-looking bytes; check the named file before recovery. Native byte/fault checks do not establish physical durability or power-loss recovery.
 
+Scope and I2C creation advance through the 100 same-second names only on an existing CSV or TMP collision. Directory/stat/open/stream-creation failures stop the attempt, preserve the first cause through cleanup and use `EIO` when errno is absent. Scope attempts to remove its newly created empty TMP after a failed `fdopen`; I2C retains and names that empty file. A rejected I2C header retains its partial TMP and leaves capture ownership clear without enabling watch. Restart skips retained files and preserves their bytes; exhausting all names reports `EEXIST`.
+
 UART and RS-485 log creation retry only existing final or temporary filenames. Other directory/stat/open/stream-creation errors stop the attempt and report their first cause; exhausting the ten same-second names reports `EEXIST`. Rejected header/row writes and failed periodic flush/sync close the log and retain the named TMP without a publication retry. A new log skips that retained name. Missing errno falls back to `EIO`, and tick/close calls cannot replace an already captured write failure. Native file checks cover both links and unchanged existing bytes; physical SD and power-loss behavior remain separate checks.
 
 ## CSV conventions

docs/testing.md

@@ -174,11 +174,13 @@ The library retains 64 stored paths of 256 bytes. The entry-limit message means
 python tools/test_capture_write.py --compiler 'C:/path/to/clang.exe'
 ```
 
-The portable runner compiles the actual Scope save callback and I2C log/finish/Stop callbacks together with complete `storage_io.c`. Its 35 cases verify exact native CSV/TMP bytes, the 300-row Scope format, I2C success/transaction-error rows, header/row failures with and without a stream error flag, missing errno, tick-clobbered errno, first-error preservation through close, one-shot flush/sync failures, failed publication, known SD unavailability during logging or Stop, pre-flush timing, a preexisting Scope filename and 25 independent failure/success cycles per writer. The previous callbacks fail 16 controls, including publishing rejected data during cleanup and replacing the first error. All current cases finish with closed native file/descriptor handles and one SD report per I/O failure.
+The portable runner compiles the actual Scope save callback and I2C Start/log/finish/Stop callbacks together with complete `storage_io.c`. All 78 native-file cases pass. The original 35 writer cases verify exact CSV/TMP bytes, the 300-row Scope format, I2C success/transaction-error rows, header/row failures with and without a stream error flag, missing errno, tick-clobbered errno, first-error preservation through close, one-shot flush/sync failures, failed publication, known SD unavailability during logging or Stop, pre-flush timing, a preexisting Scope filename and 25 independent failure/success cycles per writer. The callbacks preceding the writer fix fail 16 of those original controls, including publishing rejected data during cleanup and replacing the first error.
 
-Rejected writes and I2C flush/sync failures close the stream without retrying publication. A complete-looking TMP can remain after a failed flush/sync/close; these checks do not establish physical durability or rollback. UI, clocks/ticks, channel/sample/calibration data, directory preparation, logical mount paths, SD error reporting and I/O faults are controlled. UTC supplies deterministic filenames. Windows descriptor creation adds binary mode so CSV bytes match the SDK's LF output. The I2C start constructor, drivers, ADC acquisition, real LVGL, SDK mount/error filtering, physical SD/panel and power cuts are not executed. The cycle fixture removes its owned prior files between independent sessions; it does not prove retained-TMP collision recovery in the I2C constructor.
+The added 43 constructor cases use the actual I2C Start and Scope save paths with native directories, exclusive creation, stream conversion and descriptor cleanup. They check directory/stat/open/fdopen errors, fresh errno and first-error preservation, missing errno, both 100-name limits, existing CSV/TMP bytes, I2C header failures, unavailable SD admission, watch ownership and same-second restart after retained partial headers or an empty I2C TMP. Both constructors complete 25 header-failure/restart pairs while preserving the failed TMP and checking the next CSV. Scope removes its newly created empty TMP after a failed `fdopen`; I2C retains and names it. The preceding constructors fail 14 controls, including Scope retrying a stream-creation error and I2C enabling watch after a rejected directory operation with stale errno. All cases end with closed native stream/descriptor ownership and one SD report per I/O failure.
 
