Protocol 15: one shared session log on the server, chat never logged, Mark a problem

Every app streams its redacted diagnostic lines (server time, batched
every 10 s, gzip, buffered while offline) to POST /l/; the server merges
them with its own into session-YYYY-MM-DD.log in time order, tagged by
who. Opt-out in Settings > About; Mark a problem (Ctrl+Shift+B, the
player menus, About) writes a marker with an optional note. Copy
diagnostics can include the server's session log. Chat text never
reaches any log.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

packages/core/lib/core.dart

@@ -1,6 +1,7 @@
 export 'src/constants.dart';
 export 'src/errors.dart';
 export 'src/logging.dart';
+export 'src/diag_share.dart';
 export 'src/clock_sync.dart';
 export 'src/config.dart';
 export 'src/protocol.dart';

packages/core/lib/src/constants.dart

@@ -1,5 +1,5 @@
 abstract class RelayConstants {
-  static const int protoVersion = 14;
+  static const int protoVersion = 15;
 
   // Relay (`/r/...`): a member's bytes through the server's buffer.
   static const int relaySliceBytes = 1 << 20;
@@ -70,4 +70,20 @@ abstract class RelayConstants {
   static const int maxQueueItems = 100;
   static const int maxQueueTextLength = 200;
   static const int queuePlayTimeoutSecs = 30;
+
+  /// Diagnostics sharing (`/l/...`, ARCHITECTURE "Logging"): a member's
+  /// batch carries at most [diagBatchBytes] of lines (gzip on the wire, at
+  /// most [diagBatchBytes] compressed and [diagDecodedBytes] unpacked); it
+  /// keeps up to [diagBufferBytes] while it cannot send (oldest dropped)
+  /// and sends every [diagIntervalSecs]. The server takes at most
+  /// [diagPostsPerMin] posts and [diagBytesPerMin] unpacked bytes per member
+  /// and minute (429 beyond). A "Mark a problem" note is cut to
+  /// [maxProblemNoteLength] characters.
+  static const int diagBatchBytes = 256 * 1024;
+  static const int diagDecodedBytes = 1 << 20;
+  static const int diagBufferBytes = 2 << 20;
+  static const int diagIntervalSecs = 10;
+  static const int diagPostsPerMin = 30;
+  static const int diagBytesPerMin = 4 << 20;
+  static const int maxProblemNoteLength = 200;
 }

