2 Commits

Include renames

Author	SHA1	Message	Date
peter	54d19cc386	fix(logs): deep-review round 1 — say each failure once, and scrub it everywhere ... - yt-dlp's text is scrubbed wherever it is logged, not only in the adapter: `formats.log_safe` takes out the URL, the `[extractor] <id>:` prefix and file paths, and the job-failed, refused, edit-failed and backfill lines use it. Done lines log the asset id, not the title-built path. The PII contract now bans `rel`/`rel_path`/`title`. - A traceback goes with a download/edit failure only when it is our own code failing; for yt-dlp's DownloadError, our RuntimeErrors and OSErrors its foot is the unscrubbed message. - yt-dlp's `error` maps to WARNING: it fires on attempts the fallback client set recovers from; the job's verdict is `download.job.failed`. - The sink groups a bare `%s` pass-through by its text (numbers folded), and a process's last batch closes the repeat window, so a short-lived download child still reports what it dropped. - Worker-side failures (stall, wall-clock, no asset, cached asset error) log `download.job.failed` with a cause; they left no line at all before. The crash, supervisor-error and non-zero-exit lines carry the code too. - An edit failure is one coded line in `_fail_edit`, for every path. - `logs.get_logger("__main__")` resolves to the `-m` module, so the worker and the download child keep their names. - TRACE lines carrying user content are gated on `logs.consented_trace()`, not on the process level; a contract test pins it. - The OAuth token refresh goes through `_upstream_failure`; transport errors carry reason `transport`. Subscribe recognises a duplicate by reason code only (the prose fallback was dead). - Once-only guards for a stale sysconfig override and a refusing HLS session directory; item_detail splits Plex failures from our own parse bugs. - The playlist breaker line names the playlist and the action; comments that were false (runner noqa, `_merge_vtt`, sink grouping) are corrected.	2026-09-18 03:16:15 +02:00
peter	04b58e5c6f	feat(logs): give the log the events that no request line already carries ... The gap this sprint was scoped against turned out to be smaller than the survey said, and in a way worth writing down: `log_requests` already records every HTTP call with its route template, status, duration, request id and user id, and the audit log already records every admin act on someone else's account. Putting a line in each of routes/downloads.py's twenty mutating endpoints would have added a second copy of the first and nothing else. So this instruments what neither of them can see. yt-dlp now explains itself to our log. `quiet: True` was doing more than quieting: with no `logger` its whole account of a download went to the child's stdout, so "Requested format is not available", a signature-extraction failure or a POT refusal reached us only as whatever text ended up in the raised exception — the real reason a download failed was routinely one line the app never kept. Measured against the pinned yt-dlp 2026.07.04 before wiring it: with `logger` set it calls `debug` for extraction and progress lines and `warning`/`error` for the rest, and neither `quiet` nor `no_warnings` gates those calls. `debug` lands at TRACE, being several lines a second, so the noisy half is the half the user's own consent gates. The full source URL is trimmed to its host on the way in — it is a row of someone's download history, and `logs.set_job` already puts the job id on every one of these lines. The option is set AFTER the adapter merge, like `cookiefile` and the size cap: a source adapter must not be able to take away the one account of what went wrong that a failed job leaves behind. An HLS session now says which pipeline it got (transcode/remux, hw, tonemap, variants, offset) — everything downstream is about that choice, and it was only inferable from an ffmpeg command line nobody keeps. A session culled by the concurrent-transcode cap says so: somebody's playback stops there, the route turns it into a retryable 404, and "my film keeps rebuffering" had no other explanation anywhere. The HW→SW fallback keeps its line and gains an event code. A live search refused by a quota cap says WHICH cap: the 429 is in the request line either way, but the per-user daily cap is answered by tomorrow and the shared budget by the admin. The download and edit job lifecycle lines gain event codes, which is what E22.6's console filters on — the job id was already a structured field. tests/test_ytdlp_logging.py; three of its four cases mutation-checked. A fourth (a `%` in a progress line) survived its mutation — stdlib only applies `%` formatting to a record that has args — so it is gone rather than kept as a case nothing can break; the reasoning moved into the comment on `_emit`.	2026-09-18 01:28:52 +02:00