-Full main/function/storage/header/test hashes, generated callback/config/storage source and compile/result logs stay under `build/capture-write/`. Linux CI retains `capture-write-logs`, including available failure diagnostics. These 35 cases are separate from the Windows native total.
+Rejected writes and I2C flush/sync failures close the stream without retrying publication. A complete-looking TMP can remain after a failed flush/sync/close; these checks do not establish physical durability or rollback. UI, clocks/ticks, channel/sample/calibration data, logical mount paths, SD error reporting and I/O faults are controlled. UTC supplies deterministic filenames; Windows descriptor creation adds binary mode to match SDK LF bytes. Drivers, ADC acquisition, real LVGL, SDK mount/error filtering, physical SD/panel and power cuts are not executed. Recovery checks preserve both generations within each pair; the fixture removes its owned files between pairs and its owned directories after all cases.
+
+Full main/function/storage/header/test hashes, generated callback/config/storage source and compile/result logs stay under `build/capture-write/`. Linux CI retains `capture-write-logs`, including available failure diagnostics. These 78 cases are separate from the Windows native total.
 
 ## Serial log writers
 

main/main.c

@@ -2211,6 +2211,7 @@ static void scope_capture_clicked(lv_event_t *event)
         lv_label_set_text_fmt(scope_capture_status, "SD unavailable: %s", strerror(error ? error : ENODEV));
         return;
     }
+    errno = 0;
     if (mkdir(SCOPE_PATH, 0775) != 0 && errno != EEXIST) {
         int error = errno ? errno : EIO;
         sd_record_error(error);
@@ -2225,6 +2226,7 @@ static void scope_capture_clicked(lv_event_t *event)
     strftime(date, sizeof(date), "%y%m%d", &local);
     strftime(clock, sizeof(clock), "%H%M%S", &local);
     snprintf(directory, sizeof(directory), SCOPE_PATH "/%s", date);
+    errno = 0;
     if (mkdir(directory, 0775) != 0 && errno != EEXIST) {
         int error = errno ? errno : EIO;
         sd_record_error(error);
@@ -2240,22 +2242,26 @@ static void scope_capture_clicked(lv_event_t *event)
         snprintf(temporary_path, sizeof(temporary_path), "%s/%s.TMP", directory, stem);
         snprintf(final_path, sizeof(final_path), "%s/%s.CSV", directory, stem);
         struct stat info;
+        errno = 0;
         if (stat(final_path, &info) == 0) continue;
         if (errno != ENOENT) {
             create_error = errno ? errno : EIO;
             break;
         }
+        errno = 0;
         int descriptor = open(temporary_path, O_WRONLY | O_CREAT | O_EXCL, 0664);
         if (descriptor < 0) {
             if (errno == EEXIST) continue;
             create_error = errno ? errno : EIO;
             break;
         }
+        errno = 0;
         file = fdopen(descriptor, "wb");
         if (!file) {
             create_error = errno ? errno : EIO;
             close(descriptor);
             remove(temporary_path);
+            break;
         }
     }
     if (!file) {
@@ -5935,6 +5941,7 @@ static bool i2c_capture_start(void)
         return false;
     }
 
+    errno = 0;
     if (mkdir(SD_PATH "/I2C", 0775) != 0 && errno != EEXIST) {
         int error = errno ? errno : EIO;
         sd_record_error(error);
@@ -5951,6 +5958,7 @@ static bool i2c_capture_start(void)
     strftime(date, sizeof(date), "%y%m%d", &local);
     strftime(clock, sizeof(clock), "%H%M%S", &local);
     snprintf(directory, sizeof(directory), SD_PATH "/I2C/%s", date);
+    errno = 0;
     if (mkdir(directory, 0775) != 0 && errno != EEXIST) {
         int error = errno ? errno : EIO;
         sd_record_error(error);
@@ -5970,18 +5978,21 @@ static bool i2c_capture_start(void)
         snprintf(i2c_capture_final_path, sizeof(i2c_capture_final_path),
                  "%s/%s.CSV", directory, stem);
         struct stat info;
+        errno = 0;
         if (stat(i2c_capture_final_path, &info) == 0) continue;
         if (errno != ENOENT) {
             create_error = errno ? errno : EIO;
             break;
         }
+        errno = 0;
         int descriptor = open(i2c_capture_temporary_path, O_WRONLY | O_CREAT | O_EXCL, 0664);
         if (descriptor < 0) {
             if (errno == EEXIST) continue;
             create_error = errno ? errno : EIO;
             break;
         }
         temporary_created = true;
+        errno = 0;
         i2c_capture_file = fdopen(descriptor, "wb");
         if (!i2c_capture_file) {
             create_error = errno ? errno : EIO;
@@ -6005,6 +6016,7 @@ static bool i2c_capture_start(void)
         return false;
     }
 
+    errno = 0;
     if (fputs("unix_time,address,register,value,status,speed_khz\n", i2c_capture_file) < 0) {
         int error = errno ? errno : EIO;
         fclose(i2c_capture_file);