Modernize build, add diagnostics and live stream-health status strip

[Tarrant64]

Why

Upstream v2.5 works, but audio silently degrades and then stops after roughly 15-20 minutes while the process stays alive and the bot stays connected in voice — the only recovery is a manual restart (upstream issues #16 / #46).

This fork exists to own the build, instrument the failure so we can see which metric moves first, and add quality-of-life features along the way. Nothing here claims to fix the stall yet; the goal of this branch is to make the failure visible and measurable.

What changed

1. Dependency modernization (5fa9d5a)

• PyQt5 5.15.9 → PyQt6 6.11.0
• sounddevice 0.4.6 → 0.5.6
• Python 3.10 → 3.12 (CI)
• PyInstaller 5.1 → 6.22.2
• discord.py[voice] 2.7.1 unchanged

2. Build + CI (b4bb728, d66ea07, 93dde0b)

• build/main.spec rewritten for PyInstaller 6: the old a.binaries - TOC([...]) idiom, block_cipher, a.zipped_data, win_no_prefer_redirects etc. were all removed in PyInstaller 6, so the previous spec could not run at all. Paths now derive from SPECPATH rather than the caller's cwd. Adds davey (discord.py 2.7's DAVE/E2EE voice extension) as a hiddenimport — it is imported from inside the voice stack, so relying on the module graph to find it is a gamble.
• Two-leg CI matrix: a modern leg (3.12 / PyInstaller 6 / PyQt6) and a baseline control leg that pins the exact pre-modernization toolchain, spec and application sources (source_ref: b9ea7bf is checked back out over the tree), so there is always a known-good artifact to compare against when the modern leg misbehaves. fail-fast: false so one leg failing still produces the other's artifact.
• Triggers: push on feature/** (GitHub only shows the Run workflow button for workflows on the default branch, so a feature-branch workflow needs a push trigger to ever build) plus workflow_dispatch, keeping the original release: prereleased asset upload.
• Concurrency cancellation — superseded runs are cancelled rather than billed; this is a private repo and windows-latest bills at a 2x minute multiplier.
• Version resource stamping (build/version_info.py, modern leg only): the exe previously reported FileVersion/ProductVersion 0.0.0.0 with empty CompanyName/FileDescription, so a binary found on disk was unidentifiable. Now stamped 2.5.0.<run_number> with the branch ref and short sha carried in the version strings. Version derivation can never fail the build — every environment read falls back to a static default and the spec wraps the load in try/except.
• The baseline leg's setuptools<82 pin: setuptools 82.0.0 removed pkg_resources, which PyInstaller 5.1 imports at the top of its own __init__.py. The pin belongs on the leg, not on PyInstaller — bumping PyInstaller would delete the thing being measured.

3. Diagnostic logging (37424d4 — logging_setup.py)

• Rotating handlers (2 MB × 3) for the previously unbounded DAP_errors.log and discord.log, plus a new INFO-level DAP_session.log lifecycle trail with millisecond timestamps. Bot tokens are redacted from the logged argv line.
• Promotes discord.py's two most diagnostic voice lines out of DEBUG obscurity to WARNING, even without -v: 'Aborting playback' (player.py:818) and 'Not connected, waiting for %ss...' (player.py:814). These are the load-bearing lines and were previously invisible. Aborting playback sits immediately before a bare return that leaves AudioPlayer._end unset, so VoiceClient.is_playing() keeps returning True on a dead thread — a single such line proves the silent-abort hypothesis outright. The re-badge is done on a copy of the record, so -v's discord.log still shows the original DEBUG level.

4. Instrumentation (37424d4, 0f7136f — instrumentation.py, --diagnose)

InstrumentedPCMStream subclasses sound.PCMStream and overrides read() only — sound.py is untouched. Per call it records:

• read-block timing of the PortAudio read,
• the PortAudio overflowed flag that upstream discards via [0],
• returned length and input ring depth,
• a drift ledger (frames read / 48000 vs elapsed wall clock, in seconds and ppm).

VoiceStatePoller polls the voice client every 5s and escalates the two silent-death signatures to WARNING: is_playing() True while _player.is_alive() is False (silent abort), and _player.loops frozen across a poll while the thread is alive (player parked). Every discord.py private access (_player, _connection, .loops) goes through a guard that logs one WARNING and then permanently retires that probe, so a discord.py upgrade cannot crash the app.

As of 0f7136f, metric collection runs on every session and --diagnose gates only the verbose per-5s log lines. The SILENT ABORT / PLAYER PARKED warnings are deliberately no longer behind the flag — they fire at most once per episode and are exactly the evidence we want from a user who hits the bug without thinking to pass a flag.

