fix: diagnose compiler status publication and retry release lookup

Author: Sunrisepeak

.agents/docs/2026-11-06-compiler-attempt-recovery.md

@@ -287,6 +287,14 @@ existing compiler log at each of those exits; a waiter replays that log only
 when the controller is gone and status remains absent. This changes the
 diagnostic boundary, not the success criteria. The next Windows cross job must
 identify the cause before any protocol or OS change is attributed to it.
+The first diagnostic run narrowed this to final-status publication after unit
+retirement. The publisher now reports whether its temporary open, write, close
+or atomic rename failed, with the OS wrapper's OpenKal condition code for the
+rename and without embedding a path or user name. This wrapper does not expose
+the original Windows NTSTATUS. A controlled close failure and a
+directory-target rename refusal exercise the stage classification. The next
+cross-host run must determine the actual condition before any retry policy is
+chosen.
 
 ## Separate Windows build-program defect
 

.github/tools/upgrade_lane.sh

@@ -59,17 +59,32 @@ IS_LINUX=0; [[ $PLAT == linux-* ]] && IS_LINUX=1
 
 # ── the previous release ───────────────────────────────────────────────
 CURRENT=$(sed -n 's/^version *= *"\([^"]*\)".*/\1/p' mcpp.toml | head -1)
-OLD_VER=$(curl -fsSL ${GH_TOKEN:+-H "Authorization: Bearer $GH_TOKEN"} \
-            "https://api.github.com/repos/mcpp-community/mcpp/releases?per_page=20" \
-          | "$PY" -c '
+release_headers=()
+if [ -n "${GH_TOKEN:-}" ]; then release_headers=(-H "Authorization: Bearer $GH_TOKEN"); fi
+OLD_VER=''
+for attempt in 1 2 3; do
+  # A hosted Windows run once received an empty release list before it could
+  # exercise any upgrade. Retry this read-only input, never a product action.
+  if curl -fsSL --connect-timeout 10 --max-time 30 "${release_headers[@]}" \
+      "https://api.github.com/repos/mcpp-community/mcpp/releases?per_page=20" \
+      -o "$W/releases.json"; then
+    OLD_VER=$("$PY" -c '
 import json, sys
 current = sys.argv[1]
-for r in json.load(sys.stdin):
-    v = r["tag_name"].lstrip("v")
-    if not r["draft"] and not r["prerelease"] and v != current:
-        print(v); break
-' "$CURRENT")
-case "$OLD_VER" in ''|*[!0-9.]*) echo "::error::no previous release resolved (got '$OLD_VER')"; exit 1 ;; esac
+with open(sys.argv[2], encoding="utf-8") as source:
+    releases = json.load(source)
+if isinstance(releases, list):
+    for release in releases:
+        version = release["tag_name"].lstrip("v")
+        if not release["draft"] and not release["prerelease"] and version != current:
+            print(version)
+            break
+' "$CURRENT" "$W/releases.json") || OLD_VER=''
+    case "$OLD_VER" in ''|*[!0-9.]*) ;; *) break ;; esac
+  fi
+  [ "$attempt" = 3 ] || sleep 2
+done
+case "$OLD_VER" in ''|*[!0-9.]*) echo "::error::no previous release resolved after three metadata reads (got '$OLD_VER')"; exit 1 ;; esac
 echo "previous release: $OLD_VER; this commit: $CURRENT ($PLAT, variant $VARIANT)"
 
 name="mcpp-$OLD_VER-$PLAT.$EXT"

CHANGELOG.md

@@ -18,6 +18,8 @@
   and BMI/object identity checks require a regular output file on every host.
   A witness failure identifies its failed observation boundary, and a detached
   supervisor's failure is available to the waiter even though its stdio is closed.
+  Status publication now distinguishes temporary open, write, close and rename
+  failures, including the OpenKal condition of a failed rename.
 - Launch descriptions include the selected target, profile, resolved platform
   and available named runners, including the reachable leg of a target set.
   Editor debug launches can retain the configuration that actually built the program.

src/build/schedule/compiler_transaction.cpp

@@ -3,22 +3,35 @@ import std;
 