packages/core/lib/src/diag_share.dart

@@ -0,0 +1,389 @@
+import 'dart:async';
+import 'dart:collection';
+import 'dart:convert';
+import 'dart:io';
+import 'dart:typed_data';
+
+import 'package:logging/logging.dart';
+
+import 'constants.dart';
+import 'logging.dart';
+
+// Diagnostics sharing (ARCHITECTURE "Logging", PROTOCOL "Diagnostics"):
+// each app sends its log lines to the server, which merges them with its
+// own into one session log. The batch format both sides use, and the
+// app's sender.
+
+/// One log record of a member: [t] in epoch ms (the app's clock while it
+/// waits, the server's on the wire), the level name, the logger and the
+/// redacted message (an error and stack trace on the lines below).
+class DiagLine {
+  final int t;
+  final String level;
+  final String logger;
+  final String message;
+  const DiagLine({required this.t, required this.level, required this.logger, required this.message});
+
+  /// Roughly its bytes in a batch.
+  int get size => message.length + logger.length + level.length + 32;
+
+  Map<String, Object?> toJson() => {'t': t, 'l': level, 'n': logger, 'm': message};
+
+  static DiagLine? fromJson(Object? j) {
+    if (j is! Map) return null;
+    final t = j['t'], l = j['l'], n = j['n'], m = j['m'];
+    if (t is! num || !t.isFinite || m is! String) return null;
+    return DiagLine(t: t.toInt(), level: l is String ? l : 'INFO', logger: n is String ? n : 'app', message: m);
+  }
+}
+
+/// A "Mark a problem" from a member: when (epoch ms, server clock) and
+/// its optional note.
+class DiagMark {
+  final int t;
+  final String note;
+  const DiagMark({required this.t, this.note = ''});
+
+  Map<String, Object?> toJson() => {'t': t, if (note.isNotEmpty) 'note': note};
+
+  static DiagMark? fromJson(Object? j) {
+    if (j is! Map) return null;
+    final t = j['t'], note = j['note'];
+    if (t is! num || !t.isFinite) return null;
+    return DiagMark(t: t.toInt(), note: note is String ? note : '');
+  }
+}
+
+/// The body of `POST /l/<sid>/<token>` (gzip of its JSON): the app's
+/// [version], whether it [share]s its lines (false: none, the server notes
+/// it once), the [lines], how many it [dropped] since the last batch (its
+/// buffer was full) and any problem [marks].
+class DiagBatch {
+  final String version;
+  final bool share;
+  final List<DiagLine> lines;
+  final int dropped;
+  final List<DiagMark> marks;
+  const DiagBatch({this.version = '', this.share = true, this.lines = const [], this.dropped = 0, this.marks = const []});
+
+  Map<String, Object?> toJson() => {
+        if (version.isNotEmpty) 'v': version,
+        if (!share) 'share': false,
+        if (lines.isNotEmpty) 'lines': [for (final l in lines) l.toJson()],
+        if (dropped > 0) 'dropped': dropped,
+        if (marks.isNotEmpty) 'marks': [for (final m in marks) m.toJson()],
+      };
+
+  List<int> encode() => gzip.encode(utf8.encode(jsonEncode(toJson())));
+
+  factory DiagBatch.fromJson(Map<String, Object?> j) {
+    final lines = j['lines'], marks = j['marks'], dropped = j['dropped'], v = j['v'];
+    return DiagBatch(
+      version: v is String ? v : '',
+      share: j['share'] != false,
+      lines: lines is List ? lines.map(DiagLine.fromJson).whereType<DiagLine>().toList() : const [],
+      dropped: dropped is num && dropped.isFinite && dropped > 0 ? dropped.toInt() : 0,
+      marks: marks is List ? marks.map(DiagMark.fromJson).whereType<DiagMark>().toList() : const [],
+    );
+  }
+
+  /// Unpacks a body; throws [FormatException] when it is not gzip of a
+  /// batch or unpacks to more than [maxBytes].
+  static DiagBatch decode(List<int> body, {int maxBytes = RelayConstants.diagDecodedBytes}) {
+    final text = utf8.decode(gunzipCapped(body, maxBytes), allowMalformed: true);
+    final j = jsonDecode(text);
+    if (j is! Map) throw const FormatException('not a batch');
+    return DiagBatch.fromJson(Map<String, Object?>.from(j));
+  }
+}
+
+/// [body] gunzipped, or [FormatException] once it passes [maxBytes] (a
+/// small body must not unpack to gigabytes).
+List<int> gunzipCapped(List<int> body, int maxBytes) {
+  final out = BytesBuilder(copy: false);
+  final sink = _CappedSink(out, maxBytes);
+  try {
+    gzip.decoder.startChunkedConversion(sink)
+      ..add(body)
+      ..close();
+  } on FormatException {
+    rethrow;
+  } catch (e) {
+    throw FormatException('not gzip: $e');
+  }
+  return out.takeBytes();
+}
+
+class _CappedSink implements Sink<List<int>> {
+  final BytesBuilder out;
+  final int max;
+  _CappedSink(this.out, this.max);
+
+  @override
+  void add(List<int> data) {
+    if (out.length + data.length > max) throw const FormatException('too large');
+    out.add(data);
+  }
+
+  @override
+  void close() {}
+}
+
+/// Where the app's lines go: the server's base URL (`http://host:port`),
+/// this member's token and the server's clock minus the local one (ms).
+typedef DiagTarget = ({Uri base, String token, double offsetMs});
+
+/// The app's side: keeps its log records (not the hosted server's, which
+/// the server logs itself) while in a session, and sends them to the
+/// server every [RelayConstants.diagIntervalSecs] ([tick]) and on [stop].
+/// [target] is null while there is nowhere to send (reconnecting, no
+/// clock sample yet): lines wait, up to [bufferBytes], the oldest dropped
+/// and counted. With [share] off nothing is kept or sent but one batch
+/// saying so per connection; problem marks ([markProblem]) go either way.
+class DiagUploader {
+  final DiagTarget? Function() target;
+  /// The app and its version, e.g. `Watch Together 1.4.0 on linux`.
+  final String version;
+  final int bufferBytes;
+  final int batchBytes;
+  final Duration interval;
+  final DateTime Function() _now;
+  DiagUploader({
+    required this.target,
+    required this.version,
+    this.bufferBytes = RelayConstants.diagBufferBytes,
+    this.batchBytes = RelayConstants.diagBatchBytes,
+    this.interval = const Duration(seconds: RelayConstants.diagIntervalSecs),
+    DateTime Function()? now,
+  }) : _now = now ?? DateTime.now;
+
+  /// Loggers never sent: the hosted server's records (`server.*`, the
+  /// server logs them itself) and the local copy of a mark ([markLogger]).
+  static bool sends(String logger) => logger != 'server' && !logger.startsWith('server.') && logger != markLogger;
+
+  /// The local log's copy of a problem mark.
+  static const markLogger = 'problem';
+  static final _markLog = Logger(markLogger);
+
+  final _lines = Queue<DiagLine>();
+  var _size = 0;
+  var _dropped = 0;
+  final _marks = <DiagMark>[];
+  StreamSubscription<LogRecord>? _sub;
+  HttpClient? _http;
+  var _busy = false;
+  var _again = false;
+  DateTime? _last;
+  /// The token the server was told "doesn't share" for.
+  String? _toldOff;
+  var _share = true;
+
+  bool get running => _sub != null;
+
+  /// Lines waiting to go.
+  int get pending => _lines.length;
+
+  /// Share the log lines (Settings); off drops what waits.
+  bool get share => _share;
+  set share(bool on) {
+    if (on == _share) return;
+    _share = on;
+    if (!on) _clear();
+    _toldOff = null;
+  }
+
+  /// Starts keeping the log's records (a session starts).
+  void start() {
+    _sub ??= Logger.root.onRecord.listen(_onRecord);
+    _last = _now();
+  }
+
+  void _onRecord(LogRecord r) {
+    if (!_share || !sends(r.loggerName)) return;
+    final b = StringBuffer(r.message);
+    if (r.error != null) b.write('\n  error: ${r.error}');
+    final s = '${r.stackTrace ?? ''}'.trimRight();
+    if (s.isNotEmpty) b.write('\n$s');
+    add(DiagLine(t: r.time.millisecondsSinceEpoch, level: r.level.name, logger: r.loggerName, message: redactLog('$b')));
+  }
+
+  /// Keeps [line] (local clock) for the next batch.
+  void add(DiagLine line) {
+    _lines.add(line);
+    _size += line.size;
+    _trim();
+  }
+
+  void _trim() {
+    while (_size > bufferBytes && _lines.isNotEmpty) {
+      _size -= _lines.removeFirst().size;
+      _dropped++;
+    }
+  }
+
+  void _clear() {
+    _lines.clear();
+    _size = 0;
+    _dropped = 0;
+  }
+
+  /// "Mark a problem": a marker line in the server's session log with
+  /// [note] (cut to [RelayConstants.maxProblemNoteLength], one line), sent
+  /// now with the lines waiting. Also written to the local log. True once
+  /// the server has it; false when it waits (not connected).
+  Future<bool> markProblem(String note) {
+    var clean = note.replaceAll(RegExp(r'[\x00-\x1f\x7f]+'), ' ').trim();
+    if (clean.length > RelayConstants.maxProblemNoteLength) {
+      clean = clean.substring(0, RelayConstants.maxProblemNoteLength);
+    }
+    _markLog.warning('=== PROBLEM marked${clean.isEmpty ? '' : ': $clean'} ===');
+    _marks.add(DiagMark(t: _now().millisecondsSinceEpoch, note: redactLog(clean)));
+    return flush();
+  }
+
+  /// Once a second (the app's ticker): sends when [interval] has passed.
+  void tick() {
+    final last = _last;
+    if (last != null && _now().difference(last) < interval) return;
+    unawaited(flush());
+  }
+
+  /// Sends what waits: true when the server took all of it (or there was
+  /// nothing to send).
+  Future<bool> flush() async {
+    if (_busy) {
+      // Once the one under way is done (a mark goes now, not next tick).
+      _again = true;
+      return false;
+    }
+    final tg = target();
+    if (tg == null) return false;
+    _busy = true;
+    _last = _now();
+    try {
+      final offset = tg.offsetMs.round();
+      List<DiagMark> takeMarks() {
+        final m = [for (final x in _marks) DiagMark(t: x.t + offset, note: x.note)];
+        _marks.clear();
+        return m;
+      }
+
+      if (!_share) {
+        if (_toldOff == tg.token && _marks.isEmpty) return true;
+        final marks = takeMarks();
+        final ok = await _post(tg, DiagBatch(version: version, share: false, marks: marks));
+        if (ok) {
+          _toldOff = tg.token;
+        } else {
+          _marks.insertAll(0, [for (final m in marks) DiagMark(t: m.t - offset, note: m.note)]);
+        }
+        return ok;
+      }
+      // A few batches at most per flush; the rest goes next time.
+      for (var i = 0; i < 8 && (_lines.isNotEmpty || _marks.isNotEmpty || _dropped > 0); i++) {
+        final taken = <DiagLine>[];
+        var bytes = 0;
+        while (_lines.isNotEmpty && (taken.isEmpty || bytes + _lines.first.size <= batchBytes)) {
+          final l = _lines.removeFirst();
+          _size -= l.size;
+          bytes += l.size;
+          taken.add(l);
+        }
+        final dropped = _dropped;
+        _dropped = 0;
+        final marks = takeMarks();
+        final batch = DiagBatch(
+          version: version,
+          lines: [for (final l in taken) DiagLine(t: l.t + offset, level: l.level, logger: l.logger, message: l.message)],
+          dropped: dropped,
+          marks: marks,
+        );
+        if (!await _post(tg, batch)) {
+          // Back in front, in order; the cap applies again.
+          for (final l in taken.reversed) {
+            _lines.addFirst(l);
+            _size += l.size;
+          }
+          _dropped += dropped;
+          _marks.insertAll(0, [for (final m in marks) DiagMark(t: m.t - offset, note: m.note)]);
+          _trim();
+          return false;
+        }
+      }
+      return _lines.isEmpty;
+    } finally {
+      _busy = false;
+      if (_again) {
+        _again = false;
+        if (_sub != null) unawaited(flush());
+      }
+    }
+  }
+
+  static Uri _httpUri(Uri base, String path, [Map<String, String>? query]) => base.replace(
+      scheme: base.scheme == 'wss' || base.scheme == 'https' ? 'https' : 'http',
+      path: path,
+      queryParameters: query,
+      fragment: null);
+
+  /// The server's `http://host:port` for a `/sync` socket URL.
+  static Uri baseOf(Uri wsUri) => _httpUri(wsUri, '/');
+
+  Future<bool> _post(DiagTarget tg, DiagBatch batch) async {
+    try {
+      final http = _http ??= HttpClient()..connectionTimeout = const Duration(seconds: 5);
+      final req = await http.postUrl(_httpUri(tg.base, '/l/default/${tg.token}')).timeout(const Duration(seconds: 5));
+      final body = batch.encode();
+      req.headers.contentType = ContentType('application', 'gzip');
+      req.contentLength = body.length;
+      req.add(body);
+      final res = await req.close().timeout(const Duration(seconds: 10));
+      await res.drain<void>();
+      // 413: this batch can never go (should not happen); drop it.
+      return res.statusCode == 204 || res.statusCode == 200 || res.statusCode == 413;
+    } catch (_) {
+      return false;
+    }
+  }
+
+  /// The server's session log of the last [hours] (every member and the
+  /// server, merged), or null when it cannot be had (not connected, a
+  /// server without one, an older server).
+  Future<String?> fetchSessionLog({int hours = 6}) async {
+    final tg = target();
+    if (tg == null) return null;
+    try {
+      final http = _http ??= HttpClient()..connectionTimeout = const Duration(seconds: 5);
+      final req = await http
+          .getUrl(_httpUri(tg.base, '/l/default/${tg.token}', {'hours': '$hours'}))
+          .timeout(const Duration(seconds: 5));
+      final res = await req.close().timeout(const Duration(seconds: 10));
+      final bytes = <int>[];
+      await for (final c in res.timeout(const Duration(seconds: 30))) {
+        bytes.addAll(c);
+      }
+      if (res.statusCode != 200) return null;
+      return utf8.decode(gunzipCapped(bytes, 64 << 20), allowMalformed: true);
+    } catch (_) {
+      return null;
+    }
+  }
+
+  /// The session ends: what waits goes now (best effort, [timeout]), then
+  /// nothing is kept until the next [start].
+  Future<void> stop({Duration timeout = const Duration(milliseconds: 1500)}) async {
+    await _sub?.cancel();
+    _sub = null;
+    if ((_lines.isNotEmpty || _marks.isNotEmpty || _dropped > 0) && target() != null) {
+      try {
+        await flush().timeout(timeout);
+      } catch (_) {}
+    }
+    _clear();
+    _marks.clear();
+    _toldOff = null;
+    _last = null;
+    _http?.close(force: true);
+    _http = null;
+  }
+}

