feat(logs): source-categorized logging (EVENTS/SYS/NODE) + events.log + filters

Every log line now gets one category at the source:
- classifyLogCategory(msg) in server.js (EVENTS→SYS→NODE, first match wins),
  mirrored byte-identically as logCategory(msg) in admin.html.
- broadcast() sets data.cat before emit (logBuffer stays string[]; replayed init
  lines are re-classified client-side with the same rules).
- EVENTS lines persist to results/events.log (separate from the per-run test log),
  1-file rotation at ~2MB. The pipeline's per-run audit.log now tees only
  non-events lines, so EVENTS (lifecycle) and the run's SYS+NODE stream are kept
  separate on disk, as requested.
- admin Live Log gets ALL/EVENTS/SYS/NODE filter buttons (mirrors /live), each row
  tagged data-cat (server cat for live lines, re-derived for replay).

Adversarially reviewed (no CRITICAL/HIGH; mechanism — data.cat mutation reaches
the pipeline wrapper, rotation safety, server↔client classifier identity — all
verified). Applied the two MEDIUM classifier fixes the review found: dropped bare
'💾' from EVENTS (it caught the per-node "💾 Cached:" line, mis-routing it to
events.log and dropping it from the run log; 'Saved' already covers the lifecycle
lines), and added 'Resuming Test' to EVENTS. Test suite green (188/31/45/35).

Author: Sentinel-Bluebuilder

admin.html

@@ -572,6 +572,20 @@
       text-transform: uppercase;
     }
 
+    /* Live Log category filters — mirrors public /live's .log-filters mechanism */
+    .log-filters {
+      display: inline-flex; gap: 2px;
+      border: 1px solid var(--border); border-radius: 5px;
+      overflow: hidden; font-size: 10px; letter-spacing: 0.5px;
+      font-family: var(--font-display);
+    }
+    .log-filter-btn {
+      padding: 3px 8px; color: var(--text-muted); font-weight: 600;
+      cursor: pointer; user-select: none;
+    }
+    .log-filter-btn:hover { color: var(--text); }
+    .log-filter-btn.active { background: var(--bg-input); color: var(--text); }
+
     .table-wrap { overflow-y: auto; scrollbar-gutter: stable; flex: 1; min-height: 0; padding: 0 8px 8px 8px; }
     /* Fixed header table (outside the scroll area). scrollbar-gutter:stable on
        both wraps reserves an equal right-side gutter so the header columns line
@@ -1073,6 +1087,12 @@ <h1 style="margin:0;flex:0 0 auto">SENTINEL NODE TEST</h1>
       <div class="glass-panel log-container">
         <div class="panel-header">
           <div class="panel-title">Live Log</div>
+          <span class="log-filters" id="logFilters">
+            <span class="log-filter-btn active" data-lf="all"    onclick="setLogFilter('all')">ALL</span>
+            <span class="log-filter-btn"        data-lf="events" onclick="setLogFilter('events')">EVENTS</span>
+            <span class="log-filter-btn"        data-lf="sys"    onclick="setLogFilter('sys')">SYS</span>
+            <span class="log-filter-btn"        data-lf="node"   onclick="setLogFilter('node')">NODE</span>
+          </span>
         </div>
         <div class="logs" id="logBody"></div>
       </div>
@@ -1440,7 +1460,8 @@ <h1 style="margin:0;flex:0 0 auto">SENTINEL NODE TEST</h1>
           if (msg.result) { upsertLocal(msg.result); addSingleRow(msg.result); }
           applyState();
         } else if (msg.type === 'log') {
-          appendLog(msg.msg);
+          // Live lines carry a server-sent category; prefer it over re-deriving.
+          appendLog(msg.msg, msg.cat);
         }
       };
       eventSource.onerror = () => {
@@ -2036,18 +2057,56 @@ <h1 style="margin:0;flex:0 0 auto">SENTINEL NODE TEST</h1>
       prepend ? tbody.insertBefore(tr, tbody.firstChild) : tbody.appendChild(tr);
     }
 
