fix: strengthen live recovery and support diagnostics

Apply account and key changes to active queues without a restart and isolate provider attempt cancellation so fallback accounts remain usable. Preserve pause ownership, bound persisted HTTP 416 recovery, reconcile resets with authoritative state, and stabilize package ordering and live update cadence. Correlate rotation, conversion, resume, disk, queue-control, clipboard, and support-export events while redacting sensitive data at every persistent boundary and again in generated bundles. Release as v2.0.31 with updated English documentation and regression coverage.

tests/item-log.test.ts

@@ -35,7 +35,7 @@ describe("item-log", () => {
     expect(content).toContain("episode.part2.rar");
   });
 
-  it("writes detail events into the item log", async () => {
+  it("writes detail events into the item log", async () => {
     const baseDir = fs.mkdtempSync(path.join(os.tmpdir(), "rd-ilog-"));
     tempDirs.push(baseDir);
 
@@ -60,9 +60,56 @@ describe("item-log", () => {
     expect(logPath).not.toBeNull();
     const content = fs.readFileSync(logPath!, "utf8");
     expect(content).toContain("Entpack-Fehler");
-    expect(content).toContain("archive=episode.part2.rar");
-    expect(content).toContain("code=missing_parts");
-  });
+    expect(content).toContain("archive=episode.part2.rar");
+    expect(content).toContain("code=missing_parts");
+  });
+
+  it("redacts secrets, identities, direct links and local paths from item logs", async () => {
+    const baseDir = fs.mkdtempSync(path.join(os.tmpdir(), "rd-ilog-"));
+    tempDirs.push(baseDir);
+
+    initItemLogs(baseDir);
+    ensureItemLog({
+      itemId: "item-sensitive",
+      packageId: "pkg-sensitive",
+      packageName: "Sensitive Paket",
+      fileName: "episode.part2.rar",
+      targetPath: "C:\\Users\\Administrator\\Downloads\\Sensitive Paket\\episode.part2.rar"
+    });
+
+    logItemEvent(
+      "item-sensitive",
+      "ERROR",
+      "Download https://ddownload.com/private/file.rar?auth=url-secret für user@example.net nach /mnt/downloads/file.rar fehlgeschlagen",
+      {
+        downloadUrl: "https://ddownload.com/private/file.rar?auth=url-secret",
+        password: "password-secret-value",
+        metadata: {
+          cookies: "sid=cookie-secret-value",
+          username: "user@example.net",
+          localPath: "\\\\server\\share\\file.rar"
+        }
+      }
+    );
+
+    await new Promise((resolve) => setTimeout(resolve, 350));
+
+    const logPath = getItemLogPath("item-sensitive");
+    expect(logPath).not.toBeNull();
+    const content = fs.readFileSync(logPath!, "utf8");
+    expect(content).toMatch(/ddownload\.com#[a-f0-9]{10}/);
+    expect(content).toContain("<redacted>");
+    expect(content).toContain("<redacted-account>");
+    expect(content).toContain("<redacted-path>");
+    expect(content).not.toContain("/private/file.rar");
+    expect(content).not.toContain("url-secret");
+    expect(content).not.toContain("password-secret-value");
+    expect(content).not.toContain("cookie-secret-value");
+    expect(content).not.toContain("user@example.net");
+    expect(content).not.toContain("C:\\Users\\Administrator");
+    expect(content).not.toContain("/mnt/downloads");
+    expect(content).not.toContain("\\\\server\\share");
+  });
 
   it("keeps traversal-like item ids inside the item log directory", () => {
     const baseDir = fs.mkdtempSync(path.join(os.tmpdir(), "rd-ilog-"));