[Blackwellcode]

Supersedes #14 (rebased onto master after #15, plus the review fixes). The invariant tests from #14 moved to #16.

Summary

Broad exception handlers that hid failures without a log line now catch the expected class and log it. Fallback values are unchanged. One real bug is fixed.

 abort_deleted_media(streamer, filename)
   try:
-    if database.is_deleted_media(...): abort(404)   # NotFound is an Exception ...
-  except Exception: pass                           # ... so the 404 was swallowed
+    deleted = database.is_deleted_media(...)
+  except DB_ACCESS_ERRORS: rate-limited warning, serve as before
+  if deleted: abort(404)

core/database.py      DB_ACCESS_ERRORS = (sqlite3.Error, OSError, ValueError)   # get_db() makedirs, _normalize_channel_row int()
WEBUI/webui.py        _warn_rate_limited(site, ...)   one warning per minute and call site (+ repeat count)
                      _ChatLineSkips                  chat-log lines that are no JSON object: counted, reported once per read
core/storage/base.py  close_quietly(resource: Closable)  OSError / urllib3 HTTPError -> debug (reason in docstring)
core/redis_client.py  REDIS_ERRORS = (RedisError, OSError)
recorder/*            recording-loop checks stay broad on purpose, now with a throttled warning

Commits, in order:

• storage close helper
• token persistence and progress bookkeeping
• core helpers
• tombstone 404
• webui lookups
• changelog
• test formatting
• DB_ACCESS_ERRORS and rate limit
• close_quietly move
• core/recorder continue/return handlers
• webui continue/return handlers
• changelog

Evidence

• Tombstone bug: DeletedMediaTombstoneTests.test_tombstoned_vod_page_is_404 returns 200 on master and 404 here.

• Broad handlers without log or raise (AST count outside tests/ and docs/; throttled_log and _warn_rate_limited count as logging):

  	pass	continue	constant return	other	total
  master a66f0ce	46	15	31	91	183
  this branch 77cc24a	0	0	0	89	89

  The 89 "other" handlers do something besides pass/continue/return (for example return Response("[]")). They are out of scope here.

• Tests: python -m unittest discover -s tests -> master Ran 332 tests ... OK (skipped=20), branch Ran 377 tests ... OK (skipped=20) on Windows. The 20 skips are POSIX-only tests (process groups, real flock, file modes, symlinks); they run here only in CI.

• Coverage, the same command on both trees:

  uv run --no-project --python <venv>\Scripts\python.exe --with coverage -- python -m coverage run --branch --source=. --omit=".venv/*,tests/*,docs/*" -m unittest discover -s tests
  uv run --no-project --python <venv>\Scripts\python.exe --with coverage -- python -m coverage report
  
  `<venv>` is the absolute path of the project virtualenv (the one the tests normally run in); both commands run from the repository root.
  master a66f0ce : TOTAL  21927  13700  7434  802  34%
  branch 77cc24a : TOTAL  22018  12843  7470  965  38%
  

• Negative tests: an unexpected class (RuntimeError) still propagates. OSError and ValueError take the fallback and leave a log line. 5 failing media lookups produce 1 warning, and after 60 s a second one with "4 more". A list of 10 access checks produces 1 warning. twitch_watch with failing channel lookups returns 200 with 2 warnings. A failing progress save warns once per transfer and never aborts it.

• Changed assertions in this PR's own tests (git diff 0e49208 HEAD -- tests/; no assertion from master is touched):

  • test_maintenance_bypass_check_failure_is_logged_and_denied is removed. It mocked is_user_exempt to raise, but that call cannot raise: site_maintenance.load_state() handles unreadable files itself, so the handler was dead and is gone. It is replaced by MaintenanceBypassTests, which uses a real corrupt maintenance.json.
  • assertLogs("storage.http") -> assertLogs("storage.base") because close_quietly moved modules.
  • WebuiLookupFailureTests.setUp clears the module-wide rate-limit state.
  • All other test diffs only add tests or re-wrap with lines.

• ruff check .: All checks passed. compileall: OK.

Merge Danger

Door: two-way

Plain revert. No schema, config or data changes.

Blast Radius: moderate

• An error class nobody expected (for example a TypeError from a code bug) now shows up as an HTTP 500 or a traceback, where it used to vanish. That is intended, but it can surface latent bugs right after deploy.
• Database fallbacks catch sqlite3.Error, OSError and ValueError.
• The recording loop's own checks stay broad, so they cannot stop a recording.
• Deleted VODs and clips whose file still exists now return 404, as intended.
• Log volume during a database outage is bounded to one line per minute and call site.

🤖 Generated with Claude Code