packages/core/lib/src/logging.dart

@@ -10,6 +10,10 @@ import 'package:logging/logging.dart';
 
 Logger createLogger(String name) => Logger(name);
 
+/// The server's combined log of every member and itself
+/// (`session-YYYY-MM-DD.log`, ARCHITECTURE "Logging").
+const sessionLogPrefix = 'session';
+
 var _listening = false;
 var _console = true;
 LogFiles? _files;
@@ -35,12 +39,13 @@ void initLogging({Level level = Level.INFO, bool console = true}) {
 
 /// Writes the files in [dir] from now on: `<prefix>-YYYY-MM-DD.log`,
 /// rotated by day and [LogFiles.maxFileBytes], pruned by age and total
-/// size. Lines logged before go in first. A folder that cannot be written
-/// leaves logging on the console only (and says so there).
+/// size (shared with the session log, [sessionLogPrefix], in the same
+/// folder). Lines logged before go in first. A folder that cannot be
+/// written leaves logging on the console only (and says so there).
 LogFiles? startLogFiles(String dir, {String prefix = 'app'}) {
   if (_files != null) return _files;
   try {
-    final f = LogFiles(dir, prefix: prefix)..open();
+    final f = LogFiles(dir, prefix: prefix, shareWith: const [sessionLogPrefix])..open();
     _files = f;
     for (final l in _early) {
       f.write(l);
@@ -123,13 +128,13 @@ final _headerSecret = RegExp(
 final _pairSecret = RegExp('\\b($_secretNames)\\s*=\\s*[^&\\s"\',;)}\\]]+', caseSensitive: false);
 final _bearer = RegExp(r'\b(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]{8,}', caseSensitive: false);
 final _url = RegExp(r'''\b(?:https?|wss?)://[^\s"'<>]+''', caseSensitive: false);
-// A member token in a server path: /r/<sid>/<token>/..., /m, /j, /a, /i.
-final _pathToken = RegExp(r'(/[rmjai]/[^/\s?#]+/)[0-9a-fA-F]{32}\b');
+// A member token in a server path: /r/<sid>/<token>/..., /m, /j, /a, /i, /l.
+final _pathToken = RegExp(r'(/[rmjail]/[^/\s?#]+/)[0-9a-fA-F]{32}\b');
 final _userInfo = RegExp(r'^([a-z]+://)[^/@\s]+@', caseSensitive: false);
 
 /// [s] with nothing secret left: every URL's query string down to its
 /// parameter names (signed CDN links, `api_key`), user:password@ in URLs,
-/// member tokens in `/r/ /m/ /j/ /a/ /i/` paths, and the values of
+/// member tokens in `/r/ /m/ /j/ /a/ /i/ /l/` paths, and the values of
 /// passwords, tokens, API keys, cookies and auth headers. Applied to
 /// every log line ([formatLogLine]).
 String redactLog(String s) {
@@ -203,16 +208,21 @@ class LogThrottle {
 /// Rotating log files in [dir]: `<prefix>-YYYY-MM-DD.log` (then `.1.log`,
 /// `.2.log` ... once one passes [maxFileBytes]); files older than
 /// [keepDays] and the oldest beyond [maxTotalBytes] are deleted whenever a
-/// file is opened.
+/// file is opened. [shareWith]: other prefixes in [dir] that count toward
+/// the same [maxTotalBytes] (the app's or server's log and the session
+/// log); the oldest of all of them go first, never another prefix's file
+/// of today (its writer may have it open).
 class LogFiles {
   final String dir;
   final String prefix;
+  final List<String> shareWith;
   final int maxFileBytes;
   final int maxTotalBytes;
   final int keepDays;
   final DateTime Function() _now;
   LogFiles(this.dir,
       {this.prefix = 'app',
+      this.shareWith = const [],
       this.maxFileBytes = 10 * 1024 * 1024,
       this.maxTotalBytes = 100 * 1024 * 1024,
       this.keepDays = 7,
@@ -229,7 +239,10 @@ class LogFiles {
 
