fix(cli): resolve logs, Hasura and MinIO debt (D-0750, D-0720, D-0639, D-0679)

.github/facts.json

@@ -9,7 +9,7 @@
   },
   "schema_version": "1",
   "sources": {
-    "openapi_sha256": "01ea16e2ac6cebd687983d758b80a9f1ddffe3b6a3a85bda4fc70ce077ca71b6",
+    "openapi_sha256": "28a28a8b94fc4bb8da75afb5e7d191c153b52897a0c197665d6d9fa87238b0c7",
     "registry_sha256": "37fe98fe4dfa26f0c8af15f5cc50e9a5b81f499976850ae2b6066c536e8fe6c9"
   },
   "verbs": [

.github/openapi.json

@@ -42303,11 +42303,6 @@
                   "flags": {
                     "additionalProperties": false,
                     "properties": {
-                      "ai": {
-                        "default": false,
-                        "description": "Run the AI first-run wizard (install Ollama, setup Gemini pool, verify)",
-                        "type": "boolean"
-                      },
                       "alerts": {
                         "default": false,
                         "description": "Check monitoring alert rules are loaded",
@@ -42348,11 +42343,6 @@
                         "description": "Print OAuth URL instead of opening browser (for SSH/headless servers)",
                         "type": "boolean"
                       },
-                      "install-check": {
-                        "default": false,
-                        "description": "Run 6-stage onboarding funnel check (used by Homebrew post-install hook)",
-                        "type": "boolean"
-                      },
                       "only": {
                         "default": "",
                         "description": "Run only a specific subsystem check (host, docker, postgres, hasura, nginx, ssl, ping, plugins, license, monitoring, backups, security)",
@@ -47168,26 +47158,11 @@
                         "description": "Show logs since (e.g. 1h, 30m, or RFC3339)",
                         "type": "string"
                       },
-                      "status": {
-                        "default": false,
-                        "description": "Show service status overview",
-                        "type": "boolean"
-                      },
-                      "summary": {
-                        "default": false,
-                        "description": "Show recent errors by service",
-                        "type": "boolean"
-                      },
                       "tail": {
                         "default": 10,
                         "description": "Number of lines to show",
                         "type": "integer"
                       },
-                      "top": {
-                        "default": false,
-                        "description": "Show most active services",
-                        "type": "boolean"
-                      },
                       "until": {
                         "default": "",
                         "description": "Show logs until (e.g. 1h or RFC3339)",

.github/wiki/Config-Env-Vars.md

@@ -185,7 +185,7 @@ See also `BACKUP_CRITICAL_TABLES` under [PostgreSQL](#postgresql), and
 
 | Variable | Type | Default | Required | Description |
 |---|---|---|---|---|
-| `HASURA_VERSION` | string | `v2.44.0` | No | Docker image tag for Hasura. |
+| `HASURA_VERSION` | string | blank | No | Blank keeps the project lock pin or mode default; any nonblank tag explicitly selects that release. |
 | `HASURA_GRAPHQL_ADMIN_SECRET` | string | *(none)* | **Yes** | Admin API secret used to authenticate privileged requests. Minimum 32 characters. |
 | `HASURA_JWT_KEY` | string | *(none)* | **Yes** | Secret key used to sign and verify JWTs. Minimum 32 characters. |
 | `HASURA_JWT_TYPE` | string | `HS256` | No | JWT signing algorithm. Common values: `HS256`, `RS256`. |

.github/wiki/Config-Hasura.md

@@ -10,7 +10,7 @@ All Hasura configuration is driven by `HASURA_*` variables in your `.env` files.
 
 | Variable | Type | Default | Required | Description |
 |----------|------|---------|----------|-------------|
-| `HASURA_VERSION` | string | `v2.44.0` | No | Docker image tag for the Hasura container |
+| `HASURA_VERSION` | string | blank | No | Blank keeps the project lock pin, or uses v2.44.0 in v1.4 and v2.51.0 in v1.5. Every nonblank tag is explicit and overrides a project pin; use `nself service upgrade hasura <tag>` or set this variable to move a pinned project. |
 | `HASURA_GRAPHQL_ADMIN_SECRET` | string | *(none)* | **Yes** | Admin API secret (minimum 32 characters). Required to access the Hasura Console and the admin API endpoint. |
 | `HASURA_JWT_KEY` | string | *(none)* | **Yes** | JWT signing key (minimum 32 characters). Used to verify tokens issued by the Auth service. |
 | `HASURA_JWT_TYPE` | string | `HS256` | No | JWT algorithm. Supported values: `HS256`, `RS256`, and other algorithms supported by Hasura. |

