diff --git a/documentation/runbooks/logging-conventions.md b/documentation/runbooks/logging-conventions.md
index 6392656..f81cde4 100644
--- a/documentation/runbooks/logging-conventions.md
+++ b/documentation/runbooks/logging-conventions.md
@@ -8,6 +8,7 @@
 
 | Level | Meaning | Examples |
 |---|---|---|
+| **TRACE** (controller, v0.120.0) | A **periodic job's ROUTINE success** — "nothing happened, again". Dropped from the debug ring at write-time (fix-6, CAMPAIGN-3) so it never eats the finite post-incident window. NEVER used for a failure or a state change. | `[TRACE] [scheduler] job status-refresh: finished in 2ms`, `[TRACE] [stacks] refreshStatusLocked: stack "radarr" → state=running` |
 | **DEBUG** | Flow detail: phase steps, per-call traces, parsed values, verdicts with their inputs | `netverify: /proc/mounts verdict mounted=false`, `[agentapi] GET /storage -> 200 (12ms)` |
 | **INFO** | State changes and operations **with durations** ("X done in Yms") | `network storage added + verified: … in 4200ms`, `operator log pull served` |
 | **WARN** | Degraded-but-continuing | `journal unavailable — degraded classification`, `status persist failed` |
@@ -33,9 +34,12 @@ messages derived FROM log categories are mapped to Hungarian at the UI layer, ne
 
 ## Capture layers (how DEBUG reaches the operator)
 
-- **Controller**: the 1000-entry `LogBuffer` ring ALWAYS exists; stdout respects `logging.level`
-  via `LevelFilterWriter`. New leveled lines use `internal/logx` (`Debugf/Infof/Warnf/Errorf`).
-  Legacy `isDebug()`-gated call sites are grandfathered — their DEBUG does not exist at `info`.
+- **Controller**: the **5000-entry** `LogBuffer` ring ALWAYS exists (raised from 1000 in v0.120.0 —
+  fix-6); stdout respects `logging.level` via `LevelFilterWriter`. New leveled lines use `internal/logx`
+  (`Debugf/Infof/Warnf/Errorf`). Legacy `isDebug()`-gated call sites are grandfathered. **TRACE** lines
+  are dropped from the ring (periodic-noise policy). The ring **spills** to `<DataDir>/debug-ring.log`
+  (SSD state dir, atomic JSON-lines) every 30 s + on shutdown and loads back on boot, so a restart /
+  container recreation preserves the pre-restart window — the campaign's exact evidence-loss gap.
 - **Agent**: `applog.New` fans out — stderr/journald at the configured level, the `applog.Ring`
   fixed at DEBUG. Served by `GET /debug/logs` (local API) and the heartbeat log pull.
 - **Hub**: plain leveled Printf; the hub is directly operable, no ring needed.
diff --git a/hub/CHANGELOG.md b/hub/CHANGELOG.md
index 4ef4052..ccf7f4a 100644
--- a/hub/CHANGELOG.md
+++ b/hub/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Felhom Hub — Changelog
 
+## v0.48.0 — accept the app_start_failed event (controller fix-3, CAMPAIGN-3) (2026-07-12)
+
+- `app_start_failed` added to `allowedEventTypes` (`internal/api/handler.go`) + `customerMessages`
+  (`internal/notify/templates.go`). Without the allowlist entry the controller's fix-3 event (a
+  DEPLOYED app found not running — controller v0.120.0) would 400 at ingest and never reach the
+  operator. No other hub change; pairs with controller v0.120.0 which closes the CAMPAIGN-3 finding set.
+
 ## v0.47.0 — UI reorganization: customer tabs, Host tab, stale-host removal, offsite multi-endpoint UI, button contrast (2026-07-11)
 
 Five hub-side deliverables; no agent/controller/protocol changes. Baseline `8e1a3f0`