   String _dayOf(DateTime t) => '${t.year}-${_two(t.month)}-${_two(t.day)}';
 
-  String _dayOfFile(File f) => f.uri.pathSegments.last.substring(prefix.length + 1, prefix.length + 11);
+  String _dayOfFile(File f) => _fileDay(prefix, f);
+
+  static String _fileDay(String prefix, File f) =>
+      f.uri.pathSegments.last.substring(prefix.length + 1, prefix.length + 11);
 
   /// Opens today's file (creating [dir]); throws when it cannot.
   void open() {
@@ -256,9 +269,10 @@ class LogFiles {
   }
 
   /// Appends [line]; a new day or a full file moves on to the next file.
-  void write(String line) {
+  /// [at]: the line's own time picks the day's file (else now).
+  void write(String line, {DateTime? at}) {
     try {
-      final day = _dayOf(_now());
+      final day = _dayOf(at ?? _now());
       if (_out == null || day != _day || _size >= maxFileBytes) _roll(day);
       final bytes = utf8.encode('$line\n');
       _out!.writeFromSync(bytes);
@@ -269,7 +283,10 @@ class LogFiles {
   }
 
   /// This prefix's files, oldest first.
-  List<File> files() {
+  List<File> files() => filesOf(prefix);
+
+  /// The files of [prefix] in [dir], oldest first.
+  List<File> filesOf(String prefix) {
     final d = Directory(dir);
     if (!d.existsSync()) return const [];
     final name = RegExp('^${RegExp.escape(prefix)}-(\\d{4}-\\d{2}-\\d{2})(?:\\.(\\d+))?\\.log\$');
@@ -295,10 +312,18 @@ class LogFiles {
         kept.add(f);
       }
     }
-    var total = kept.fold<int>(0, (a, f) => a + _len(f));
-    for (final f in kept) {
+    final today = _dayOf(_now());
+    // Every file under the budget, oldest day first: (day, prefix, file).
+    final all = [
+      for (final f in kept) (_dayOfFile(f), true, f),
+      for (final p in shareWith)
+        if (p != prefix)
+          for (final f in filesOf(p)) (_fileDay(p, f), false, f),
+    ]..sort((a, b) => a.$1.compareTo(b.$1));
+    var total = all.fold<int>(0, (a, f) => a + _len(f.$3));
+    for (final (day, own, f) in all) {
       if (total <= maxTotalBytes) break;
-      if (f.path == _path) continue;
+      if (f.path == _path || (!own && day == today)) continue;
       total -= _len(f);
       _delete(f);
     }

packages/core/test/diag_share_test.dart

@@ -0,0 +1,87 @@
+import 'dart:convert';
+import 'dart:io';
+
+import 'package:logging/logging.dart';
+import 'package:sync_relay_core/core.dart';
+import 'package:test/test.dart';
+
+void main() {
+  test('a batch survives gzip both ways; a bomb or junk is refused', () {
+    const b = DiagBatch(
+        version: 'WT 1.0',
+        lines: [DiagLine(t: 5, level: 'WARNING', logger: 'mpv', message: 'x\n  error: y')],
+        dropped: 2,
+        marks: [DiagMark(t: 7, note: 'lag')]);
+    final back = DiagBatch.decode(b.encode());
+    expect(back.toJson(), b.toJson());
+    expect(DiagBatch.decode(const DiagBatch(share: false).encode()).share, isFalse);
+    expect(() => DiagBatch.decode(gzip.encode(List.filled(2 << 20, 32)), maxBytes: 1 << 20), throwsFormatException);
+    expect(() => DiagBatch.decode(utf8.encode('plain')), throwsFormatException);
+  });
+
+  group('DiagUploader', () {
+    late HttpServer http;
+    final got = <DiagBatch>[];
+    var accept = true;
+    setUp(() async {
+      got.clear();
+      accept = true;
+      http = await HttpServer.bind(InternetAddress.loopbackIPv4, 0);
+      http.listen((req) async {
+        final body = await req.fold<List<int>>([], (a, c) => a..addAll(c));
+        if (accept) got.add(DiagBatch.decode(body));
+        req.response.statusCode = accept ? 204 : 503;
+        await req.response.close();
+      });
+    });
+    tearDown(() => http.close(force: true));
+
+    DiagUploader make({bool connected = true, int buffer = 1 << 20}) => DiagUploader(
+        target: () => connected ? (base: Uri.parse('http://127.0.0.1:${http.port}'), token: 't', offsetMs: 1000) : null,
+        version: 'WT 1.0',
+        bufferBytes: buffer);
+
+    test('sends its records on the server clock, not the hosted server\'s; keeps them while it cannot', () async {
+      final u = make()..start();
+      Logger('relay').info('hello api_key=abc');
+      Logger('server.relay').info('the server logs this itself');
+      await Future<void>.delayed(Duration.zero);
+      accept = false;
+      expect(await u.flush(), isFalse);
+      expect(u.pending, 1);
+      accept = true;
+      expect(await u.flush(), isTrue);
+      final line = got.single.lines.single;
+      expect(line.message, 'hello api_key=***');
+      expect(line.logger, 'relay');
+      expect(got.single.version, 'WT 1.0');
+      await u.stop();
+    });
+
+    test('a full buffer drops the oldest and says how many', () async {
+      final u = make(buffer: 400);
+      for (var i = 0; i < 10; i++) {
+        u.add(DiagLine(t: i, level: 'INFO', logger: 'a', message: 'line $i ${'x' * 40}'));
+      }
+      expect(await u.flush(), isTrue);
+      expect(got.single.dropped, greaterThan(0));
+      expect(got.single.lines.last.message, startsWith('line 9'));
+      expect(got.single.lines.first.t, greaterThanOrEqualTo(1000), reason: 'offset to the server clock');
+    });
+
+    test('opted out: no lines, one "does not share" per connection; marks still go', () async {
+      final u = make()
+        ..share = false
+        ..start();
+      Logger('relay').info('private');
+      expect(await u.flush(), isTrue);
+      expect(await u.flush(), isTrue);
+      expect(got.length, 1);
+      expect(got.single.share, isFalse);
+      expect(got.single.lines, isEmpty);
+      expect(await u.markProblem('it\nfroze'), isTrue);
+      expect(got.last.marks.single.note, 'it froze');
+      await u.stop();
+    });
+  });
+}

