dashboard: move infra container logs to dedicated INFRA tab

logs.html/logs.js previously showed infra containers (hive-ci, hive-forge,
hive-gateway, hive-matrix) in an optgroup within the AGENT tab selector.
This was confusing because infra containers don't run the per-agent hive
daemons, making the unit filter meaningless for them.

Changes:
- Add INFRA tab (between AGENT and SYSTEM) with its own container selector
  and full-machine-journal fetch (no unit filter).
- Remove the infra optgroup from the AGENT tab — it now shows agents only.
- loadContainerLists() replaces loadAgentList(): fetches /api/state once and
  populates both selectors, avoiding a duplicate network request.
- Deep-link (?agent=hive-ci) now routes to the INFRA tab when the named
  container is an infra container, falling back to AGENT otherwise.
- Remove syncUnitSelectForSelection() — no longer needed since the AGENT
  tab no longer contains infra containers.
- Extend the 30s timestamp ticker to cover the INFRA tab fetch time.

No backend changes: /api/journal/{name} already supports infra container names.

frontend/packages/dashboard/src/logs.html

@@ -15,8 +15,8 @@
   <!-- Minimal chrome: back link + sub-tab strip.
        Same pattern as flow.html — no full dashboard tabbar. Back link
        points to the H0M3 hub (served at /), not the dashboard.
-       Three sub-tabs: AGENT, SYSTEM, AUDIT. Build log history has moved
+       Four sub-tabs: AGENT, INFRA, SYSTEM, AUDIT. Build log history has
-       to /builds.html (the build lifecycle hub). -->
+       moved to /builds.html (the build lifecycle hub). -->
   <header class="page-header">
     <a class="page-back" href="/">← home</a>
     <nav class="hive-tabbar logs-tabbar" id="logs-tabbar" role="tablist">
@@ -24,6 +24,10 @@
          aria-controls="logs-pane-agent" data-tab="agent">
         <span class="logs-tab-label">AGENT</span>
       </a>
+      <a class="hive-tab" id="logs-tab-infra" href="#infra" role="tab"
+         aria-controls="logs-pane-infra" data-tab="infra">
+        <span class="logs-tab-label">INFRA</span>
+      </a>
       <a class="hive-tab" id="logs-tab-system" href="#system" role="tab"
          aria-controls="logs-pane-system" data-tab="system">
         <span class="logs-tab-label">SYSTEM</span>
@@ -57,6 +61,21 @@
       <pre id="agent-output" class="journal-output">select an agent above</pre>
     </section>
 
+    <!-- INFRA: journald viewer for infrastructure containers (hive-ci,
+         hive-forge, hive-gateway, hive-matrix). Always fetches the full
+         machine journal — no unit filter (infra containers don't run the
+         per-agent hive daemons). Backed by GET /api/journal/{name}?lines=N.
+         Deep-link: ?agent=hive-ci routes here instead of the AGENT tab. -->
+    <section class="logs-pane" id="logs-pane-infra" data-tab-pane="infra"
+             role="tabpanel" aria-labelledby="logs-tab-infra">
+      <div class="logs-toolbar">
+        <select id="infra-select" class="journal-unit"></select>
+        <button type="button" class="btn btn-restart" id="infra-refresh">↻ refresh</button>
+        <span id="infra-fetch-ts" class="meta logs-fetch-ts" hidden></span>
+      </div>
+      <pre id="infra-output" class="journal-output">select a container above</pre>
+    </section>
+
     <!-- SYSTEM: host-side service logs. Shows the hive-c0re daemon
          journal via GET /api/journal-host?unit=hive-c0re.service. -->
     <section class="logs-pane" id="logs-pane-system" data-tab-pane="system"

