feat(greenfield): close logs maintenance parity

greenfield/docs/architecture/greenfield-rewrite/data-and-security.md

@@ -201,6 +201,8 @@ queryable lifecycle.
 | Incident notification         | unique `(incident_id, incident_generation, channel)` when incident is non-null            |
 | Queue claim                   | partial `job_runs(available_at, priority DESC, queued_at, id) WHERE state = 'queued'`     |
 | One active scheduled run      | unique partial `job_runs(scheduled_job_id) WHERE state IN ('queued', 'running')`          |
+| Active action status          | partial `job_runs_action_active_idx`; exact predicate below                               |
+| Terminal maintenance status   | partial `job_runs_action_payload_terminal_idx`; exact predicate below                     |
 | Worker expiry                 | `worker_instances(heartbeat_at, id)`                                                      |
 | Job timeline                  | `job_run_events(job_run_id, sequence)`                                                    |
 | Realtime catch-up             | `realtime_events(topic, id)`                                                              |
@@ -210,6 +212,16 @@ queryable lifecycle.
 | Cache refresh/expiry          | `cache_entries(last_attempt_status, expires_at_ms, key)`                                  |
 | Audit cursor                  | `audit_events(occurred_at_ms DESC, id DESC)` plus request/target indexes                  |
 
+The action-status indexes intentionally mirror the repository's literal predicates:
+
+- `job_runs_action_active_idx` indexes `(action_key, state DESC, queued_at DESC, id DESC)`
+  where `state IN ('queued', 'running')`. Maintenance payload equality is filtered after
+  this globally single-flight action lookup.
+- `job_runs_action_payload_terminal_idx` indexes
+  `(action_key, payload_json, queued_at DESC, id DESC)` where
+  `action_key = 'maintenance.rotate-logs'`, `length(CAST(payload_json AS BLOB)) <= 128`,
+  and `state IN ('cancelled', 'failed', 'succeeded', 'timed-out')`.
+
 Primary keys and unique constraints already create indexes; the schema does not add redundant
 copies. Partial-index predicates must match query predicates exactly enough for SQLite to use
 them.

greenfield/docs/architecture/greenfield-rewrite/progress.md

@@ -14,7 +14,7 @@ closes a phase; dated entries below provide the evidence, not a second status so
 | 2 — Trust and transport             | Complete for the stated server scope | Authentication, MFA, WebAuthn, automation credentials, audit, authenticated renewable SSE, one-shot native Gateway bootstrap verification, and the consolidated [threat model](../../security/greenfield-phase-two-threat-model.md) have executable evidence. Browser UI and production cutover remain later gates.                                                                                                                                                                                                                                                                                                                                                          |
 | 3 — Core operator domains           | Started                              | Task and agent-directory parity are implemented with durable history, realtime invalidation, and browser workflows. Monitoring ingestion plus report, incident, and notification server/browser parity are implemented. Dashboard-local durable schedules/jobs, real worker execution, their `/jobs` operator UI, the first claim-fenced `system.host` cache provider, its cache browser, and bounded system metrics are implemented. Root composition covers every implemented Phase 3 operator domain, and Phase 4A now supplies the OpenClaw-cron half of `/jobs`. Full root parity and privileged/external providers remain later gates, so the Phase 3 exit stays open. |
 | 4 — Gateway and chat                | Started                              | The current installed OpenClaw source is hash-pinned for the persistent sessions, cron, chat, companion, task, and media surfaces. Process-owned Gateway lifecycle, durable realtime invalidation, sessions and agent availability, OpenClaw cron/tasks, the compact heartbeat, the durable chat journal/runtime, bounded history and reconciliation, attachments/media proxy, and the `/chat` frontend are implemented. Recorded contract, protocol, service, browser, restart, load-boundary, and security tests cover the slice; live Gateway smoke/restart evidence and the Phase 4 exit gate remain open.                                                               |
-| 5 — Privileged and external domains | Started                              | Files now has named-root browsing, ticketed raw transfer, bounded spooling, CAS writes, worker execution, and browser workflows. Logs has redacted named-source reads plus separate custom app/container rotation and fixed host-logrotate policies. Terminal is a worker-owned interactive PTY over a hardened WebSocket with bounded reconnect replay. Docker control, database, Moltbook, settings, GitHub, deployment, backup, and the remaining privileged adapters stay open; the Phase 5 exit gate is not claimed.                                                                                                                                                    |
+| 5 — Privileged and external domains | Started                              | Files now has named-root browsing, ticketed raw transfer, bounded spooling, CAS writes, worker execution, and browser workflows. Logs has redacted named-source reads, durable active/latest-terminal maintenance status, worker-owned managed dry runs, separate custom app/container rotation, fixed host-logrotate policies, and closed reviewed `/logs` parity. Terminal is a worker-owned interactive PTY over a hardened WebSocket with bounded reconnect replay. Docker control, database, Moltbook, settings, GitHub, deployment, backup, full Files parity, and the remaining privileged adapters stay open; the Phase 5 exit gate is not claimed.                  |
 | 6 — Parity, hardening, and cutover  | Not started                          | Full UI parity, generated `/docs`, load/resource/restore evidence, cutover rehearsal, fresh production database, and legacy removal remain open.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
 