packages/core/test/logging_test.dart

@@ -19,6 +19,7 @@ void main() {
       expect(redactLog('open http://1.2.3.4:8080/r/default/$tok/2/0/name'), 'open http://1.2.3.4:8080/r/default/***/2/0/name');
       expect(redactLog('ws://h:1/r/default/$tok/source?q=7'), 'ws://h:1/r/default/***/source?q=…');
       expect(redactLog('/m/default/$tok/file.mkv range=bytes=0-'), '/m/default/***/file.mkv range=bytes=0-');
+      expect(redactLog('POST /l/default/$tok'), 'POST /l/default/***');
       expect(redactLog('edl://!no_clip;%160%http://h/r/default/$tok/2/0/n;!new_stream;!no_clip;%160%http://h/r/default/$tok/2/1/n'),
           isNot(contains(tok)));
     });
@@ -85,5 +86,16 @@ void main() {
       expect(small.files().map((x) => x.uri.pathSegments.last), ['app-2026-10-12.1.log', 'app-2026-10-13.log']);
       small.close();
     });
+
+    test('the session log shares the total budget, never touching another writer\'s today', () {
+      final now = DateTime(2026, 10, 12, 10);
+      File('${dir.path}/session-2026-10-10.log').writeAsStringSync('s' * 100);
+      File('${dir.path}/session-2026-10-12.log').writeAsStringSync('s' * 100);
+      File('${dir.path}/app-2026-10-11.log').writeAsStringSync('a' * 100);
+      final f = LogFiles(dir.path, maxTotalBytes: 150, shareWith: const ['session'], now: () => now)..open();
+      final left = dir.listSync().map((e) => e.uri.pathSegments.last).toSet();
+      expect(left, {'session-2026-10-12.log', 'app-2026-10-12.log'});
+      f.close();
+    });
   });
 }

packages/server/bin/server.dart

@@ -31,7 +31,8 @@ Future<void> main(List<String> args) async {
             'An account login: keep it private. Copied into --yt-dlp-dir at start.')
     ..addOption('config', help: 'YAML or JSON config file (keys as in AppConfig); overrides the other flags.')
     ..addOption('log-dir',
-        help: 'Folder for the rotating log files (server-YYYY-MM-DD.log, kept 7 days). '
+        help: 'Folder for the rotating log files (server-YYYY-MM-DD.log, and session-YYYY-MM-DD.log with '
+            'every member\'s shared diagnostics merged in; kept 7 days). '
             'Default: logs next to --config, else logs next to this binary (systemd: \$STATE_DIRECTORY/logs).')
     ..addFlag('upgrade',
         negatable: false,
@@ -117,7 +118,9 @@ Future<void> main(List<String> args) async {
   }
 
   final events = ReceivePort('server events');
-  final done = serve(config.toMap(), events: events.sendPort);
+  // The session log (every member's diagnostics and the server's records
+  // merged) goes next to the server's own.
+  final done = serve({...config.toMap(), if (files != null) 'logDir': files.dir}, events: events.sendPort);
   final signals = <StreamSubscription<ProcessSignal>>[];
   await for (final msg in events) {
     if (msg is! Map) continue;

packages/server/lib/server.dart

@@ -7,3 +7,4 @@ export 'src/jellyfin_relay.dart';
 export 'src/relay_buffer.dart';
 export 'src/relay_routes.dart';
 export 'src/relay_stats.dart';
+export 'src/session_log.dart';

packages/server/lib/src/serve.dart

@@ -19,7 +19,8 @@ import 'sync_server.dart';
 /// swap; a following `swap` with its name and size puts it up) and answers
 /// `{'ok':true,'name':n,'size':s}` or `{'ok':false}`. Without [events] a
 /// start failure throws. `'loopbackOnly': true` in [config] (next to the
-/// [AppConfig] keys) binds 127.0.0.1 only: the app's solo session.
+/// [AppConfig] keys) binds 127.0.0.1 only: the app's solo session;
+/// `'logDir'` is the folder of the session log ([SyncServer.logDir]).
 Future<void> serve(Map<String, Object?> config, {SendPort? events}) async {
   StreamSubscription<pkg_logging.LogRecord>? logs;
   if (events != null) {
@@ -34,7 +35,9 @@ Future<void> serve(Map<String, Object?> config, {SendPort? events}) async {
   }
   final SyncServer server;
   try {
-    server = SyncServer(AppConfig.fromMap(config), loopbackOnly: config['loopbackOnly'] == true);
+    final logDir = config['logDir'];
+    server = SyncServer(AppConfig.fromMap(config),
+        loopbackOnly: config['loopbackOnly'] == true, logDir: logDir is String && logDir.isNotEmpty ? logDir : null);
     await server.start();
   } catch (e) {
     await logs?.cancel();

