fix(logs): rule on every swallowed exception in the backend

114 exception handlers neither logged nor re-raised. The defect was never that
they are silent — plenty of them should be — it is that their silence said
nothing, so nobody could tell a decision from an oversight. Each one has now been
read. 44 got a line; the other 70 carry `# silent-ok: <why>`.

What the silent ones had been hiding, in the cases that got a line:
- A failed ffprobe sent every HDR file down the 8-bit pipeline, so playback
  degraded to a software transcode with nothing saying why; a failed audio probe
  collapsed a multi-audio file to one track and the player showed no language
  picker; a failed first-PTS probe left subtitles seconds out of sync.
- A subtitle sidecar that existed but would not parse made a PARTIAL track read as
  complete, permanently — the viewer loses every cue past the cached window.
- An unreadable crop/trim/cut-list in an edit spec was dropped, so the clip came
  out uncropped, untrimmed, or shorter than the one the user built.
- A dropped `max_height` downloaded at best quality against an explicit cap.
- A failed videos.list enrich made every candidate undroppable-from-judgement and
  therefore dropped: a working search rendered as "no results".
- An unusable password hash answered as "wrong password", locking the owner out
  and telling them they mistyped; a rotated TOKEN_ENCRYPTION_KEY turned every
  stored token into "not connected".
- A stored admin setting that would not coerce fell back to the env default while
  the settings page went on showing the saved value.
- A one-off InnerTube config failure pinned the whole process to the hard-coded
  fallback key, and searches return nothing when that goes stale.
- The HLS sweep reported 0 swept — like a clean run — when it could not list its
  own root, leaving every crashed session's segments on disk forever.

Four of them are counted rather than logged per item (dropped cues, dropped cut
list segments, unreclaimed GC files) and reported once per call, because the
alternative is one line per cue over a whole subtitle track.

ruff gains S110 and BLE001. Every blind `except Exception` that remains carries
`# noqa: BLE001 — <why>`, which is the point: catching everything is sometimes
right, and always worth a sentence. plex/sync.py's three best-effort backfill
catches now keep the traceback — a blind catch over a batch that fetches AND
writes could be Plex, the database or our own bug, and `%s` of the exception told
them apart badly. main.py's boot-time log-level read likewise.

logs.event's `code` is positional-only now: `event("x", code=...)` was a TypeError,
and `code` is exactly the word a caller reaches for when the thing that failed has
one of its own.

tests/test_swallowed_exceptions.py is the wider rule ruff cannot see: a handler
that neither logs nor re-raises must say why. Both cases mutation-checked — a
marker removed and a log line removed each fail it, naming the handler.

backend/app/sync/autotag.py

@@ -28,7 +28,13 @@ try:
     def _restrict(codes: list[str]) -> None:
         _identifier.set_languages(codes)
 
-except Exception:  # pragma: no cover - fallback to module-level API
+except Exception:  # noqa: BLE001 — pragma: no cover, fallback to the module-level API
+    # The fallback classifies without the normalisation the identifier applies, so language tags
+    # come out subtly different — and nothing else in the app would ever hint at which path ran.
+    log.info(
+        "the langid model could not be loaded; using the module-level classifier",
+        extra=logs.event("autotag.langid.fallback"),
+    )
     import py3langid as _langid
 
     def _classify(text: str):

