v0.116.0: observability pass — always-on debug ring + leveled sweep + agent tab + self-log pull — MinAgent: 0.81.0

Capture layer: LogBuffer always exists; logger = MultiWriter(LevelFilterWriter
(stdout, logging.level), ring) so DEBUG detail exists remotely without a config
flip while docker logs keep respecting the level. New internal/logx leveled
helpers. Report ACK gains controller_log_requested (additive); next report
ships controller_log_tail (128KB, consume-once, app-tail wire byte-compatible).
Debug page: Vezérlő|Ügynök tabs; agent tab proxies agent /debug/logs with the
pre-0.83 notice on typed 404. Sweep: netstorage_job phases, netprobe, handler
validation refusals + orphan WARN, SupportsWithSource gate line, agentapi
per-call DEBUG, migrate phase lines, tier2/offbox unswallowed persists.
Red-proofs: filter-disabled, drain-removed, dropped-phase-line all FAIL.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

controller/cmd/controller/main.go

@@ -86,6 +86,8 @@ func main() {
 	}
 
 	logger, logBuffer := setupLogger(cfg)
+	// v0.116.0: the debug ring is the controller_log_tail source (report self-tail channel).
+	report.SetControllerLogSource(logBuffer.Lines)
 
 	// --- Bootstrap ingestion (slice 8A → v0.40.0 onboarding, doc 03 §6) ---
 	// On first run, if this controller is not yet configured AND the host agent's provisioning
@@ -455,6 +457,8 @@ func main() {
 			// never reaches in). The NEXT report cycle collects + ships the tails; the hub
 			// clears its pending request on receipt. An empty list clears any stale local set.
 			report.SetPendingLogTails(resp.LogTailRequests)
+			// v0.116.0: the controller's OWN ring, same pattern (selftail.go).
+			report.SetPendingControllerLog(resp.ControllerLogRequested)
 		}
 		// Wire hub push status into alert manager for dashboard alerts
 		alertMgr.SetHubPushStatus(func() web.HubPushStatusData {
@@ -969,13 +973,18 @@ func selfUpdateAuthMiddleware(cfg *config.Config, webServer *web.Server, next ht
 	})
 }
 
+// setupLogger builds the v0.116.0 capture layer: the LogBuffer ring ALWAYS exists
+// and captures every line (DEBUG included — remote diagnostics need the detail to
+// exist without a config flip), while stdout (docker logs) keeps respecting
+// logging.level via the level filter. Lshortfile stays debug-only (unchanged).
 func setupLogger(cfg *config.Config) (*log.Logger, *web.LogBuffer) {
+	logBuffer := web.NewLogBuffer(1000)
+	flags := log.LstdFlags
 	if cfg.Logging.Level == "debug" {
-		logBuffer := web.NewLogBuffer(1000)
-		logger := log.New(io.MultiWriter(os.Stdout, logBuffer), "", log.LstdFlags|log.Lshortfile)
-		return logger, logBuffer
+		flags |= log.Lshortfile
 	}
-	return log.New(os.Stdout, "", log.LstdFlags), nil
+	stdout := web.NewLevelFilterWriter(os.Stdout, cfg.Logging.Level)
+	return log.New(io.MultiWriter(stdout, logBuffer), "", flags), logBuffer
 }
 
 // stackAdapter implements backup.StackDataProvider using stacks.Manager.