.github/wiki/Config-System.md

@@ -80,7 +80,7 @@ You do not need to set every variable. ɳSelf ships with sensible defaults so mi
 | `ENV` | `dev` |
 | `BASE_DOMAIN` | `local.nself.org` |
 | `POSTGRES_VERSION` | `16-alpine` |
-| `HASURA_VERSION` | `v2.44.0` |
+| `HASURA_VERSION` | blank (project lock pin or compatibility mode default) |
 
 Password handling varies by environment:
 

.github/wiki/Image-Lock.md

@@ -25,7 +25,7 @@ Set `IMAGE_PINNING=lock` in `.env` to opt a project in early. Moving to `lock` c
 
 ## Overrides
 
-A `*_VERSION` key in the env cascade is an explicit override and is used as given, unpinned, unless it equals the lock version or the `legacy_ref` tag. The `legacy_ref` tag is what the config defaults and the `.env` files written by `nself setup` carry (`HASURA_VERSION=v2.44.0`), so it counts as "the default" and stays pinned after a bump. To run the pre-lock version itself, use `IMAGE_PINNING=legacy`.
+A `*_VERSION` key in the env cascade is an explicit override and is used as given, unpinned, unless it equals the lock version or the `legacy_ref` tag. The `legacy_ref` tag is what most config defaults and init env files carry, so it counts as the default and stays pinned after a bump. Hasura leaves its version blank instead: every nonblank `HASURA_VERSION` is explicit. Known Hasura releases use their own lock entry; other tags render unpinned. To use tag references without digests, use `IMAGE_PINNING=legacy`.
 
 | Setting | `IMAGE_PINNING=lock` | `IMAGE_PINNING=legacy` |
 |---|---|---|
@@ -101,10 +101,13 @@ The lock carries two Hasura entries on `docker.io/hasura/graphql-engine`: `hasur
 | v1.4 | `hasura-v14`: `docker.io/hasura/graphql-engine:v2.44.0@sha256:...` in lock mode, `hasura/graphql-engine:v2.44.0` in legacy mode |
 | v1.5, no lock pin yet (a new project) | `hasura` (v2.51.0) |
 | the project lock pins v2.44.0 | the pin, in both modes, until `nself update` moves it |
-| `HASURA_VERSION=v2.44.0` (what `nself init` writes into `.env`) or blank | the mode default, or the pin if there is one: a default, not an override |
+| `HASURA_VERSION=` (what `nself init` writes into `.env`) or unset | the mode default, or the pin if there is one |
+| `HASURA_VERSION=v2.44.0` | `hasura-v14`; explicit override that drops a v2.51.0 project pin with one notice |
 | `HASURA_VERSION=v2.51.0` | `hasura` in any mode; it is an override, so it drops a lock pin of v2.44.0 with one notice |
 | any other `HASURA_VERSION` (`v2.45.0`) | `hasura/graphql-engine:<tag>`, unpinned, in any mode |
 
+Every nonblank `HASURA_VERSION` is explicit and overrides a project pin, including `v2.44.0`. Projects without a v2.51.0 pin resolve `v2.44.0` to `hasura-v14`. To move a v2.51.0-pinned project to v2.44.0, use `nself service upgrade hasura v2.44.0` or set `HASURA_VERSION=v2.44.0` in `.env`.
+
 Hasura v2.51.0 does not change the metadata format or the migration contract. `scripts/ci/hasura-upgrade-smoke.sh` starts a project on v2.44.0 with a migrated fixture (tables and rows) and metadata (tracked tables, a relationship, a select permission, an event trigger to a webhook, a remote schema), takes a verified backup, switches the pin to v2.51.0 and checks that the rows are readable, that the metadata export is identical before and after (the `nself db hasura metadata export` tree and the normalised API JSON), that apply then export round-trips, and that a mutation, a subscription event, a remote schema call and an event trigger delivery work. The metadata catalog version is 48 on both releases.
 
 ### Upgrade an existing project