hub v0.46.0: observability pass — per-box log pulls, bundle custody, 72h TTL + secret gate

log_bundle_requests + log_bundles store (gzip, newest-3, 72h TTL purged on the
60s sweep); SaveLogBundle secret gate fail-closed (blocked flag row, no payload;
REDACTED/checksums pass). Report ACK gains controller_log_requested + ingests
controller_log_tail; heartbeat envelope gains log_tail_requested + ingests
log_tail (consume-once on arrival; pre-0.83 agents stay visibly pending). Host
detail Diagnostics section: request buttons (controller/agent), state rows with
honest latency hints, View/Download endpoint. Red-proofs: gate disabled and
clear-on-arrival removed both FAIL their tests.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

hub/internal/store/store.go

@@ -494,6 +494,34 @@ func (s *Store) migrate() error {
 		return err
 	}
 
+	// Component log bundles (v0.46.0 observability, see logbundle.go): the operator's
+	// pending pull intents per (scope, component) — scope = customer_id for the
+	// controller (report ACK channel) / host_id for the agent (heartbeat envelope) —
+	// plus the received gzip bundles (72 h TTL, purge on the 60 s sweep; a secret-gate
+	// hit stores a BLOCKED flag row with no payload).
+	_, err = s.db.Exec(`
+		CREATE TABLE IF NOT EXISTS log_bundle_requests (
+			scope_id     TEXT NOT NULL,
+			component    TEXT NOT NULL,
+			requested_at DATETIME NOT NULL,
+			PRIMARY KEY (scope_id, component)
+		);
+		CREATE TABLE IF NOT EXISTS log_bundles (
+			id             INTEGER PRIMARY KEY AUTOINCREMENT,
+			scope_id       TEXT NOT NULL,
+			component      TEXT NOT NULL,
+			collected_at   DATETIME NOT NULL,
+			received_at    DATETIME NOT NULL,
+			size_bytes     INTEGER NOT NULL,
+			gz             BLOB,
+			blocked        INTEGER NOT NULL DEFAULT 0,
+			blocked_reason TEXT NOT NULL DEFAULT ''
+		);
+	`)
+	if err != nil {
+		return err
+	}
+
 	return nil
 }