frontend/packages/dashboard/src/logs.js

@@ -1,16 +1,18 @@
-// /logs.html entry point: log viewer with three sub-tabs (AGENT, SYSTEM,
+// /logs.html entry point: log viewer with four sub-tabs (AGENT, INFRA,
-// AUDIT). Build log history has moved to /builds.html.
+// SYSTEM, AUDIT). Build log history has moved to /builds.html.
 // AGENT  — per-container journald viewer, backed by GET /api/journal/{name}
+// INFRA  — infra-container journald viewer (hive-ci, hive-forge, …),
+//          same API but full machine journal only (no unit filter)
 // SYSTEM — host service logs, backed by GET /api/journal-host
 // AUDIT  — agent-initiated privileged-action trail, GET /api/audit-log;
 //          live-appends via the `audit_entry_added` /dashboard/stream event
 //
-// Tab routing via URL hash (#agent, #system, #audit). Default: #agent.
+// Tab routing via URL hash (#agent, #infra, #system, #audit). Default: #agent.
 //
-// URL params `?agent=name` and `?unit=svc` pre-select the agent + unit on
+// URL params `?agent=name` and `?unit=svc` pre-select the agent + unit.
-// the AGENT tab (deep-link from other pages, e.g. the per-agent ⋮ menu).
+// When `?agent=` names an infra container the INFRA tab is activated instead.
-// Last-fetched timestamp is shown next to the refresh button on AGENT +
+// Last-fetched timestamp is shown next to the refresh button on AGENT,
-// SYSTEM tabs so the operator knows how stale the output is.
+// INFRA, and SYSTEM tabs so the operator knows how stale the output is.
 
 import {
   $, el, fmtAgeSecs, openStream, initServerWarnings,
@@ -23,14 +25,20 @@ import { createTabStrip } from '@hive/shared/tabs.js';
 
   // ─── tab routing ──────────────────────────────────────────────────────
   // The shared hash-routed tab strip (@hive/shared/tabs.js) handles the
-  // active toggle + aria-selected + pane visibility + the SYSTEM lazy
+  // active toggle + aria-selected + pane visibility + lazy fetches via
-  // fetch via onShow. Constructed in the init block below (after the
+  // onShow. Constructed in the init block below (after the fetch fns +
-  // fetch fns + element refs it depends on exist). `logTabs.active()`
+  // element refs it depends on exist). `logTabs.active()` replaces the
-  // replaces the old `activeTab()`.
+  // old `activeTab()`.
   let logTabs;
 
   // ─── helpers ──────────────────────────────────────────────────────────
 
+  // Format a last-fetched timestamp: "fetched just now" / "fetched 3m ago".
+  function fmtFetchTs(fetchedAt) {
+    const ageSecs = Math.floor((Date.now() - fetchedAt) / 1000);
+    return 'fetched ' + (ageSecs < 5 ? 'just now' : fmtAgeSecs(ageSecs) + ' ago');
+  }
+
   // ─── AGENT tab ────────────────────────────────────────────────────────
 
   const agentSelect     = $('agent-select');
@@ -39,70 +47,6 @@ import { createTabStrip } from '@hive/shared/tabs.js';
   const agentOutput     = $('agent-output');
   const agentFetchTs    = $('agent-fetch-ts');
 
