fix(export): write graph.canvas and Obsidian notes atomically

[drmikecrypto]

Route to_canvas and owned_write through paths.write*_atomic so concurrent readers (e.g. git hashing) never see a truncated file.

Fixes #3282

[graphify-labs]

Graphify reviewed this change.

Worth a look — the grounded gate found no coupling regressions or blocking issues, but 1 advisory finding(s) below merit a look before merge.

Formal verification. 1 change(s) tested, no difference found (not proven).

---

Graphify review — findings

Makes to_canvas and Obsidian vault note writes atomic by routing them through write_json_atomic and write_text_atomic (write-temp-then-os.replace) instead of writing files in place, so an existing output is preserved intact when the write fails partway. Adds regression tests asserting the replace path is used and that the prior file survives a simulated os.replace failure.

Worth a look

• to_canvas no longer writes through symlink output paths — graphify/export.py:1202 · Escalate · medium
  • agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 511 functions depend on the 58 functions this change touches.

Health — this change adds coupling hotspots:

• new: _rebuild_code() — 113 callers, 50 callees
• new: to_obsidian() — 38 callers, 14 callees
• new: to_json() — 54 callers, 7 callees
• new: dispatch_command() — 2 callers, 123 callees
• new: _make_graph() — 32 callers, 6 callees
• new: run_pipeline() — 8 callers, 13 callees
• new: to_canvas() — 20 callers, 5 callees
• new: to_graphml() — 15 callers, 4 callees
• …and 3 more — each is listed as a finding

Verification — 511 functions in the blast radius were not formally verified this run (proofs are advisory here).

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

• verification_scope: 346 function(s) in the blast radius were not formally verified this run

Formal verification

No difference found (not proven): No behavior difference found in to\_canvas (not a proof).

The verifier ran both versions of to\_canvas on many inputs and saw identical behavior every time. Strong evidence the change is safe, but evidence, not a proof.

Guarantee: Empirical: differential testing (both versions run on many generated inputs). A divergence on an untested input remains possible, so this is 'no counterexample found', not 'proven equivalent'.

Note: An input the sampler did not try could still differ.

Could not verify: Could not verify to\_obsidian.

The verifier did not have enough to check to\_obsidian, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: non-vacuity: domain too small (only 2 distinct inputs exercised, need 3) — 'no divergence' would be near-vacuous

· 1 grounded finding(s) anchored inline below; 10 more finding(s) on lines outside this diff (see the check run).

[graphify-labs]

⚠️ Health regression — to_graphml()

15 callers depend on it (afferent coupling).

Grounded coupling-delta finding (deterministic), not an LLM guess.