 namespace mcpp::build::schedule::transaction {
 
-bool replace_record(const fs::path& path,std::string_view bytes) {
+bool replace_record(const fs::path& path,std::string_view bytes,std::string* diagnostic) {
     // No process may observe a partial record. This protects process loss,
     // not power loss; do not change the OS library's durable write_atomic.
     static const auto who=os::process::self();
     static std::atomic<unsigned long long> sequence{0};
-    if(!who||!who->id||!who->started_ns)return false;
+    auto fail=[&](std::string_view stage) {
+        if(diagnostic)*diagnostic=stage;
+        return false;
+    };
+    if(!who||!who->id||!who->started_ns)return fail("identify writer");
     const auto temporary=path.parent_path()/named(std::format(".mcpp-record-{}-{}-{}",
         who->id,who->started_ns,sequence++));
     std::ofstream output(temporary,std::ios::binary|std::ios::out|std::ios::noreplace);
-    if(!output)return false; // Never remove a name this invocation did not create.
+    if(!output)return fail("open temporary"); // Never remove a name this invocation did not create.
     output.write(bytes.data(),static_cast<std::streamsize>(bytes.size()));
     output.flush();
     const bool written=bool(output);
     output.close();
     const bool closed=bool(output);
-    if(written&&closed&&os::fs::rename(temporary,path,true))return true;
+    if(written&&closed) {
+        auto renamed=os::fs::rename(temporary,path,true);
+        if(renamed)return true;
+        if(diagnostic)*diagnostic=std::format("rename temporary (condition {}, native {})",
+            static_cast<int>(renamed.error().code),renamed.error().native);
+    } else if(!written) {
+        fail("write/flush temporary");
+    } else {
+        fail("close temporary");
+    }
     std::error_code ec;fs::remove(temporary,ec);return false;
 }
 bool publish(const fs::path& path,std::string_view tag,const Fields& fields) {

src/build/schedule/compiler_transaction.cppm

@@ -37,7 +37,7 @@ std::string pack(std::string_view tag, const Fields& fields) {
     return body + "\n" + mcpp::toolchain::hash_string(body) + "\n";
 }
 // Atomic visibility across process loss; storage durability is not promised.
-bool replace_record(const fs::path& path,std::string_view bytes);
+bool replace_record(const fs::path& path,std::string_view bytes,std::string* diagnostic=nullptr);
 bool publish(const fs::path& path,std::string_view tag,const Fields& fields);
 Record read(const fs::path& path, std::string_view tag) {
     std::ifstream input(path,std::ios::binary);

src/build/schedule/detach_codegen.cppm

@@ -312,8 +312,8 @@ std::optional<int> read_rc(const std::filesystem::path& slot) {
 
 // Temp file + rename, so a reader never observes half a number. The same
 // guarantee, for the same reason, that makes watching the BMI path sound.
-bool write_rc(const std::filesystem::path& slot, int rc) {
-    return transactions::replace_record(suffixed(slot,".rc"),std::to_string(rc)+"\n");
+bool write_rc(const std::filesystem::path& slot, int rc,std::string* diagnostic=nullptr) {
+    return transactions::replace_record(suffixed(slot,".rc"),std::to_string(rc)+"\n",diagnostic);
 }
 
 // Stable kernel lock slots, shared by ordinary and detached compilers. The
@@ -888,7 +888,11 @@ int supervise(const std::filesystem::path& slot,
             record_supervisor_error(slot,retired.error());return 1;
         }
         if(!attempt.retired(rc)) {record_supervisor_error(slot,"cannot publish compiler retirement certificate");return 1;}
-        if(!write_rc(slot,rc)) {record_supervisor_error(slot,"cannot publish compiler final status");return 1;}
+        std::string status_failure;
+        if(!write_rc(slot,rc,&status_failure)) {
+            record_supervisor_error(slot,std::format("cannot publish compiler final status: {}",status_failure));
+            return 1;
+        }
         if(!transactions::release_reservation(permit->reservation,attempt.directory)) {
             record_supervisor_error(slot,"cannot release compiler reservation");return 1;
         }

tests/unit/test_compiler_transaction.cpp

@@ -223,10 +223,20 @@ TEST(CompilerTransaction, ChangedBmiParentCannotRedirectCertifiedRecovery) {
 
 TEST(CompilerTransaction, RecordCloseFailureDriver) {
     if(!mcpp::invocation::get("MCPP_TEST_RECORD_CLOSE_DRIVER"))GTEST_SKIP()<<"subprocess driver";
-    EXPECT_FALSE(tx::replace_record("record","replacement"));
+    std::string diagnostic;
+    EXPECT_FALSE(tx::replace_record("record","replacement",&diagnostic));
+    EXPECT_EQ(diagnostic,"close temporary");
     EXPECT_EQ(Transaction::contents("record"),"previous");
     EXPECT_TRUE(fs::exists("record-close-refused"));
 }
+TEST(CompilerTransaction, FailedRenameReportsTheStageAndPreservesItsTarget) {
+    Transaction t;
+    fs::create_directory(t.root/"record");
+    std::string diagnostic;
+    EXPECT_FALSE(tx::replace_record(t.root/"record","replacement",&diagnostic));
+    EXPECT_TRUE(diagnostic.starts_with("rename temporary (condition "))<<diagnostic;
+    EXPECT_TRUE(fs::is_directory(t.root/"record"));
+}
 TEST(CompilerTransaction, RecordOpenAppearanceDriver) {
     if(!mcpp::invocation::get("MCPP_TEST_RECORD_OPEN_DRIVER"))GTEST_SKIP()<<"subprocess driver";
     auto record=tx::read("record","schema");