feat(web-ui): add service health graphs and core log viewer

docs/api/PROTOCOL.md

@@ -484,6 +484,122 @@ Control a local backend daemon (`start`, `restart`, `stop`, `update`).
 }
 ```
 
+#### `system.observabilitySources`
+
+Return graph/log-capable observability sources for the dashboard.
+
+**Request:**
+```json
+{
+  "id": 15,
+  "method": "system.observabilitySources"
+}
+```
+
+**Response:**
+```json
+{
+  "id": 15,
+  "result": {
+    "sources": [
+      {
+        "id": "systemd:flynn",
+        "name": "Flynn daemon",
+        "kind": "systemd_system",
+        "runtime": "systemd_system",
+        "status": "running",
+        "graphCapable": true,
+        "logCapable": true
+      },
+      {
+        "id": "docker:whisper",
+        "name": "Whisper (whisper.cpp)",
+        "kind": "docker_dependency",
+        "runtime": "docker_compose",
+        "status": "running",
+        "graphCapable": true,
+        "logCapable": true
+      }
+    ]
+  }
+}
+```
+
+#### `system.observabilitySeries`
+
+Return sampled service trend points (bounded, in-memory) for dashboard charts.
+
+**Request:**
+```json
+{
+  "id": 16,
+  "method": "system.observabilitySeries",
+  "params": {
+    "windowMinutes": 60,
+    "bucketSeconds": 30,
+    "sourceIds": ["systemd:flynn", "docker:whisper"]
+  }
+}
+```
+
+**Response:**
+```json
+{
+  "id": 16,
+  "result": {
+    "generatedAt": 1739999999000,
+    "windowMinutes": 60,
+    "bucketSeconds": 30,
+    "series": [
+      {
+        "sourceId": "systemd:flynn",
+        "points": [
+          { "ts": 1739999970000, "stateCode": 3, "healthCode": 2, "errorCount": 0, "restartCount": 0 },
+          { "ts": 1739999985000, "stateCode": 3, "healthCode": 2, "errorCount": 0, "restartCount": 1 }
+        ]
+      }
+    ]
+  }
+}
+```
+
+#### `system.serviceLogs`
+
+Return recent logs for a discovered observability source. Flynn applies secret masking heuristics to returned lines.
+
+**Request:**
+```json
+{
+  "id": 17,
+  "method": "system.serviceLogs",
+  "params": {
+    "sourceId": "docker:whisper",
+    "lines": 200,
+    "sinceSeconds": 900
+  }
+}
+```
+
+**Response:**
+```json
+{
+  "id": 17,
+  "result": {
+    "sourceId": "docker:whisper",
+    "fetchedAt": 1739999999000,
+    "redacted": false,
+    "truncated": false,
+    "lines": [
+      {
+        "ts": 1739999990000,
+        "level": "warn",
+        "text": "queue depth rising"
+      }
+    ]
+  }
+}
+```
+
 **Response:**
 ```json
 {

docs/plans/state.json

@@ -3,6 +3,24 @@
   "updated_at": "2026-02-23",
   "description": "Tracks the status of all Flynn plans and implementation phases",
   "plans": {
+    "dashboard-observability-graphs-and-service-logs": {
+      "status": "completed",
+      "date": "2026-02-23",
+      "updated": "2026-02-23",
+      "summary": "Implemented focused observability upgrades in the web dashboard: sampled service health trend graphs for systemd/docker sources and core service log viewing with source selection, filters, and auto-refresh. Added new gateway RPCs (`system.observabilitySources`, `system.observabilitySeries`, `system.serviceLogs`) backed by a bounded observability collector and server-side secret masking on returned log lines.",
+      "files_modified": [
+        "src/gateway/handlers/observability.ts",
+        "src/gateway/handlers/observability.test.ts",
+        "src/gateway/handlers/system.ts",
+        "src/gateway/handlers/handlers.test.ts",
+        "src/gateway/server.ts",
+        "src/gateway/ui/pages/dashboard.js",
+        "src/gateway/ui/pages/dashboard.test.ts",
+        "docs/api/PROTOCOL.md",
+        "docs/plans/state.json"
+      ],
+      "test_status": "pnpm test:run src/gateway/handlers/observability.test.ts src/gateway/handlers/handlers.test.ts src/gateway/ui/pages/dashboard.test.ts + pnpm typecheck passing"
+    },
     "dashboard-docker-dependency-discovery": {
       "status": "completed",
       "date": "2026-02-23",
@@ -6221,6 +6239,7 @@
     "tier4_completion": "4/4 (100%) — gateway lock, shell completion, Tailscale Serve/Funnel, DM pairing codes",
     "feature_gap_scorecard": "128/128 match (100%), 0 partial (0%), 0 missing (0%)",
     "operator_dx_milestone": "Phase 3 (Live Ops Dashboard): 2/2 plans complete — milestone done",
+    "dashboard_observability": "completed — service health graphs + core service log viewer added to web UI via observability RPCs and bounded backend sampling",
     "gmail_auth_cli": "flynn gmail-auth command implemented with OAuth2 flow, doctor check, config routed to Telegram",
     "native_audio_support": "completed — smart routing for native audio (Gemini/OpenAI/GitHub) vs Whisper transcription fallback, plus 2026-02-23 arg hydration hardening, tool.args_rewritten audit metric, transient fetch retry/timeout hardening, localhost->127.0.0.1 fallback for transcription endpoint connectivity, and whisper docker-compose entrypoint arg fix for port 18801",
     "remaining_phases_completion": "Phase 1: 3/3 (100%) — context levels, command registry, memory structure. Phase 2: 3/3 (100%) — component registry, confidence routing, history index. Phase 3: 2/2 (100%) — adaptive memory/compaction, truthfulness/autonomy hardening",