Thanks @RithvikReddy0-0 — the ADR save/restore around the delete/rebuild path is the right fix for #516.

Two things before merge:

1. Add a reproduce-first test (the checklist boxes are unchecked) — index a repo with an ADR, trigger a full re-index, assert the ADR survives. That's the regression guard the project requires for every fix.
2. Please double-check the lifetime of p->saved_adr: on an early-exit path (an error before dump_and_persist_hashes), is it freed? If the pipeline teardown doesn't free(p->saved_adr), that's a leak — add the free on the appropriate path.

(For info: the doubled commit title is just a cosmetic git artifact — the diff itself is clean and not duplicated.) 🙏

Confirming the two concerns from a closer pass:

1. The saved_adr leak is real — on the cbm_gbuf_dump_to_sqlite failure early-return in dump_and_persist_hashes, p->saved_adr is freed neither there nor in cbm_pipeline_free, so it leaks on that error path. Free it on that path (or add it to cbm_pipeline_free).
2. cbm_store_adr_store's return value isn't checked, so a failed restore silently drops the ADR — the same symptom as the original bug. Please surface that error.

Both can go in alongside the reproduce-first test. 🙏

Thanks — all three addressed in 2f434d4.

Leak. free(p->saved_adr) now lives in cbm_pipeline_free, so it's released on every exit path including the cbm_gbuf_dump_to_sqlite failure early-return. The successful-restore path still sets it to NULL after freeing in dump_and_persist_hashes, so there's no double-free.

Unchecked restore. cbm_store_adr_store's return is now checked; a failed restore logs pipeline.err phase=adr_restore instead of silently dropping the ADR.

Test. Added pipeline_adr_survives_full_reindex (reproduce-first): index a repo, store an ADR, force a full re-index by adding files past the incremental threshold, assert the ADR is present and unchanged. Passes against the fix (pipeline_adr_survives_full_reindex PASS).

One note from running the full suite locally: 5619 passed, 1 failed, and the single failure is incr_full_index (tests/test_incremental.c:302 — RSS delta 2560MB vs 2048MB ceiling on a 1100-file project). That's unrelated to this change — the fix only adds a strdup of an ≤8KB ADR string, which can't move RSS by ~512MB. It's the ASAN/UBSan-instrumented test binary inflating memory past a threshold tuned for a native non-instrumented run, and the file isn't touched by this PR. Flagging it for transparency rather than claiming a clean sweep.

Thanks @RithvikReddy0-0 — all three review items are addressed now (the saved_adr leak on the dump-failure path, the unchecked cbm_store_adr_store return, and the reproduce-first test), and CI is green. It just needs a rebase on latest main (currently conflicting). Rebase and I'll merge. 🙏