[Blackwellcode]

Summary

Removes the last 46 except Exception/bare: pass handlers (audit finding B5) and adds tests for the invariant functions that still had none (audit finding T1).

 abort_deleted_media(streamer, filename)
   try:
-    if database.is_deleted_media(...): abort(404)   # NotFound is an Exception ...
-  except Exception: pass                           # ... so the 404 was swallowed
+    deleted = database.is_deleted_media(...)
+  except sqlite3.Error: log warning, serve as before
+  if deleted: abort(404)

core/storage/http.py        close_quietly(): OSError/urllib3 HTTPError -> debug log   (15 handlers)
core/storage/base.py        rotated token not persisted -> warning                     (1)
core/storage/service.py     progress / provider-error bookkeeping -> debug / warning   (2)
core/twitch_api, eventsub   unreadable HTTP error body -> debug                        (5)
core/live_watch_diag, chat_chunker, redis_client, tube_auth -> warning                 (5)
WEBUI/webui.py              sqlite3.Error / OSError / GQL errors -> warning            (18)

Every fallback value stays the same. Only the listed error classes are absorbed; anything else now propagates.

Evidence

• Before (origin/master 016090b): AST count of broad handlers whose body is only pass: 46. unittest discover -s tests: Ran 328 tests ... OK (skipped=20). A tombstoned VOD with its file still on disk: GET /vod/streamer/vod.mp4 -> 200.
  After (this branch): AST count 0. Ran 361 tests ... OK (skipped=23) (Windows; the POSIX tests run in CI). Same request -> 404 (DeletedMediaTombstoneTests.test_tombstoned_vod_page_is_404, red before the fix, green after).
• Tests inject the expected failure for every changed function except three (sqlite3.OperationalError("database is locked"), ConnectionResetError, URLError, PermissionError, corrupt meta.json). Each checks that the fallback still comes back and that a log line is written: tests/test_error_handling.py (22 tests), plus StorageBookkeepingFailureTests in tests/test_storage.py. The three without a dedicated test: the chat-log title read in read_media_sidecar_metadata, the config lookups in twitch_watch, and twitch_eventsub.reload_env (the delete_state call there absorbs Redis errors itself).
• New invariant tests in tests/test_invariants.py: lock-file PID ownership, the instance flock across processes (POSIX), SIGKILL fallback for a channel worker that ignores SIGTERM (POSIX), and traversal and symlink rejection in worker._safe_vod_task_path (17/17 lines covered, was 1/17).
• Coverage, local Windows run (statements + branches): 34 % -> 37 %.
• ruff check .: All checks passed. compileall: OK.

Merge Danger

Door: two-way

Plain revert. No schema, config or data changes.

Blast Radius: narrow

Narrowing except Exception means an unexpected error class (for example a TypeError from a malformed row) now shows up as an HTTP 500 or a traceback in the log, where it used to vanish. That is intended. Deleted VODs and clips whose file still exists now return 404, which was always the intended behaviour.

🤖 Generated with Claude Code

[Blackwellcode]

Superseded by #17 (rebased on master after #15; review fixes).