-    function appendLog(msg) {
+    // ─── Live Log category filter ────────────────────────────────────────────
+    // Every log line gets exactly ONE category: 'events' | 'sys' | 'node'.
+    // First match wins, EVENTS → SYS → NODE. These keyword lists MUST stay
+    // byte-identical to server.js's classifyLogCategory() so categorization is
+    // consistent between live SSE lines and replayed init buffer lines.
+    function logCategory(msg) {
+      const s = String(msg == null ? '' : msg);
+      const EVENTS = ['Starting Test', 'Resuming Test', 'Stop requested', '⏹', 'Loop continues', '♾', 'Deleted Test', '🗑', 'Saved', 'Loaded Test', '📂', 'DNS', '🔧', 'On-chain reporting', 'On-chain report posted', 'Setting up wallet', '🔑', 'Log file', '📝', 'subscribing', '📋', 'SDK switched', 'Broadcast'];
+      const SYS = ['baseline', 'Baseline', 'Balance', '💰', 'internet', 'Internet', 'connectivity', '🌐', 'Transport cache', '🧠', 'Fetching node list', '🔍', 'V2Ray:', 'WireGuard:', 'Admin:', 'Cloudflare', 'Discovered', 'active plans', 'online scan', 'Scanning'];
+      for (const k of EVENTS) if (s.includes(k)) return 'events';
+      for (const k of SYS) if (s.includes(k)) return 'sys';
+      return 'node';
+    }
+
+    let _logFilter = 'all'; // 'all' | 'events' | 'sys' | 'node'
+
+    function setLogFilter(f) {
+      _logFilter = f;
+      document.querySelectorAll('#logFilters .log-filter-btn').forEach(b => {
+        b.classList.toggle('active', b.dataset.lf === f);
+      });
+      const body = document.getElementById('logBody');
+      if (!body) return;
+      for (const row of body.children) {
+        row.style.display = _logEntryMatches(row, f) ? '' : 'none';
+      }
+      body.scrollTop = body.scrollHeight;
+    }
+
+    function _logEntryMatches(row, f) {
+      if (f === 'all') return true;
+      return (row.dataset.cat || 'node') === f;
+    }
+
+    // `cat` is the server-sent category for live SSE lines; replayed init buffer
+    // lines arrive as plain strings (no cat), so re-derive via logCategory().
+    function appendLog(msg, cat) {
       const body = document.getElementById('logBody');
       const div = document.createElement('div');
       let cls = '';
       if (/⚠|warn|pause|insufficient/i.test(msg)) cls = 'log-warn';
       else if (/✅|complete|✓|success/i.test(msg)) cls = 'log-ok';
       else if (/error|fail|ERR/i.test(msg)) cls = 'log-err';
       div.className = 'log-entry ' + cls;
+      div.dataset.cat = cat || logCategory(msg);
       const ts = new Date().toLocaleTimeString('en-US', { hour12: false });
       const escaped = String(msg).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;');
       const linkified = escaped.replace(/(https?:\/\/[^\s<]+)/g, (u) => `<a href="${u}" target="_blank" rel="noopener" style="color:var(--accent);text-decoration:underline">${u}</a>`);
       div.innerHTML = `<span class="log-time">${ts}</span>` + linkified;
+      if (!_logEntryMatches(div, _logFilter)) div.style.display = 'none';
       body.appendChild(div);
       body.scrollTop = body.scrollHeight;
       if (body.children.length > 500) body.removeChild(body.firstChild);

audit/pipeline.js

@@ -592,7 +592,10 @@ export async function runAudit(resume, state, broadcast, preloadedNodes = null,
   const origBroadcast = broadcast;
   broadcast = (type, data) => {
     origBroadcast(type, data);
-    if (type === 'log' && data?.msg) logLine(data.msg);
+    // The per-run audit log is the TEST log (SYS + NODE). Lifecycle EVENTS live
+    // in results/events.log instead. origBroadcast runs first and sets data.cat,
+    // so this tee only writes non-events lines into runs/test-NNN/audit.log.
+    if (type === 'log' && data?.msg && data.cat !== 'events') logLine(data.msg);
   };
 
   broadcast('log', { msg: `📝 Log file: results/${path.basename(auditLogPath)}${resume ? ' (resumed — appending)' : ''}` });

server.js

@@ -285,10 +285,56 @@ function saveStateSnapshot(force = false) {
 // lands inside the 5s throttle window.
 function flushStateSnapshot() { saveStateSnapshot(true); }
 