5. UI restyle (1e5fd4e, b10edb9, a75798e)

• Layered surfaces (titlebar #131417 / panel #24262C / inset control well #1B1D21) so inputs read as recessed; consistent 8px radii (was a mix of 2px/3px).
• Full :hover / :pressed / :focus / :disabled coverage on every interactive control — focus and disabled were previously invisible, which made the connecting state unreadable.
• Accent retuned to #5561E8 so white label text clears 4.5:1; body text at 12.6:1 on panel.
• Fixed ::hover → :hover pseudo-state syntax and the specificity collision that let the titlebar rule override the red close-button hover.
• Code-side companions: titlebar buttons set to NoFocus (the new focus ring exposed that the app opened with a highlighted minimize button), titlebar pinned to setFixedHeight(36), real grid setSpacing(10) / setContentsMargins(20, 16, 20, 20) replacing the 3px per-widget QSS margins that were faking row rhythm, and pointing-hand cursors (QSS cursor is unreliable in Qt).

6. Live status strip + settings (0f7136f — gui.py, config.py)

• One line at the bottom, refreshed every 2s: ● Live · 38ms · 0 drops · drift +12ppm · 18m. State is spelled out in words as well as coloured, so it survives colour-blindness and screenshots. Unknown values render --, and a stale value is never shown as if it were live — including the all-probes-retired case, which reports "No metrics" rather than a green "Live" it has not earned.
• Metrics reach the GUI through a lock-free snapshot: producer threads build a dict and rebind one attribute; a rebind is atomic under the GIL, so the reader never sees a partial value and the audio thread never waits on the GUI.
• Strip contrast on #1B1D21: green 6.6:1, amber 7.8:1, red 6.1:1, idle 6.4:1. The strip's red is #F87171 rather than the existing #D83C3E, which is only 3.7:1 as text.
• config.py: versioned JSON next to token.txt. Atomic os.replace write, unknown keys preserved across downgrade/upgrade round trips, and every failure path (missing, corrupt, wrong-typed, unwritable, path-is-a-directory) falls back to defaults with one WARNING instead of raising. The token is never stored — FORBIDDEN_KEYS refuses it, and a hand-added one is ignored on load and stripped on the next write.

7. Windows-only rendering fixes (afec6c7)

Two problems from the first run on real Windows 11, neither of which reproduced on macOS:

• Servers/Devices dropdown truncation ("A pack of autism" → "A pack of auti"): resize_combobox() sized combos as "widest item text + 30px", but the stylesheet spends 12px on left padding and 32px on the arrow well, so every dropdown was ~16px short of its own contents — and setMinimumWidth() meant a long guild name could push the window arbitrarily wide and never let it back down. Now uses AdjustToContents, caps the size hint, and elides with the full name on the tooltip.
• Everything rendered bold: assets/ shipped only Roboto-Black.ttf, which registers as the sole face of family "Roboto", so every weight request — including the default 400 — snapped to 900. macOS hid this because addApplicationFont() returns -1 for a relative path there, silently falling back to the system font. Font paths are now absolute, failures are logged rather than swallowed, and Roboto Regular + Medium (v2.137, matching the bundled Black) join the family. Fonts are Apache-2.0; assets/Roboto-LICENSE.txt carries the attribution.

Reviewer notes

• Instrumentation overhead is negligible: re-measured on CPython 3.14 against a fake PortAudio stream — 122 ns/call plain vs 344 ns/call instrumented, so ~222 ns of overhead against a 20 ms per-frame budget (0.001%). Enabling --diagnose adds ~1 ns.
• The baseline CI leg is a control, not a build target. It reproduces the pre-modernization toolchain and sources (checked out at b9ea7bf) so there is always a comparison artifact. build/main-baseline.spec is intentionally untouched by the version-resource work for the same reason.
• Status-strip thresholds are PROVISIONAL and not yet calibrated. We have two clean captures and none of a failing stream, so the green/amber/red boundaries are deliberately loose guesses — under-warning costs one missed warning, crying wolf costs the user's trust in the readout entirely. Recalibration procedure is in the README: run with --diagnose, capture a session that actually degrades, set amber near where each metric leaves its clean-minute range.
• Auto-recover is a persisted setting only — the checkbox saves the preference and does nothing else. It is labelled "(soon)" with a matching tooltip, deliberately, so the UI does not imply behavior that is not implemented.
• No secrets are used anywhere in CI beyond the auto-provided GITHUB_TOKEN, and a Discord token must never be added to it.

