feat(diagnostics): the debug recorder — start, the pill, steps, screenshots, stop (E16 S2)

- the start dialog is the consent: level (Részletes/Teljes), what is recorded,
  retention and the cap (now served as diagnostics.session_minutes)
- the pill docks under the toasts: elapsed time, Step (an optional label,
  its own Escape layer), Screenshot (tab capture where the browser has it),
  Stop; compact on a phone
- while recording, lib/log tags every event and every request path (req,
  beacon, uploadReq via one identityHeaders) names the session; applyDiagnostics
  raises the level for the session's run and never lowers a raised one, and
  lapses at whichever ends first
- Stop sends what is waiting before the server closes the session; the cap
  says so and opens the composer
- Settings → Diagnosztika and the command palette start/step/stop it
- the evidence leaves the log upload's own request lines out
- the step shortcut is deliberately palette-only: the keymap's D1 rule bars a
  new modifier chord, and a bare letter collides with the players'

backend/app/debugsession.py

@@ -22,14 +22,14 @@ from datetime import datetime, timedelta, timezone
 from enum import StrEnum
 from typing import Literal, get_args
 
-from sqlalchemy import delete, func, select, update
+from sqlalchemy import and_, delete, func, not_, select, update
 from sqlalchemy.orm import Session, defer
 
 from app import diagnostics
 from app.models import DebugScreenshot, DebugSession, LogEvent, User
 
 HEADER = "x-debug-session"
-MAX_MINUTES = 60
+MAX_MINUTES = diagnostics.SESSION_MINUTES
 SCREENSHOT_MAX_BYTES = 10 * 1024 * 1024
 SCREENSHOTS_MAX = 8
 # Rows an issue can carry. A 60-minute session at Teljes is a few thousand rows; past this the
@@ -216,13 +216,28 @@ def screenshots(db: Session, session: DebugSession) -> list[DebugScreenshot]:
 
 
 # --- the evidence --------------------------------------------------------------------------
+# The browser's own log upload (`POST` here, every few seconds while recording) is how the evidence
+# arrives, not part of it: its server lines would fill the bundle with the recording's plumbing. The
+# browser leaves its copies out for the same reason (frontend lib/diagnostics `isOwnRequest`).
+INGEST_PATH = "/api/diagnostics/events"
+
+
+def _evidence(session: DebugSession):
+    upload_line = and_(
+        LogEvent.event == "http.request", LogEvent.attrs["path"].astext == INGEST_PATH
+    )
+    # `IS TRUE`, not the bare condition: for a row with no event or no attrs it is NULL, and
+    # `NOT NULL` would drop exactly the rows that are evidence.
+    return (LogEvent.debug_session_id == session.id, not_(upload_line.is_(True)))
+
+
 def bundle(db: Session, session: DebugSession) -> tuple[list[LogEvent], int]:
     """The session's log rows, browser and server interleaved in time, capped at BUNDLE_MAX — and
     how many rows it has in all, so a cut bundle can say so."""
     rows = list(
         db.scalars(
             select(LogEvent)
-            .where(LogEvent.debug_session_id == session.id)
+            .where(*_evidence(session))
             .order_by(LogEvent.ts, LogEvent.id)
             .limit(BUNDLE_MAX)
         )
@@ -230,11 +245,7 @@ def bundle(db: Session, session: DebugSession) -> tuple[list[LogEvent], int]:
     total = len(rows)
     if total == BUNDLE_MAX:
         total = (
-            db.scalar(
-                select(func.count())
-                .select_from(LogEvent)
-                .where(LogEvent.debug_session_id == session.id)
-            )
+            db.scalar(select(func.count()).select_from(LogEvent).where(*_evidence(session)))
             or total
         )
     return rows, total

backend/app/diagnostics.py

@@ -27,6 +27,9 @@ DiagnosticsLevel = Literal["INFO", "DEBUG", "TRACE"]
 LEVELS: tuple[str, ...] = get_args(DiagnosticsLevel)
 BASE: DiagnosticsLevel = "INFO"
 ELEVATION_HOURS = 24
+# How long a debug session records at most (E16, app/debugsession.py). Here, beside the other
+# consent window, because the start dialog's consent text states it and reads it from `state`.
+SESSION_MINUTES = 60
 
 
 def effective_level(user: User, now: datetime | None = None) -> DiagnosticsLevel:
@@ -47,6 +50,7 @@ def state(db: Session, user: User) -> dict:
         "level": level,
         "until": user.diagnostics_until.isoformat() if level != BASE else None,
         "retention_days": sysconfig.get_int(db, "log_retention_days"),
+        "session_minutes": SESSION_MINUTES,
     }
 
 

backend/tests/test_debug_sessions.py

@@ -335,15 +335,16 @@ def test_the_evidence_is_the_sessions_rows_in_time_order(db, make_user, as_user)
     sid = _start(client)["id"]
     now = datetime.now(timezone.utc)
 
-    def row(ts, source, session):
+    def row(ts, source, session, event="x.y", attrs=None):
         return LogEvent(
             ts=ts,
             level="INFO",
             sev=9,
             source=source,
             logger=source,
-            event="x.y",
+            event=event,
             msg=source,
+            attrs=attrs,
             user_id=user.id,
             debug_session_id=session,
         )
@@ -353,15 +354,20 @@ def test_the_evidence_is_the_sessions_rows_in_time_order(db, make_user, as_user)
             row(now + timedelta(seconds=2), "api", sid),
             row(now + timedelta(seconds=1), "web", sid),
             row(now, "web", None),
+            # The recording's own log upload is plumbing, not evidence…
+            row(now, "api", sid, "http.request", {"path": debugsession.INGEST_PATH}),
+            # …but a server line with no event code and no attrs is evidence all the same.
+            row(now + timedelta(seconds=3), "api", sid, None),
         ]
     )
     db.commit()
     body = client.get(f"/api/debug-sessions/{sid}/events").json()
-    assert [(i["source"], i["debug_session_id"]) for i in body["items"]] == [
-        ("web", sid),
-        ("api", sid),
+    assert [(i["source"], i["event"]) for i in body["items"]] == [
+        ("web", "x.y"),
+        ("api", "x.y"),
+        ("api", None),
     ]
-    assert body["total"] == 2
+    assert body["total"] == 3
 
 
 # --- screenshots ----------------------------------------------------------------------------
@@ -436,3 +442,7 @@ def test_a_screenshot_can_be_removed_and_is_then_gone(recording):
     assert r.json() == {"ok": True, "deleted": shot}
     r = client.get(f"/api/debug-sessions/{sid}/screenshots/{shot}")
     assert r.status_code == 404 and r.json()["detail"]["reason"] == "screenshot"
+
+
+def test_the_upload_path_left_out_of_the_evidence_is_the_real_one():
+    assert debugsession.INGEST_PATH in {r.path for r in diagnostics_routes.router.routes}

backend/tests/test_diagnostics.py

@@ -68,6 +68,7 @@ def test_raising_the_level_sets_the_servers_expiry_whatever_the_client_sends(db,
         "level": "INFO",
         "until": None,
         "retention_days": 7,
+        "session_minutes": 60,
     }
 
 
@@ -82,6 +83,7 @@ def test_a_lapsed_level_reads_as_the_base_in_me(db, client, make_user):
         "level": "INFO",
         "until": None,
         "retention_days": 7,
+        "session_minutes": 60,
     }