Log store write failures at the source; share the oper guard

The store's map_err(|_| Internal) discarded the real IO error, so a
disk-full or permissions failure was invisible; log it once in the log
append path where it happens. Add echo_api::require_oper (parameterised
by the required privilege) and route the three copied per-service guards
through it, keeping each service's own wording and policy.

api/src/lib.rs

@@ -1175,6 +1175,20 @@ pub fn help(me: &str, from: &Sender, ctx: &mut ServiceCtx, blurb: &str, topics:
     }
 }
 
+// Gate a command on operator privilege. `need` is the privilege required, or
+// None for "any operator". Notices the user and returns false when denied,
+// otherwise returns true. `what` names the action, e.g. "reviewing reports".
+pub fn require_oper(me: &str, from: &Sender, ctx: &mut ServiceCtx, need: Option<Priv>, what: &str) -> bool {
+    let ok = match need {
+        Some(p) => from.privs.has(p),
+        None => from.privs.any(),
+    };
+    if !ok {
+        ctx.notice(me, from.uid, format!("Access denied — {what} is for services operators."));
+    }
+    ok
+}
+
 // Format a Unix timestamp (seconds) as "YYYY-MM-DD HH:MM:SS UTC", using Howard
 // Hinnant's civil-from-days algorithm so no date crate is needed.
 pub fn human_time(ts: u64) -> String {

modules/helpserv/src/lib.rs

@@ -87,11 +87,7 @@ impl Service for HelpServ {
 
 // Working the help queue is operator-only.
 fn require_oper(me: &str, from: &Sender, ctx: &mut ServiceCtx) -> bool {
-    if from.privs.any() {
-        return true;
-    }
-    ctx.notice(me, from.uid, "Access denied — working the help queue is for services operators.");
-    false
+    echo_api::require_oper(me, from, ctx, None, "working the help queue")
 }
 
 // Claim ticket `id` for the calling operator (shared by TAKE and NEXT).

modules/hostserv/src/lib.rs

@@ -103,11 +103,7 @@ impl Service for HostServ {
 
 // Operator gate for vhost administration.
 fn require_oper(me: &str, from: &Sender, ctx: &mut ServiceCtx) -> bool {
-    if from.privs.has(Priv::Admin) {
-        return true;
-    }
-    ctx.notice(me, from.uid, "Access denied — assigning vhosts is for services operators.");
-    false
+    echo_api::require_oper(me, from, ctx, Some(Priv::Admin), "assigning vhosts")
 }
 
 // Canonicalise a vhost the way the ircd will actually display it: the host part

modules/reportserv/src/lib.rs

@@ -66,9 +66,5 @@ impl Service for ReportServ {
 
 // Reviewing the queue is for operators only.
 fn require_oper(me: &str, from: &Sender, ctx: &mut ServiceCtx) -> bool {
-    if from.privs.any() {
-        return true;
-    }
-    ctx.notice(me, from.uid, "Access denied — reviewing reports is for services operators.");
-    false
+    echo_api::require_oper(me, from, ctx, None, "reviewing reports")
 }

src/engine/db/mod.rs

@@ -690,7 +690,12 @@ impl EventLog {
         } else {
             LogEntry { origin: self.origin.clone(), seq: 0, lamport: 0, event }
         };
-        self.persist(&entry)?;
+        if let Err(e) = self.persist(&entry) {
+            // Surface the real cause (disk full, permissions, ...) here at the
+            // source; callers only see a generic Internal error further up.
+            tracing::error!(%e, path = %self.path.display(), "failed to write event to the log");
+            return Err(e);
+        }
         if global {
             self.versions.insert(entry.origin.clone(), entry.seq);
             self.notify(&entry);