packages/server/lib/src/session_log.dart

@@ -0,0 +1,288 @@
+import 'dart:async';
+import 'dart:convert';
+import 'dart:io';
+import 'dart:typed_data';
+
+import 'package:logging/logging.dart' as pkg_logging;
+import 'package:relic/relic.dart';
+import 'package:sync_relay_core/core.dart';
+
+import 'server_hub.dart';
+import 'session.dart';
+
+// The session log (ARCHITECTURE "Logging"): every member's diagnostics
+// (`POST /l/...`) and the server's own records, merged in server-clock
+// order into one file per day, `session-YYYY-MM-DD.log`, in the server's
+// log folder.
+
+class _Entry {
+  final int t;
+  final int seq;
+  final String text;
+  const _Entry(this.t, this.seq, this.text);
+}
+
+/// The merged log. Lines wait [window] (members send every 10 s) and are
+/// written in time order; a line later than that (a reconnect's backlog)
+/// still goes in with its own time, a little out of order.
+class SessionLog {
+  final LogFiles files;
+  final Duration window;
+  final DateTime Function() _now;
+  final _pending = <_Entry>[];
+  var _seq = 0;
+  StreamSubscription<pkg_logging.LogRecord>? _own;
+  /// Per member token: the version and share state already noted.
+  final _noted = <String, ({String version, bool share})>{};
+
+  SessionLog(String dir,
+      {this.window = const Duration(seconds: 15),
+      List<String> shareWith = const ['app', 'server'],
+      DateTime Function()? now,
+      int maxFileBytes = 10 * 1024 * 1024,
+      int maxTotalBytes = 100 * 1024 * 1024})
+      : _now = now ?? DateTime.now,
+        files = LogFiles(dir,
+            prefix: sessionLogPrefix,
+            shareWith: shareWith,
+            maxFileBytes: maxFileBytes,
+            maxTotalBytes: maxTotalBytes,
+            now: now) {
+    files.open();
+  }
+
+  /// Takes this isolate's own log records as the server's lines.
+  void captureOwn() {
+    _own ??= pkg_logging.Logger.root.onRecord.listen((r) {
+      final b = StringBuffer(r.message);
+      if (r.error != null) b.write('\n  error: ${r.error}');
+      final s = '${r.stackTrace ?? ''}'.trimRight();
+      if (s.isNotEmpty) b.write('\n$s');
+      add(r.time.millisecondsSinceEpoch, 'server', r.level.name, r.loggerName, '$b');
+    });
+  }
+
+  static final _control = RegExp(r'[\x00-\x08\x0b-\x1f\x7f]');
+  static final _loggerName = RegExp(r'^[A-Za-z0-9_.\-]{1,40}$');
+  static const _levels = {'FINEST', 'FINER', 'FINE', 'CONFIG', 'INFO', 'WARNING', 'SEVERE', 'SHOUT'};
+  static const _quiet = {'FINEST', 'FINER', 'FINE', 'CONFIG', 'INFO'};
+
+  static String _clean(String s, int max) {
+    var out = s.replaceAll('\r', '').replaceAll(_control, ' ');
+    if (out.length > max) out = '${out.substring(0, max)}…';
+    return out;
+  }
+
+  static String _two(int n) => n.toString().padLeft(2, '0');
+
+  static String _clock(DateTime t) =>
+      '${_two(t.hour)}:${_two(t.minute)}:${_two(t.second)}.${t.millisecond.toString().padLeft(3, '0')}';
+
+  /// One record at [t] (epoch ms, server clock) from [who] (`name (id)`
+  /// or `server`): `HH:MM:SS.mmm [who] logger: message`, the level before
+  /// the logger from WARNING up, continuation lines indented. Redacted
+  /// again here.
+  void add(int t, String who, String level, String logger, String message) {
+    final lvl = _levels.contains(level) ? level : 'INFO';
+    final name = _loggerName.hasMatch(logger) ? logger : 'app';
+    final body = redactLog(_clean(message, 8192)).split('\n');
+    final head = '[${_clean(who, 80).replaceAll('\n', ' ')}] ${_quiet.contains(lvl) ? '' : '$lvl '}$name: ${body.first}';
+    _push(t, [head, for (final l in body.skip(1)) '  $l'].join('\n'));
+  }
+
+  /// A problem mark by [name] ([who]) at [t]:
+  /// `=== PROBLEM marked by <name>: <note> ===`.
+  void mark(int t, String who, String name, String note) {
+    final n = redactLog(_clean(note, RelayConstants.maxProblemNoteLength).replaceAll('\n', ' ')).trim();
+    _push(t, '[${_clean(who, 80).replaceAll('\n', ' ')}] === PROBLEM marked by $name${n.isEmpty ? '' : ': $n'} ===');
+  }
+
+  /// A line of the server's about a member, now.
+  void note(String message) => add(_now().millisecondsSinceEpoch, 'server', 'INFO', 'diag', message);
+
+  void _push(int t, String text) {
+    final now = _now().millisecondsSinceEpoch;
+    // A clock far ahead lands now; older than the files keep is dropped.
+    if (t > now + 60000) t = now;
+    if (t < now - files.keepDays * 86400000) return;
+    _pending.add(_Entry(t, _seq++, text));
+    // A flood must not grow the wait without bound: write early.
+    if (_pending.length > 20000) flush(all: true);
+  }
+
+  /// Writes the lines older than [window] ([all]: every one), in order.
+  /// Called every second.
+  void flush({bool all = false}) {
+    if (_pending.isEmpty) return;
+    final until = all ? null : _now().millisecondsSinceEpoch - window.inMilliseconds;
+    _pending.sort(_order);
+    var n = 0;
+    for (final e in _pending) {
+      if (until != null && e.t > until) break;
+      final at = DateTime.fromMillisecondsSinceEpoch(e.t);
+      files.write('${_clock(at)} ${e.text}', at: at);
+      n++;
+    }
+    _pending.removeRange(0, n);
+  }
+
+  static int _order(_Entry a, _Entry b) => a.t != b.t ? a.t.compareTo(b.t) : a.seq.compareTo(b.seq);
+
+  /// A batch from the member [token] ([who] for the log, [name] for a
+  /// mark): its lines, a note the first time (or when its version or
+  /// sharing changes), how many it dropped, its marks.
+  void takeBatch(String token, String who, String name, DiagBatch batch) {
+    final version = _clean(batch.version, 100).replaceAll('\n', ' ');
+    final before = _noted[token];
+    if (before == null || before.version != version || before.share != batch.share) {
+      _noted[token] = (version: version, share: batch.share);
+      final what = version.isEmpty ? '' : ' ($version)';
+      if (!batch.share) {
+        note("$who doesn't share diagnostics$what");
+      } else if (before == null || !before.share) {
+        note('$who shares diagnostics$what');
+      } else {
+        note('$who now runs $version');
+      }
+    }
+    if (batch.share) {
+      for (final l in batch.lines) {
+        add(l.t, who, l.level, l.logger, l.message);
+      }
+      if (batch.dropped > 0) {
+        final t = batch.lines.isEmpty ? _now().millisecondsSinceEpoch : batch.lines.first.t;
+        add(t, who, 'WARNING', 'diag', '${batch.dropped} lines dropped (the app could not send them in time)');
+      }
+    }
+    for (final m in batch.marks) {
+      mark(m.t, who, name, m.note);
+    }
+  }
+
+  /// The lines of the last [since], written and waiting, oldest first; at
+  /// most about [maxBytes], the newest kept.
+  String recent(Duration since, {int maxBytes = 8 * 1024 * 1024}) {
+    final from = _now().subtract(since);
+    final fromDay = _day(from);
+    final out = <String>[];
+    final head = RegExp(r'^(\d{2}):(\d{2}):(\d{2})\.(\d{3}) ');
+    for (final f in files.files()) {
+      final name = f.uri.pathSegments.last;
+      final day = name.substring(sessionLogPrefix.length + 1, sessionLogPrefix.length + 11);
+      if (day.compareTo(fromDay) < 0) continue;
+      final date = DateTime.tryParse(day);
+      if (date == null) continue;
+      List<String> lines;
+      try {
+        lines = const LineSplitter().convert(utf8.decode(f.readAsBytesSync(), allowMalformed: true));
+      } catch (_) {
+        continue;
+      }
+      var keep = false;
+      for (final l in lines) {
+        final m = head.firstMatch(l);
+        if (m != null) {
+          final t = DateTime(date.year, date.month, date.day, int.parse(m[1]!), int.parse(m[2]!), int.parse(m[3]!),
+              int.parse(m[4]!));
+          keep = !t.isBefore(from);
+        }
+        if (keep) out.add(l);
+      }
+    }
+    final fromMs = from.millisecondsSinceEpoch;
+    final waiting = [..._pending]..sort(_order);
+    for (final e in waiting) {
+      if (e.t >= fromMs) out.add('${_clock(DateTime.fromMillisecondsSinceEpoch(e.t))} ${e.text}');
+    }
+    var size = 0, start = out.length;
+    while (start > 0 && size + out[start - 1].length + 1 <= maxBytes) {
+      size += out[--start].length + 1;
+    }
+    return out.sublist(start).join('\n');
+  }
+
+  static String _day(DateTime t) => '${t.year}-${_two(t.month)}-${_two(t.day)}';
+
+  Future<void> close() async {
+    await _own?.cancel();
+    _own = null;
+    flush(all: true);
+    files.close();
+  }
+}
+
+class _Rate {
+  var start = DateTime.now();
+  var posts = 0;
+  var bytes = 0;
+}
+
+/// `POST /l/<sid>/<token>`: a member's diagnostics batch ([DiagBatch],
+/// gzip) into the [sessionLog]; `GET /l/<sid>/<token>?hours=N`: the session log of
+/// the last N hours (gzip text), for any member. Without one (a
+/// server with no log folder, the solo session) batches are taken and
+/// dropped, and the GET is 404.
+void mountSessionLogRoutes(RelicApp app, ServerHub hub, SessionLog? Function() sessionLog) {
+  Response status(int code, [String? why]) => Response(code, body: Body.fromString(why ?? 'status $code'));
+  final rates = <String, _Rate>{};
+
+  ViewerToken? member(Request req) {
+    final session = hub.sessions.get(req.pathParameters.raw[#sid] ?? '');
+    final token = req.pathParameters.raw[#token] ?? '';
+    if (session == null || session.gate(token) != MediaGate.ok) return null;
+    return session.tokens[token];
+  }
+
+  app.post('/l/:sid/:token', (final req) async {
+    final viewer = member(req);
+    if (viewer == null) return status(401);
+    final body = BytesBuilder(copy: false);
+    try {
+      await for (final c in req.read(maxLength: RelayConstants.diagBatchBytes)) {
+        body.add(c);
+      }
+    } catch (_) {
+      return status(413);
+    }
+    final DiagBatch batch;
+    try {
+      batch = DiagBatch.decode(body.takeBytes());
+    } on FormatException catch (e) {
+      return status(e.message == 'too large' ? 413 : 400, 'bad batch');
+    }
+    final now = DateTime.now();
+    if (rates.length > 500) rates.removeWhere((k, _) => !hub.session.tokens.containsKey(k));
+    final rate = rates.putIfAbsent(viewer.token, _Rate.new);
+    if (now.difference(rate.start) >= const Duration(minutes: 1)) {
+      rate
+        ..start = now
+        ..posts = 0
+        ..bytes = 0;
+    }
+    final size = batch.lines.fold<int>(0, (a, l) => a + l.size);
+    if (rate.posts >= RelayConstants.diagPostsPerMin || rate.bytes + size > RelayConstants.diagBytesPerMin) {
+      return Response(429,
+          body: Body.fromString('too many'), headers: Headers.build((h) => h['retry-after'] = ['30']));
+    }
+    rate
+      ..posts += 1
+      ..bytes += size;
+    final log = sessionLog();
+    if (log == null) return Response.noContent();
+    log.takeBatch(viewer.token, hub.who(viewer.token), viewer.name, batch);
+    return Response.noContent();
+  });
+
+  app.get('/l/:sid/:token', (final req) {
+    if (member(req) == null) return status(401);
+    final log = sessionLog();
+    if (log == null) return status(404, 'this server keeps no session log');
+    final hours = (int.tryParse(req.url.queryParameters['hours'] ?? '') ?? 6).clamp(1, 24 * 7);
+    final text = log.recent(Duration(hours: hours));
+    return Response.ok(
+      body: Body.fromData(Uint8List.fromList(gzip.encode(utf8.encode(text))),
+          mimeType: MimeType('application', 'gzip')),
+      headers: Headers.build((h) => h['cache-control'] = ['no-store']),
+    );
+  });
+}

