fix: silence werkzeug access logger so Flask 200s don't false-red (#181)

[cofade]

What & why

Closes #181 (follow-up to the #178 / PR #180 structured Server Logs panel).

In the Server Logs panel, every request to a Flask service (duckdb-service, image-service) produced two ring entries:

1. The canonical structured access entry from the @app.after_request _access_log_finish hook — GET /health 200 0.1ms, level-tagged by status. Intended.
2. Werkzeug's own request line (… "GET /health HTTP/1.1" 200 -), which the stdout/stderr tee in services/log_ring.py captures from stderr and therefore tags error (red) — even for a healthy 200.

So every successful request was double-logged and painted red. Because docker-compose.prod.yml builds both Flask services from Dockerfile.dev (CMD ["python", "app.py"] → the Werkzeug dev server), this noise reached prod, not just dev.

The fix

Silence Werkzeug's built-in access logger at import in both app.py, right after init_log_persistence() and before any request is served:

logging.getLogger("werkzeug").setLevel(logging.ERROR)

Werkzeug's _log only forces the logger to INFO when its level is still NOTSET, so pre-setting ERROR at import wins permanently. Access request lines (emitted at info) are filtered; Werkzeug's genuine error/exception logging (emitted at error) is untouched. The _access_log_finish hook is now the sole, level-tagged access entry.

Changes

• Silence the logger symmetrically in duckdb-service/app.py and image-service/app.py (+ import logging).
• Updated the now-stale _access_log_finish comments in both files.
• Updated the log_ring.py docstring in both services — kept byte-identical (enforced by test_log_ring_byte_identical_across_services).
• New test test_werkzeug_access_logger_silenced per service (asserts the logger level filters INFO while keeping ERROR; verified it fails when the fix is neutered to INFO).
• ADR-023 addendum recording the rationale.

Verification

• duckdb-service: 205 passed (incl. byte-identity guard + new test)
• image-service: 80 passed
• make check-citations: 7 OK, 0 problems
• Passed the senior-reviewer gate — no P0/P1; mechanism independently verified against werkzeug source.

Manual (needs the stack up): with docker compose up, hit /health on both services and confirm the Server Logs panel shows exactly one green GET /health 200 N.Nms entry — no second werkzeug line, no red.

Out of scope (per issue)

• gunicorn migration (future hardening — at which point this setLevel becomes a no-op and should be removed).
• No docker-compose.prod.yml change.

🤖 Generated with Claude Code

https://claude.ai/code/session_01UUXqNmzoqszKVAtaam1A3U

---

Generated by Claude Code