Known incomplete / follow-up work

• Auto-recover behavior — persisted preference exists; the recovery logic is a separate change.
• Threshold calibration against a real degradation capture.
• Profile persistence (last-used device / server / channel / mute state) — config.py is already versioned and extensible for exactly this.
• Connect / Disconnect controls — separate upcoming work.
• macOS build spec — the PyInstaller hooks were made macOS-safe, but a macOS spec is a later phase.

Everything on this branch has been verified against a Windows build; the status strip was additionally verified by rendering the real GUI offscreen in eight states, with 29 config unit tests and 19 integration checks passing.

[Tarrant64]

Pushed two more commits to this branch (fast-forward, no rebase):

• Profile persistence — the app now remembers the last-used setup (device, server/channel selection, window state) across restarts via a new config.py store. The store has a FORBIDDEN_KEYS denylist applied recursively, so the bot token and similar secrets can never be persisted; the token still lives only in token.txt.
• Config eager-write fix — settings are flushed when they change rather than only at shutdown, so a crash or force-quit no longer loses the profile.
• @guarded_slot crash safety — Qt slots are wrapped so an exception inside a slot is logged and contained instead of propagating through the C++ event loop and killing the app.
• Font and column fixes — assets/style.qss and layout tweaks following on from the earlier dropdown-clipping/over-bold work.

README updated to cover the profile behaviour and the secrets denylist.

[Tarrant64]

Pushed two more commits to this branch (fast-forward, 376d1f8..f871912).

fe89241 — Make the next stall capture conclusive

• discord.log is now written on every run, not only under -v. Without it a stall capture has no gateway evidence at all (no voice websocket close codes, no handshake/heartbeat trail). It appends rather than truncates, since the failure mode is "audio dies, app survives, user restarts" — mode="w" would wipe the failed session at exactly the wrong moment. Bounded at 4 MB x 5; measured ~5.1 KB/min steady state after a ~41 KB connect burst. -v still does something: console echo plus DEBUG on the dap namespace.
• Abort-vs-teardown discriminator. "Aborting playback" alone proves nothing, because a deliberate disconnect hits the same line. The tell is the gap back to the preceding "Not connected, waiting for": disconnect() pulses the event, so a teardown returns in milliseconds while a real stall burns the whole timeout (measured 0.035 s vs 10.005 s). The verdict line reports the gap and its cause — ERROR for a real stall, INFO for a teardown. Timeout is read from the value discord.py logged rather than hardcoded; the cut sits at half of it.
• Shutdown-cause attribution. The bare === DAP shutdown (clean) === could not answer "was that the bug or just teardown?". Call sites now record the cause where it is knowable, first-writer-wins so the specific trigger is not masked by the generic one behind it.
• instrumentation.make_after() is ungated — it fires on every player exit path including the silent bare return, and is the only instantaneous evidence of thread death.

Observation only. No auto-recover, no transport changes, sound.py untouched.

f871912 — Make connecting an explicit act with a real state machine

⚠️ Breaking behaviour change: selecting a channel no longer auto-connects. Previously change_channel joined as a side effect of the dropdown changing. There is now a per-row Connect button, and joining happens only when it is pressed. Existing users who are not told this will think channel selection is broken.

• connection_state.py holds the machine: IDLE → CONNECTING → LIVE → DISCONNECTING → IDLE, plus FAILED. Qt-free and discord-free, so its rules are testable standalone. Transitions outside the table are refused (return False + log) rather than raised, because under PyQt6 an exception escaping a slot reaches qFatal().
• Every visible affordance now reads that one value — button label/colour, dropdown editability, mute, status strip, auto-connect gating. Those were four separate guesses before (voice is not None, is_connected(), is_playing(), the strip's own sample count) which could and did disagree. is_playing() is no longer consulted anywhere: it returns True forever once the player thread has died.
• Double-click and mid-flight cancel are structurally impossible: the button is disabled through both in-flight states, and begin_connect() claims the state synchronously in the slot before the coroutine is scheduled.
• Disconnect keeps selections and leaves the audio stream open, so Connect rejoins in one click. Auto-connect on launch calls the same start_connect() the button calls, so there is no second "join" implementation to drift.
• Mute is checkable and latched, with set_muted() as its single writer; disconnecting un-mutes. Status strip gains Connecting / Disconnecting / Failed / Starting.
• README documents the change and flags the breaking part in a callout.

CI run for this push: 33259021185.