Changelog

All notable project changes are recorded here. The README shows only the most recent entry.

2026-07-14 - OAuth-Blocked Recovery

Classified refresh-token invalid_grant responses and unusable token files as explicit OAuth authorization blocks instead of ambiguous retry failures.
Added a mode-0600 cross-process refresh lock and a single exact request replay when YouTube rejects a cached access token with HTTP 401.
Prevented a second post-refresh 401 from creating a supervisor busy loop by waiting on the post-refresh token fingerprint.
Added bounded local credential fingerprinting and signal-interruptible waiting that makes no API calls until token content changes, then resumes automatically.
Preserved already-public FFmpeg ingest under its local watchdog during an OAuth block and revalidated the exact cached lifecycle state after reauthorization.
Limited custom child-stopping signal handlers to visible test-pattern runs so device authorization terminates normally.
Added regression coverage and operator documentation for revoked, missing, malformed, unreadable, and oversized token states.

Stopped setting liveBroadcast and liveStream descriptions; new insert payloads omit the description field entirely and privacy updates remain status-only.
Replaced description-marker ownership with schema-v3 exact-ID state and a durable normal-field fingerprint for verification-only recovery after an ambiguous insert.
Added one-way read-only migration for schema-v2 markers, conservative state-loss conflict handling, and regression coverage for every insert crash boundary.

Corrected privacy-only liveBroadcasts.update requests so part=status sends only the matching id and status resource fields, eliminating HTTP 400 unexpectedPart failures after the healthy-live gate.
Preserved made-for-kids status and post-update privacy verification while removing unrelated scheduled-start and monitor-stream fields from publication requests.
Added regression coverage for the exact part/body contract used to promote an existing live broadcast without creating or replacing it.

Added an opt-in videos.list command and one-shot collector for aggregate live-stream timing, viewer, view, like, and comment metrics.
Added private local latest and daily JSONL samples, strict payload validation, a nonblocking lock, write-ahead quota throttling, and configurable retention.
Added independent system and user five-minute timers that remain disabled after installation; one selected timer consumes at most 288 quota units per 24 hours at the minimum interval and never controls stream recovery.

Reordered every recovery, including cached public state, so one marked broadcast is reconciled, created unlisted if needed, and bound before FFmpeg starts ingest; startup API failures now fail closed.
Added fail-closed detection for unmarked recoverable broadcasts bound to the reusable stream, preventing unintended legacy auto-start events.
Reused the prepared lifecycle state after ingest becomes active, while revalidating cached public events and reconciling a replacement when YouTube confirms the cached event is terminal, missing, or rebound.
Added redacted API operation, HTTP status, and structured reason details to supervisor failures for actionable quota diagnostics.
Added regression coverage for offline staging, insert and bind partial failures, stable generation reuse, public-stream fallback, and CLI gating.

Added durable instance and generation markers so one nonterminal broadcast is reconciled and reused across camera, FFmpeg, service, and host restarts.
Added write-ahead state, mutation and supervisor locks, structured API failures, persisted class-specific cooldowns, and fail-closed handling for ambiguous remote state.
Removed automatic broadcast completion and unconditional recreation from unattended recovery; only an explicit operator command can complete a confirmed live event.
Made FFmpeg RTSP options capability-aware, removed the incompatible default -rw_timeout, and added machine-readable media-progress supervision during API operations.
Added unlisted staging and verified public promotion only after two consecutive healthy live observations, while preserving the public watch URL through later outages.

Added GitHub Actions CI for Python 3.11, 3.12, and 3.13 with Ruff, py_compile, pytest, executable-bit checks, and systemd unit verification.
Added CodeQL, Gitleaks-based secret scanning, Dependabot updates, CODEOWNERS, public issue templates, a PR template, SECURITY.md, and CONTRIBUTING.md.
Added offline unit coverage for URL redaction, OBS source selection, FFmpeg argument construction, OAuth client parsing, token refresh, secret-file permissions, and broadcast payload construction.
Added repository metadata hygiene files for editor behavior, line endings, and Markdown linting.

Added Google Cloud, YouTube Data API, Google Auth Platform, OAuth client, device-code authorization, validation, and common-error instructions for fresh deployments.
Documented the org_internal, invalid_client, testing-mode token expiry, and channel-permission failure modes observed during setup.

Expanded the README into an executive summary covering architecture, runtime process flow, operational commands, recovery behavior, and caveats.
Added this standalone changelog so README history stays concise.

Added the generic YouTube AutoEncoder package with youtube-autoencoder, youtube-autoencoder-api, and youtube-autoencoder-test-pattern.
Added source probing, FFmpeg supervision, retry behavior, YouTube Live lifecycle automation, and API-managed visible test broadcasts.
Added example configuration, systemd units, Raspberry Pi deployment notes, and secret-focused ignore rules.