Summary

Three linked observability fixes so operators can correlate cross-process cascade failures when sync-cli is invoked once per resource type as separate processes:

1. Roles.create_resource / update_resource — log source id + role name at ERROR before re-raising on unhandled failure. Previously the module logged nothing before propagating the HTTP error, so a downstream resource type that later couldn't remap the role UUID had no way to see which specific role failed to sync.

2. Counter — track failed and missing-dependency source ids by resource type. apply_resources emits a per-type summary at end so a subsequent sync-cli invocation can find the exact ids to search for in cascade logs. Ids are chunked at 50 per line to stay under common log-shipper truncation caps. Backwards-compatible: existing callers that pass no ids still increment the numeric counter as before.

3. paginated_request — elevate the non-5xx mid-pagination failure log to say TRUNCATED explicitly and mention downstream cascade risk. A 403 Forbidden on one page previously produced a benign-looking Error during paginated request ... line and silently truncated the returned resource list; downstream syncs saw a partial source list without knowing why.

Motivation

When sync-cli is orchestrated as one process per resource type (each reading state from a shared store), a failure in an earlier process can cascade into "missing connections" errors in later processes referencing ids that never appeared in any prior log. These three changes make that failure mode debuggable from logs alone.

No behavior change for callers that

• don't hit an unhandled error in Roles.create/update (2xx and handled 4xx paths unchanged)
• don't experience non-5xx mid-pagination failures
• don't consume the new counter attributes

Test plan

• pytest tests/unit/ — 829 passing (19 new across 4 new test files).
• New coverage includes:
  • Counter data-structure semantics (backwards-compat guards).
  • Handler-level summary emission: chunking, insertion-order preservation, silence-on-clean-run, exception propagation.
  • paginated_request truncation log wording (403 path) + regression guard for 5xx isolation path.
  • Roles create/update ERROR logging on source id + role name.