packages/server/lib/src/sync_server.dart

@@ -11,6 +11,7 @@ import 'media_endpoint.dart';
 import 'relay_routes.dart';
 import 'server_hub.dart';
 import 'session.dart';
+import 'session_log.dart';
 
 /// [configured], else systemd's `$STATE_DIRECTORY/yt-dlp`, else `yt-dlp`
 /// next to the server binary when that is writable (not under `dart run`),
@@ -56,8 +57,16 @@ class SyncServer {
   /// IPv4 interface.
   final bool loopbackOnly;
 
+  /// The folder of the session log (`session-YYYY-MM-DD.log`, every
+  /// member's diagnostics and the server's records merged); null: none.
+  final String? logDir;
+  SessionLog? _sessionLog;
+
+  /// The session log while running with a [logDir].
+  SessionLog? get sessionLog => _sessionLog;
+
   /// [ytDlp] replaces the server's own (tests).
-  SyncServer(this.config, {YtDlp? ytDlp, this.loopbackOnly = false}) {
+  SyncServer(this.config, {YtDlp? ytDlp, this.loopbackOnly = false, this.logDir}) {
     hub = ServerHub(sessions, config.secret,
         hostKey: config.hostKey,
         jellyfin: config.jellyfin,
@@ -103,6 +112,7 @@ class SyncServer {
     mountRelayRoutes(_app, sessions, relayAt: hub.relayAt, sourceOf: hub.sourceOf, onLog: logRequest);
     mountAvatarRoute(_app, hub);
     mountArtRoute(_app, hub);
+    mountSessionLogRoutes(_app, hub, () => _sessionLog);
     mountJellyfinRelayRoute(
         _app, sessions, () => hub.jellyfin, () => _relayClient ??= HttpClient(),
         next: () => hub.nextJellyfinRef, onLog: logRequest);
@@ -139,6 +149,14 @@ class SyncServer {
     if (config.secret.isEmpty) {
       _log.warning('no password set: open server, anyone who can reach it can join');
     }
+    final dir = logDir;
+    if (dir != null && _sessionLog == null) {
+      try {
+        _sessionLog = SessionLog(dir)..captureOwn();
+      } catch (e) {
+        _log.warning('no session log: cannot write $dir ($e)');
+      }
+    }
     await _resolveJellyfinServerId();
     _mountRoutes();
     _server = await _app.serve(
@@ -158,6 +176,7 @@ class SyncServer {
       hub.sampleRates();
       hub.broadcastState();
       hub.broadcastFeed();
+      _sessionLog?.flush();
     });
     _log.info('server "${config.name}" listening on $boundPort');
   }
@@ -193,5 +212,7 @@ class SyncServer {
     await _app.close();
     _server = null;
     _log.info('server "${config.name}" stopped');
+    await _sessionLog?.close();
+    _sessionLog = null;
   }
 }