-  // Format a last-fetched timestamp: "fetched just now" / "fetched 3m ago".
-  function fmtFetchTs(fetchedAt) {
-    const ageSecs = Math.floor((Date.now() - fetchedAt) / 1000);
-    return 'fetched ' + (ageSecs < 5 ? 'just now' : fmtAgeSecs(ageSecs) + ' ago');
-  }
-
-  // Names from `state.infra_containers` (hive-ci / hive-forge / hive-gateway
-  // / hive-matrix) — kept in sync with the fetched list so fetchAgent() can
-  // tell an infra container apart from an agent and skip the (inapplicable)
-  // unit filter for it.
-  let infraContainerNames = new Set();
-
-  // Populate agent selector from /api/state (agents, then the four infra
-  // containers in their own optgroup), then honour any `?agent=` / `?unit=`
-  // URL params (used by the per-agent ⋮ menu's deep-link).
-  async function loadAgentList() {
-    try {
-      const resp = await fetch('/api/state');
-      if (!resp.ok) return;
-      const state = await resp.json();
-      if (!agentSelect) return;
-      agentSelect.replaceChildren();
-      agentSelect.append(el('option', { value: '' }, '— select agent —'));
-      for (const c of (state.containers || [])) {
-        agentSelect.append(el('option', { value: c.name }, c.name));
-      }
-      infraContainerNames = new Set((state.infra_containers || []).map((c) => c.name));
-      if (infraContainerNames.size) {
-        const infraGroup = el('optgroup', { label: 'infra' });
-        for (const name of infraContainerNames) {
-          infraGroup.append(el('option', { value: name }, name));
-        }
-        agentSelect.append(infraGroup);
-      }
-      // Deep-link: honour ?agent= and ?unit= URL params.
-      const urlAgent = new URLSearchParams(location.search).get('agent');
-      const urlUnit  = new URLSearchParams(location.search).get('unit');
-      if (urlAgent) {
-        const found = Array.from(agentSelect.options).some((o) => o.value === urlAgent);
-        if (found) {
-          agentSelect.value = urlAgent;
-          if (urlUnit && agentUnitSelect) {
-            const unitFound = Array.from(agentUnitSelect.options)
-              .some((o) => o.value === urlUnit);
-            if (unitFound) agentUnitSelect.value = urlUnit;
-          }
-          syncUnitSelectForSelection();
-          fetchAgent();
-        }
-      }
-    } catch { /**/ }
-  }
-
-  // Infra containers don't run the per-agent hive daemons, so the unit
-  // filter is meaningless for them — disable the selector and always fetch
-  // the full machine journal to avoid a picked unit silently doing nothing.
-  function syncUnitSelectForSelection() {
-    if (!agentUnitSelect) return;
-    const isInfra = infraContainerNames.has(agentSelect ? agentSelect.value : '');
-    agentUnitSelect.disabled = isInfra;
-    if (isInfra) agentUnitSelect.value = '';
-  }
-  if (agentSelect) agentSelect.addEventListener('change', syncUnitSelectForSelection);
-
   let agentFetching = false;
   let agentLastFetch = 0;
   async function fetchAgent() {
@@ -113,8 +57,7 @@ import { createTabStrip } from '@hive/shared/tabs.js';
     agentFetching = true;
     agentOutput.textContent = 'fetching…';
     if (agentFetchTs) agentFetchTs.hidden = true;
-    const isInfra = infraContainerNames.has(name);
+    const unit = agentUnitSelect ? agentUnitSelect.value : '';
-    const unit = (!isInfra && agentUnitSelect) ? agentUnitSelect.value : '';
     const params = new URLSearchParams({ lines: '500' });
     if (unit) params.set('unit', unit);
     try {
@@ -140,6 +83,107 @@ import { createTabStrip } from '@hive/shared/tabs.js';
   if (agentUnitSelect) agentUnitSelect.addEventListener('change', fetchAgent);
   if (agentRefresh)    agentRefresh.addEventListener('click', fetchAgent);
 