 ### 2026-08-03 — Phase 0 started
@@ -1274,9 +1274,10 @@ full-browser parity, production rehearsal, cutover, and legacy deletion remain o
 - Logs exposes a path-free catalog for exact Dashboard files, exact host text logs, and bounded
   dated OpenClaw files. Descriptor reads enforce owner, mode, link, type, size, and partial-read
   checks before centralized secret redaction; stable line identities derive only from redacted
-  text. Tail and search remain bounded and browser-session-only. The `/logs` route retains validated
-  data through safe failures and queues only fixed reviewed maintenance policy IDs after recent
-  MFA, durable audit, and job admission. The worker periodically probes its managed rotation engine
+  text. Tail and search remain bounded and browser-session-only. The `/logs` route hides cached
+  snapshots after source-availability or read-refresh failures rather than rendering or exporting
+  stale lines, and queues only fixed reviewed maintenance policy IDs after recent MFA, durable
+  audit, and job admission. The worker periodically probes its managed rotation engine
   and only `LoadState` for the four fixed host units, then atomically publishes a private,
   contract-ordered policy-ID projection under project-local log-maintenance state. The web process
   has no process or rotation-state authority: it reads only that bounded `0600` projection and
@@ -1309,3 +1310,28 @@ full-browser parity, production rehearsal, cutover, and legacy deletion remain o
   reviewed PTY replacement as implemented; `/files`, `/logs`, and legacy rotation-status parity
   remain planned until their outstanding full-parity behavior and real runtime status exist. The
   other Phase 5 domains and the aggregate privileged-operation exit gate remain open.
+
+### 2026-08-10 — Phase 5 Logs parity closed
+
+- Maintenance status now reads the five exact real-run payloads plus managed dry-run activity
+  through one bounded repository snapshot. Each policy exposes a running-preferred active run
+  separately from its latest terminal real run, while successful managed results project only
+  bounded path-free aggregate counts. Dry-run jobs remain independently observable and do not
+  replace the policy's real-run history.
+- `docker-managed` dry runs use the same durable recent-MFA, audit, admission, worker execution,
+  and settlement path as real maintenance. Host dry runs fail closed before invoking the fixed
+  system broker. Unknown worker result content never crosses the contract boundary.
+- The `/logs` browser keeps maintenance controls available even with no configured read sources,
+  locks all policies while the shared `host.logs` resource is active, follows the requested run
+  through realtime invalidation with a bounded polling fallback, and renders only the validated
+  terminal summary. Failed detail reads recover without leaving the controls permanently locked.
+- Credential redaction consumes complete scalar, structured, malformed, authorization, and cookie
+  values before search matching. Search inspects at most 4,000 newest physical lines per request,
+  and line identities use framed, redacted generation tuples. Managed copy-truncate publishes a
+  source-specific `rotating` marker before truncation and commits the pending epoch only after file
+  sync; a fresh worker instance safely completes interrupted pre-truncate, empty, and below-threshold
+  regrowth cases while web reads remain fail-closed. Queued maintenance audit rows retain only the
+  public policy target, request identity, and classified settlement metadata.
+- The reviewed `/logs` route plus legacy maintenance status, managed dry-run, and real-run
+  operations are now recorded as implemented. `/files`, Docker control, database, Moltbook,
+  settings, GitHub, delivery, backup, and the aggregate Phase 5 exit gate remain open.