packages/server/test/session_log_test.dart

@@ -0,0 +1,130 @@
+import 'dart:async';
+import 'dart:convert';
+import 'dart:io';
+
+import 'package:logging/logging.dart';
+import 'package:sync_relay_core/core.dart';
+import 'package:sync_relay_server/server.dart';
+import 'package:test/test.dart';
+import 'package:web_socket_channel/web_socket_channel.dart';
+
+void main() {
+  late Directory dir;
+  setUp(() async => dir = await Directory.systemTemp.createTemp('session_log'));
+  tearDown(() async => dir.delete(recursive: true));
+
+  String read() => File('${dir.path}/session-2026-10-12.log').readAsStringSync();
+
+  test('merges lines of every side in server-clock order after the window', () async {
+    var now = DateTime(2026, 10, 12, 18, 0, 30);
+    final log = SessionLog(dir.path, window: const Duration(seconds: 15), now: () => now);
+    int at(int s, [int ms = 0]) => DateTime(2026, 10, 12, 18, 0, s, ms).millisecondsSinceEpoch;
+    log.add(at(12), 'Bob (m2)', 'INFO', 'relay', 'second');
+    log.add(at(10, 5), 'server', 'WARNING', 'server_hub', 'first\n  error: boom');
+    log.add(at(20), 'Alice (m1)', 'INFO', 'mpv', 'too new');
+    log.add(at(14), 'Alice (m1)', 'INFO', 'media', 'open http://h:1/r/default/50989dda73c45a4710751f8aff4a1982/2/0/x?sig=abc');
+    log.mark(at(13), 'Alice (m1)', 'Alice', 'stutter\nhere');
+    log.flush();
+    expect(read().trimRight().split('\n'), [
+      '18:00:10.005 [server] WARNING server_hub: first',
+      '    error: boom',
+      '18:00:12.000 [Bob (m2)] relay: second',
+      '18:00:13.000 [Alice (m1)] === PROBLEM marked by Alice: stutter here ===',
+      '18:00:14.000 [Alice (m1)] media: open http://h:1/r/default/***/2/0/x?sig=…',
+    ]);
+    expect(log.recent(const Duration(hours: 1)), endsWith('[Alice (m1)] mpv: too new'), reason: 'waiting lines too');
+    now = DateTime(2026, 10, 12, 18, 1);
+    await log.close();
+    expect(read(), contains('18:00:20.000 [Alice (m1)] mpv: too new'));
+  });
+
+  test('takeBatch: notes the version once, opt-out once, dropped lines', () async {
+    final now = DateTime(2026, 10, 12, 18);
+    final log = SessionLog(dir.path, now: () => now);
+    final t = now.millisecondsSinceEpoch;
+    log.takeBatch('tok', 'Bob (m2)', 'Bob',
+        DiagBatch(version: 'WT 1.0', lines: [DiagLine(t: t, level: 'INFO', logger: 'app', message: 'hi')], dropped: 3));
+    log.takeBatch('tok', 'Bob (m2)', 'Bob', DiagBatch(version: 'WT 1.0', lines: [DiagLine(t: t, level: 'INFO', logger: 'app', message: 'again')]));
+    log.takeBatch('tok2', 'Cleo (m3)', 'Cleo', const DiagBatch(version: 'WT 1.0', share: false, lines: [DiagLine(t: 0, level: 'INFO', logger: 'app', message: 'never')]));
+    log.takeBatch('tok2', 'Cleo (m3)', 'Cleo', const DiagBatch(version: 'WT 1.0', share: false));
+    await log.close();
+    final text = read();
+    expect('shares diagnostics'.allMatches(text).length, 1);
+    expect(text, contains('[server] diag: Bob (m2) shares diagnostics (WT 1.0)'));
+    expect(text, contains("[server] diag: Cleo (m3) doesn't share diagnostics (WT 1.0)"));
+    expect("doesn't share".allMatches(text).length, 1);
+    expect(text, contains('[Bob (m2)] WARNING diag: 3 lines dropped'));
+    expect(text, isNot(contains('never')));
+  });
+
+  group('live', () {
+    late SyncServer server;
+    setUp(() async {
+      server = SyncServer(const AppConfig(port: 0, secret: 's', name: 't'), logDir: dir.path);
+      await server.start();
+    });
+    tearDown(() async => server.stop());
+
+    Future<(WebSocketChannel, String)> join(String name) async {
+      final ch = WebSocketChannel.connect(Uri.parse('ws://127.0.0.1:${server.boundPort}/sync'));
+      final msgs = StreamIterator(ch.stream);
+      ch.sink.add(jsonEncode(HelloMessage(
+              proto: RelayConstants.protoVersion,
+              secret: 's',
+              user: HelloUser(name: name),
+              media: const HelloMedia(name: '', size: 0, duration: 0))
+          .toJson()));
+      while (await msgs.moveNext()) {
+        final m = jsonDecode('${msgs.current}') as Map;
+        if (m['t'] == 'welcome') {
+          unawaited(() async {
+            while (await msgs.moveNext()) {}
+          }());
+          return (ch, m['token'] as String);
+        }
+      }
+      throw StateError('no welcome');
+    }
+
+    DiagUploader uploader(String token, {String version = 'WT 1.0'}) => DiagUploader(
+        target: () => (base: Uri.parse('http://127.0.0.1:${server.boundPort}'), token: token, offsetMs: 0),
+        version: version);
+
+    test('members send lines and marks; chat never lands; any member reads it back', () async {
+      final (alice, aliceTok) = await join('Alice');
+      final (bob, bobTok) = await join('Bob');
+      final a = uploader(aliceTok)..start();
+      final b = uploader(bobTok)
+        ..share = false
+        ..start();
+      Logger('relay').info('alice line password=hunter2');
+      alice.sink.add(jsonEncode(const ChatMessage(text: 'secret chat words').toJson()));
+      await Future<void>.delayed(const Duration(milliseconds: 200));
+      expect(await a.flush(), isTrue);
+      expect(await b.flush(), isTrue);
+      expect(await a.markProblem('audio drifts'), isTrue);
+      final text = await a.fetchSessionLog(hours: 1);
+      expect(text, isNotNull);
+      expect(text, contains('[Alice (m1)] relay: alice line password=***'));
+      expect(text, contains('=== PROBLEM marked by Alice: audio drifts ==='));
+      expect(text, contains("Bob (m2) doesn't share diagnostics"));
+      expect(text, contains('[server] server_hub: join Alice'));
+      expect(text, isNot(contains('secret chat words')));
+      // Bob reads it too (friends); a stranger does not.
+      expect(await b.fetchSessionLog(), contains('PROBLEM'));
+      expect(await uploader('0' * 32).fetchSessionLog(), isNull);
+      final bad = await HttpClient().postUrl(Uri.parse('http://127.0.0.1:${server.boundPort}/l/default/$aliceTok'));
+      bad.add(utf8.encode('not gzip'));
+      expect((await bad.close()).statusCode, 400);
+      await a.stop();
+      await b.stop();
+      await alice.sink.close();
+      await bob.sink.close();
+      await server.stop();
+      final files = dir.listSync().map((e) => e.uri.pathSegments.last).where((n) => n.startsWith('session-'));
+      final all = [for (final n in files) File('${dir.path}/$n').readAsStringSync()].join();
+      expect(all, contains('PROBLEM'));
+      expect(all, isNot(contains('secret chat words')));
+    });
+  });
+}

packages/server/test/session_test.dart

@@ -64,8 +64,8 @@ void main() {
   });
 
   group('core welcome + proto', () {
-    test('proto 14: avatars by hash, profile intent', () {
-      expect(RelayConstants.protoVersion, 14);
+    test('proto 15: avatars by hash, profile intent', () {
+      expect(RelayConstants.protoVersion, 15);
       const v = MemberView(id: 'm1', name: 'a', ready: false, inSet: false, buffered: 0, stale: false);
       expect(v.toJson().containsKey('avatarHash'), isFalse);
       expect(v.toJson().containsKey('avatar'), isFalse);