backend/app/sync/playlists.py

@@ -57,7 +57,17 @@ def _load_baseline(pl: Playlist) -> tuple[list[str] | None, set[str]]:
         return None, set()
     try:
         val = json.loads(pl.synced_video_ids)
-    except (ValueError, TypeError):
+    except (ValueError, TypeError) as exc:
+        # No baseline means the three-way merge has no "what we last agreed on" to subtract, so
+        # it degrades to a union: nothing is lost, but a delete made on either side comes back.
+        log.warning(
+            "the sync baseline for a playlist could not be read; merging as a union",
+            extra=logs.event(
+                "sync.playlist.baseline_unreadable",
+                playlist_id=pl.id,
+                reason=type(exc).__name__,
+            ),
+        )
         return None, set()
     if isinstance(val, list):
         return [str(v) for v in val], set()
@@ -439,7 +449,13 @@ class _Breaker:
             return FAILED
         try:
             out = op()
-        except YouTubeError:
+        except YouTubeError as exc:
+            # The client logged the call, but not WHICH item it was for — and the caller's failure
+            # list only ever reaches the user as a count.
+            log.debug(
+                "a playlist write to YouTube failed",
+                extra=logs.event("sync.playlist.item_push_failed", reason=exc.reason),
+            )
             on_fail()
             self.hit(False)
             return FAILED
@@ -531,7 +547,17 @@ def merge_playlist(db: Session, user: User, pl: Playlist, *, live=None) -> dict:
         if snippet is not None and (snippet.get("title") or "") != pl.name:
             try:
                 yt.update_playlist_title(pl.yt_playlist_id, pl.name)
-            except YouTubeError:
+            except YouTubeError as exc:
+                # All the caller passes on is the word "title", which says the rename did not
+                # happen but not that YouTube refused it, or why.
+                log.debug(
+                    "a playlist rename did not reach YouTube",
+                    extra=logs.event(
+                        "sync.playlist.title_push_failed",
+                        playlist_id=pl.id,
+                        reason=exc.reason,
+                    ),
+                )
                 failures.append("title")
         # Propagate genuine local deletes.
         for vid in mp.remove_from_yt:

backend/app/sync/runner.py

@@ -120,14 +120,18 @@ def run_rss_poll(db: Session, channels: list[Channel] | None = None) -> dict[str
             except RssError as exc:
                 log.debug("RSS poll skipped for channel %s: %s", channel.id, exc)
                 fail(exc.reason, f"{channel.id}: {exc}")
-            except Exception as exc:
+            # silent-ok: `fail(unexpected=…)` is the report — it logs at ERROR with the
+            # traceback, once per reason per poll, which is the flood control this loop needs.
+            except Exception as exc:  # noqa: BLE001 — one channel must not stop the poll
                 fail(
                     "error", f"{channel.id}: {exc}", unexpected=f"RSS fetch failed for {channel.id}"
                 )
             else:
                 try:
                     new += apply_rss_feed(db, channel, entries)
-                except Exception as exc:
+                # silent-ok: `fail(unexpected=…)` below is the report — ERROR with the traceback,
+                # once per reason per poll.
+                except Exception as exc:  # noqa: BLE001 — one channel must not stop the poll
                     # A write failure (read-only DB, failover) leaves the channel just as un-polled
                     # as an unreachable feed — count it, or a wholly broken run reports "failed=0".
                     db.rollback()

backend/app/sync/subscriptions.py

@@ -16,6 +16,8 @@ log = logs.get_logger(__name__)
 def _to_int(value) -> int | None:
     try:
         return int(value) if value is not None else None
+    # silent-ok: an upstream count we cannot read is stored as no count, which the card renders as
+    # absent rather than as zero. Per-channel over a whole subscription list, so it must stay quiet.
     except (TypeError, ValueError):
         return None
 
@@ -25,6 +27,8 @@ def _parse_dt(value: str | None) -> datetime | None:
         return None
     try:
         return datetime.fromisoformat(value.replace("Z", "+00:00"))
+    # silent-ok: as `_to_int` above — an unreadable upstream date becomes NULL, and every caller
+    # already treats a missing date as unknown.
     except ValueError:
         return None
 

backend/app/sync/videos.py

@@ -39,6 +39,8 @@ def parse_dt(value: str | None) -> datetime | None:
         return None
     try:
         return datetime.fromisoformat(value.replace("Z", "+00:00"))
+    # silent-ok: a pure parser with no video to name — the only thing it could put in a line is
+    # the upstream string itself. None is stored, and absent is how the UI renders it.
     except ValueError:
         return None