From 458d7e1ebcf71a39c0b46346b8190a17a2a883c5 Mon Sep 17 00:00:00 2001
From: kisfenyo <nagyfenyvesi.viktor@gmail.com>
Date: Sat, 11 Jul 2026 17:12:20 +0200
Subject: [PATCH] =?UTF-8?q?v0.116.1:=20ungate=20/debug=20+=20/api/debug=20?=
 =?UTF-8?q?from=20logging.level=20=E2=80=94=20the=20viewer=20must=20exist?=
 =?UTF-8?q?=20wherever=20the=20ring=20does?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Live validation at logging.level=info 404'd the whole debug surface (the
motivating incident's blind spot). Auth unchanged (RequireAuth + CSRF).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
---
 CHANGELOG.md                                  |  8 ++++++++
 CLAUDE.md                                     |  3 +++
 controller/internal/web/server.go             | 13 ++++---------
 controller/internal/web/templates/layout.html |  2 +-
 4 files changed, 16 insertions(+), 10 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8530635..5ef59f5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,13 @@
 ## Changelog
 
+### v0.116.1 — debug surface ungated from logging.level (2026-07-11) — MinAgent: 0.81.0
+
+Live validation of v0.116.0 caught the last blind spot: `/debug` + `/api/debug/*` (and the nav
+item) 404'd/hid unless `logging.level=debug` — the EXACT failure mode of the motivating incident,
+still standing in front of the new always-on ring. The debug surface is now available at ANY
+logging level (still session-authed via RequireAuth + CSRF); the nav link always renders.
+`isDebug()` keeps gating only legacy log EMISSION sites, as designed.
+
 ### v0.116.0 — observability pass: always-on debug ring + leveled sweep + agent tab + self-log pull (2026-07-11) — MinAgent: 0.81.0
 
 Controller half of the cross-repo observability task (agent v0.83.0 + hub v0.46.0). Motivating
diff --git a/CLAUDE.md b/CLAUDE.md
index d17d9c0..a0571c2 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -87,6 +87,9 @@ Per-package helpers/seams/traps: **`REUSE.md`** (maintained same-commit as helpe
 - All UI text is Hungarian (Budapest timezone). Design tokens/gates: use the `felhom-ui-design`
   skill; templates must pass `controller/scripts/template_id_gate.py` + `emoji_gate.py`.
 - Testing doctrine (non-hollow tests, red-proofs, seams): use the `felhom-testing` skill.
+- **Logging**: new leveled lines use `internal/logx` (DEBUG always reaches the debug ring; stdout
+  respects `logging.level`); English, keys-never-values, durations on outcomes — full rules in
+  `felhom.eu/documentation/runbooks/logging-conventions.md`.
 - Update `REUSE.md` if you added/changed/deprecated a shared helper or pattern (same commit).
 - **Coupled features** (controller behavior that depends on a specific agent version): add a
   `featureProbes` table row in `internal/agentapi/features.go` + a `Supports` gate call at the
diff --git a/controller/internal/web/server.go b/controller/internal/web/server.go
index 1b56bcb..711e8a6 100644
--- a/controller/internal/web/server.go
+++ b/controller/internal/web/server.go
@@ -252,12 +252,10 @@ func (s *Server) isDebug() bool {
 }
 
 // ServeDebugAPI handles /api/debug/* routes (JSON API for debug operations).
-// Called from the mux carve-out; debug mode check is done here.
+// v0.116.1: NO logging-level gate — the capture ring always exists now, and gating
+// the viewer on logging.level=debug was exactly the motivating incident's blind
+// spot (an info box 404'd the whole debug surface). Auth: RequireAuth at the mux.
 func (s *Server) ServeDebugAPI(w http.ResponseWriter, r *http.Request) {
-	if !s.isDebug() {
-		http.NotFound(w, r)
-		return
-	}
 	s.handleDebugAPI(w, r)
 }
 
@@ -373,10 +371,7 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		slug := strings.TrimPrefix(path, "/apps/")
 		s.appDetailHandler(w, r, slug)
 	case path == "/debug":
-		if !s.isDebug() {
-			http.NotFound(w, r)
-			return
-		}
+		// v0.116.1: available at ANY logging.level (the ring always captures; see ServeDebugAPI).
 		s.debugPageHandler(w, r)
 	default:
 		s.logger.Printf("[WARN] [web] 404 Not Found: %s %s", r.Method, path)
diff --git a/controller/internal/web/templates/layout.html b/controller/internal/web/templates/layout.html
index 8352f7e..af76146 100644
--- a/controller/internal/web/templates/layout.html
+++ b/controller/internal/web/templates/layout.html
@@ -31,7 +31,7 @@
             </li>
             <li><a href="/backups" class="{{if eq .Page "backups"}}active{{end}}"><svg class="ico"><use href="#i-shield"/></svg>Biztonsági mentés</a></li>
             <li><a href="/monitoring" class="{{if eq .Page "monitoring"}}active{{end}}"><svg class="ico"><use href="#i-cpu"/></svg>Rendszermonitor</a></li>
-            {{if .DebugMode}}<li><a href="/debug" class="{{if eq .Page "debug"}}active{{end}}"><svg class="ico"><use href="#i-wrench"/></svg>Debug</a></li>{{end}}
+            <li><a href="/debug" class="{{if eq .Page "debug"}}active{{end}}"><svg class="ico"><use href="#i-wrench"/></svg>Debug</a></li>
         </ul>
         <div class="sidebar-bottom">
             <div class="nav-group-label">Beállítások</div>