+  // ─── INFRA tab ────────────────────────────────────────────────────────
+  // Infra containers (hive-ci, hive-forge, hive-gateway, hive-matrix) don't
+  // run the per-agent hive daemons, so the unit filter is inapplicable. We
+  // always fetch the full machine journal for them.
+
+  const infraSelect  = $('infra-select');
+  const infraRefresh = $('infra-refresh');
+  const infraOutput  = $('infra-output');
+  const infraFetchTs = $('infra-fetch-ts');
+
+  let infraFetching = false;
+  let infraLastFetch = 0;
+  async function fetchInfra() {
+    if (!infraSelect || !infraOutput) return;
+    const name = infraSelect.value;
+    if (!name) { infraOutput.textContent = 'select a container above'; return; }
+    if (infraFetching) return;
+    infraFetching = true;
+    infraOutput.textContent = 'fetching…';
+    if (infraFetchTs) infraFetchTs.hidden = true;
+    const params = new URLSearchParams({ lines: '500' });
+    try {
+      const resp = await fetch('/api/journal/' + encodeURIComponent(name) + '?' + params);
+      const text = await resp.text();
+      infraOutput.textContent = resp.ok ? (text || '(empty)') : 'error ' + resp.status + '\n' + text;
+      infraOutput.scrollTop = infraOutput.scrollHeight;
+      if (resp.ok) {
+        infraLastFetch = Date.now();
+        if (infraFetchTs) {
+          infraFetchTs.textContent = fmtFetchTs(infraLastFetch);
+          infraFetchTs.hidden = false;
+        }
+      }
+    } catch (err) {
+      infraOutput.textContent = 'fetch failed: ' + err;
+    } finally {
+      infraFetching = false;
+    }
+  }
+
+  if (infraSelect)  infraSelect.addEventListener('change', fetchInfra);
+  if (infraRefresh) infraRefresh.addEventListener('click', fetchInfra);
+
+  // ─── container list init ──────────────────────────────────────────────
+  // Fetch /api/state once and populate both the AGENT selector (agents only)
+  // and the INFRA selector (infra containers only). Also handles the
+  // ?agent= / ?unit= deep-link, routing to the INFRA tab when the named
+  // container is an infra container.
+  async function loadContainerLists() {
+    try {
+      const resp = await fetch('/api/state');
+      if (!resp.ok) return;
+      const state = await resp.json();
+
+      // Populate AGENT selector (agents only — no infra optgroup).
+      if (agentSelect) {
+        agentSelect.replaceChildren();
+        agentSelect.append(el('option', { value: '' }, '— select agent —'));
+        for (const c of (state.containers || [])) {
+          agentSelect.append(el('option', { value: c.name }, c.name));
+        }
+      }
+
+      // Populate INFRA selector.
+      const infraNames = new Set((state.infra_containers || []).map((c) => c.name));
+      if (infraSelect) {
+        infraSelect.replaceChildren();
+        infraSelect.append(el('option', { value: '' }, '— select container —'));
+        for (const name of infraNames) {
+          infraSelect.append(el('option', { value: name }, name));
+        }
+      }
+
+      // Deep-link: honour ?agent= and ?unit= URL params.
+      const urlAgent = new URLSearchParams(location.search).get('agent');
+      const urlUnit  = new URLSearchParams(location.search).get('unit');
+      if (urlAgent) {
+        if (infraNames.has(urlAgent)) {
+          // Route to INFRA tab.
+          logTabs.show('infra');
+          if (infraSelect) {
+            infraSelect.value = urlAgent;
+            fetchInfra();
+          }
+        } else if (agentSelect) {
+          // Route to AGENT tab.
+          const found = Array.from(agentSelect.options).some((o) => o.value === urlAgent);
+          if (found) {
+            agentSelect.value = urlAgent;
+            if (urlUnit && agentUnitSelect) {
+              const unitFound = Array.from(agentUnitSelect.options)
+                .some((o) => o.value === urlUnit);
+              if (unitFound) agentUnitSelect.value = urlUnit;
+            }
+            fetchAgent();
+          }
+        }
+      }
+    } catch { /**/ }
+  }
+
   // ─── SYSTEM tab ───────────────────────────────────────────────────────
 
   const systemUnitSelect = $('system-unit-select');
@@ -330,7 +374,7 @@ import { createTabStrip } from '@hive/shared/tabs.js';
       else if (id === 'audit') fetchAudit();
     },
   });
-  loadAgentList();
+  loadContainerLists();
 
   // Subscribe to the dashboard SSE stream for audit live-appends.
   {
@@ -350,6 +394,9 @@ import { createTabStrip } from '@hive/shared/tabs.js';
     if (agentLastFetch && agentFetchTs && !agentFetchTs.hidden) {
       agentFetchTs.textContent = fmtFetchTs(agentLastFetch);
     }
+    if (infraLastFetch && infraFetchTs && !infraFetchTs.hidden) {
+      infraFetchTs.textContent = fmtFetchTs(infraLastFetch);
+    }
     if (systemLastFetch && systemFetchTs && !systemFetchTs.hidden) {
       systemFetchTs.textContent = fmtFetchTs(systemLastFetch);
     }