greenfield/docs/generated/procedures.md

@@ -80,7 +80,7 @@
 | `jobs.listRuns` | query | jobs | Authenticated: jobs:read | [input](./schemas/jobs.listRuns.input.schema.json) | [output](./schemas/jobs.listRuns.output.schema.json) | `FORBIDDEN`, `UNAUTHORIZED` | None | Lists stable newest-first durable run history and queue state. |
 | `jobs.setClaimingPaused` | mutation | jobs | Authenticated browser session: jobs:write | [input](./schemas/jobs.setClaimingPaused.input.schema.json) | [output](./schemas/jobs.setClaimingPaused.output.schema.json) | `CONFLICT`, `FORBIDDEN`, `SERVICE_UNAVAILABLE`, `UNAUTHORIZED` | None | Pauses or resumes new cross-process claims under version control. |
 | `logs.listSources` | query | logs | Authenticated browser session: logs:read | [input](./schemas/logs.listSources.input.schema.json) | [output](./schemas/logs.listSources.output.schema.json) | `FORBIDDEN`, `SERVICE_UNAVAILABLE`, `UNAUTHORIZED` | None | Lists the bounded named log-source catalog without filesystem paths. |
-| `logs.maintenanceStatus` | query | logs | Authenticated browser session: logs:read | [input](./schemas/logs.maintenanceStatus.input.schema.json) | [output](./schemas/logs.maintenanceStatus.output.schema.json) | `FORBIDDEN`, `SERVICE_UNAVAILABLE`, `UNAUTHORIZED` | None | Reports which reviewed fixed log-maintenance policies can be queued. |
+| `logs.maintenanceStatus` | query | logs | Authenticated browser session: logs:read | [input](./schemas/logs.maintenanceStatus.input.schema.json) | [output](./schemas/logs.maintenanceStatus.output.schema.json) | `FORBIDDEN`, `SERVICE_UNAVAILABLE`, `UNAUTHORIZED` | None | Reports reviewed policy queueability plus active and latest terminal maintenance runs. |
 | `logs.requestMaintenance` | mutation | logs | Authenticated browser session: logs:write; MFA enrollment required; recent MFA when enabled | [input](./schemas/logs.requestMaintenance.input.schema.json) | [output](./schemas/logs.requestMaintenance.output.schema.json) | `FORBIDDEN`, `SERVICE_UNAVAILABLE`, `UNAUTHORIZED` | `mfa_enrollment_required`, `step_up_required` | Queues one audited worker-owned invocation of an exact reviewed log policy. |
 | `logs.search` | query | logs | Authenticated browser session: logs:read | [input](./schemas/logs.search.input.schema.json) | [output](./schemas/logs.search.output.schema.json) | `FORBIDDEN`, `NOT_FOUND`, `SERVICE_UNAVAILABLE`, `UNAUTHORIZED` | None | Searches only a bounded redacted tail window of one named source. |
 | `logs.tail` | query | logs | Authenticated browser session: logs:read | [input](./schemas/logs.tail.input.schema.json) | [output](./schemas/logs.tail.output.schema.json) | `FORBIDDEN`, `NOT_FOUND`, `SERVICE_UNAVAILABLE`, `UNAUTHORIZED` | None | Reads one redacted bounded tail from an exact named source. |

greenfield/docs/generated/schemas/chat.runtime.output.schema.json

@@ -290,6 +290,11 @@
                     "kind": {
                       "const": "item"
                     },
+                    "occurredAtMs": {
+                      "type": "integer",
+                      "minimum": 0,
+                      "maximum": 8640000000000000
+                    },
                     "sequence": {
                       "type": "integer",
                       "minimum": 1,
@@ -1510,6 +1515,11 @@
                     "kind": {
                       "const": "item"
                     },
+                    "occurredAtMs": {
+                      "type": "integer",
+                      "minimum": 0,
+                      "maximum": 8640000000000000
+                    },
                     "sequence": {
                       "type": "integer",
                       "minimum": 1,