+// ─── Log categorization ──────────────────────────────────────────────────────
+// Every log line gets exactly ONE category: 'events' | 'sys' | 'node'.
+//   EVENTS — operator/lifecycle (start/stop/save/load, on-chain, wallet, DNS…)
+//   SYS    — in-run diagnostics (baseline, balance, connectivity, scan…)
+//   NODE   — per-node results incl. failures (default).
+// First match wins, checked in EVENTS → SYS → NODE order. The 📡 emoji is shared
+// by on-chain (events) and baseline (sys), so classify by the WORDS, not emoji.
+// IMPORTANT: keep these keyword lists byte-identical to admin.html's logCategory().
+function classifyLogCategory(msg) {
+  const s = String(msg == null ? '' : msg);
+  // NOTE: no bare '💾' — it also prefixes the per-node "💾 Cached:" transport
+  // line; 'Saved' already covers the lifecycle save lines. 'Resuming Test' is a
+  // lifecycle sibling of 'Starting Test'.
+  const EVENTS = ['Starting Test', 'Resuming Test', 'Stop requested', '⏹', 'Loop continues', '♾', 'Deleted Test', '🗑', 'Saved', 'Loaded Test', '📂', 'DNS', '🔧', 'On-chain reporting', 'On-chain report posted', 'Setting up wallet', '🔑', 'Log file', '📝', 'subscribing', '📋', 'SDK switched', 'Broadcast'];
+  const SYS = ['baseline', 'Baseline', 'Balance', '💰', 'internet', 'Internet', 'connectivity', '🌐', 'Transport cache', '🧠', 'Fetching node list', '🔍', 'V2Ray:', 'WireGuard:', 'Admin:', 'Cloudflare', 'Discovered', 'active plans', 'online scan', 'Scanning'];
+  for (const k of EVENTS) if (s.includes(k)) return 'events';
+  for (const k of SYS) if (s.includes(k)) return 'sys';
+  return 'node';
+}
+
+// EVENTS persist to a file (separate from per-run runs/test-NNN/audit.log), with
+// a simple 1-file rotation at ~2MB so it can't grow unbounded.
+const EVENTS_LOG_FILE = path.join(__dirname, 'results', 'events.log');
+const EVENTS_LOG_MAX_BYTES = 2 * 1024 * 1024;
+function appendEventLog(msg) {
+  try {
+    try {
+      const st = _statSync(EVENTS_LOG_FILE);
+      if (st && st.size > EVENTS_LOG_MAX_BYTES) {
+        _rfs2(EVENTS_LOG_FILE, EVENTS_LOG_FILE + '.1');
+      }
+    } catch (e) {
+      // ENOENT (no file yet) is expected — only log genuine stat/rotate errors.
+      if (e && e.code !== 'ENOENT') console.error('[events.log] rotate failed:', e.message);
+    }
+    _afs(EVENTS_LOG_FILE, `[${new Date().toISOString()}] ${msg}\n`, 'utf8');
+  } catch (e) {
+    console.error('[events.log] append failed:', e.message);
+  }
+}
+
 function broadcast(type, data = {}) {
   if (type === 'log' && data.msg) {
+    // Tag the live SSE 'log' event with a category so admin/live can filter
+    // without re-deriving it. logBuffer stays an array of strings (the client
+    // re-classifies replayed init lines). Set BEFORE emitter.emit below.
+    data.cat = data.cat || classifyLogCategory(data.msg);
     logBuffer.push(data.msg);
     if (logBuffer.length > LOG_BUFFER_MAX) logBuffer.shift();
+    if (data.cat === 'events') appendEventLog(data.msg);
   }
   if (type === 'state' || type === 'result') saveStateSnapshot();
   // NOTE: spread `data` FIRST so a payload field named `type` (e.g. the node's
@@ -509,7 +555,7 @@ function hydrateLogBufferFromFile(filePath) {
 }
 
 // ─── Test Run Management ─────────────────────────────────────────────────────
-import { readFileSync as _rfs, writeFileSync as _wfs, mkdirSync as _mkd, existsSync as _ex, readdirSync as _rd, copyFileSync as _cp, rmSync as _rm } from 'fs';
+import { readFileSync as _rfs, writeFileSync as _wfs, mkdirSync as _mkd, existsSync as _ex, readdirSync as _rd, copyFileSync as _cp, rmSync as _rm, statSync as _statSync, renameSync as _rfs2, appendFileSync as _afs } from 'fs';
 
 const RUNS_DIR = path.join(__dirname, 'results', 'runs');
 const RUNS_INDEX = path.join(RUNS_DIR, 'index.json');
@@ -1812,6 +1858,7 @@ function sanitizeForPublic(evt) {
   if (evt.errorCode != null)  safe.errorCode  = evt.errorCode;
   if (evt.testedAt != null)   safe.testedAt   = evt.testedAt;
   if (evt.msg != null)        safe.msg        = String(evt.msg).slice(0, 400);
+  if (evt.cat != null)        safe.cat        = evt.cat;
   if (evt.baselineMbps != null) safe.baselineMbps = evt.baselineMbps;
   if (evt.skipped === true)   safe.skipped    = true;
   if (evt.inPlan === true)    safe.inPlan     = true;