Updates

docs/CONFIGURATION.md

@@ -40,7 +40,7 @@ Treat `SERVER_SEED` like a root password. Prefer `pd1.` invites for operators.
 | `PEARDATA_STORAGE` | — | Electron/Pear storage dir override (bookmarks prefer `Pear.config.storage`) |
 | `PEARDATA_RATE_LIMIT_RPM` | `120` | Per-peer RPC requests per minute |
 | `PEARDATA_MAX_RECONNECT` | `20` | Client manager reconnect attempts per peer |
-| `PEARDATA_JOURNAL` | off | `1` enables host `journalctl` for Logs / `queryLogs` (Linux; needs journal ACL) |
+| `PEARDATA_JOURNAL` | **on** | Host `journalctl` for Logs / `queryLogs` (Linux). Set `0` to disable. Installer adds `peardata` to `systemd-journal` and sets unit `SupplementaryGroups` |
 
 ```
 data/

docs/GETTING-STARTED.md

@@ -110,12 +110,14 @@ npm start
 
 ## systemd (Linux)
 
-Prefer the [one-line installer](#one-line-installer-recommended) (`--server`). It installs the Bare binary and writes `peardata.service`.
+Prefer the [one-line installer](#one-line-installer-recommended) (`--server`). It installs the Bare binary, writes `peardata.service`, adds `peardata` to **`systemd-journal`**, and enables host journal for the Logs tab (`PEARDATA_JOURNAL=1`).
 
 Manual (matches installer layout):
 
 ```bash
 # After placing peardata-server + .env under /opt/peardata
+sudo useradd --system --home /opt/peardata --shell /usr/sbin/nologin peardata  # if needed
+sudo usermod -aG systemd-journal peardata
 sudo cp deploy/peardata.service /etc/systemd/system/
 sudo systemctl daemon-reload
 sudo systemctl enable --now peardata

docs/PROTOCOL.md

@@ -82,7 +82,7 @@ REST parity: `GET /api/v*/weights`. Engine: `server/services/weights.js`.
 | `priority` / `unit` | Journal filters |
 | `limit` / `cursor` | Cap (≤2000) + pagination offset |
 
-Journal requires `PEARDATA_JOURNAL=1` on Linux. REST: `GET /api/v*/logs`. Engine: `server/services/logs.js`. UI: [user-guide/logs.md](../user-guide/logs.md).
+Journal is **enabled by default** on Linux (`PEARDATA_JOURNAL=0` to disable). Installer grants `systemd-journal` to the agent user. REST: `GET /api/v*/logs`. Engine: `server/services/logs.js`. UI: [user-guide/logs.md](../user-guide/logs.md).
 
 ### Live subscriptions
 

docs/SECURITY.md

@@ -47,7 +47,7 @@
 - [ ] Run under systemd with `ProtectSystem` / `NoNewPrivileges` (see `deploy/`)
 - [ ] Do not embed seed in frontend builds, CI logs, or crash reports
 - [ ] Review `LOG_LEVEL=debug` before production (avoid verbose auth noise)
-- [ ] Keep `PEARDATA_JOURNAL` off unless operators need host logs; journal access is **admin-only** over P2P and can expose secrets from other units — add `SupplementaryGroups=systemd-journal` only when enabling
+- [ ] Journal is **on by default** (admin-only over P2P); it can expose secrets from other units — set `PEARDATA_JOURNAL=0` if you do not want host log access
 - [ ] Keep Pear / dependency updates current (`npm outdated`)
 
 ## Threat notes
@@ -86,7 +86,7 @@ Implementation: `shared/crypto-auth.js`.
 | `.env` | Critical | Never commit; backup offline |
 | `data/peer-policy.json` | High | Contains roles & JTIs |
 | `data/audit.log` | Medium | Peer activity metadata; readable via Logs/audit (admin) |
-| Host journal (`PEARDATA_JOURNAL`) | High | May include secrets from other units; admin-only; off by default |
+| Host journal (`PEARDATA_JOURNAL`) | High | May include secrets from other units; admin-only; **on by default** (disable with `=0`) |
 | `identity.json` | High for that user | Per-machine client secret |
 | Release tarballs | Low | Source only; no secrets |
 

docs/TESTING.md

@@ -89,7 +89,7 @@ When adding an RPC method:
 | Metric Correlations | Charts → Correlate → brush ≥15s → Find Correlations → wall filters; Clear restores; Related ⇢ still works |
 | Charts Filters | Filters closed → full-width wall; `/` opens search; chip when filter active; Esc closes panel |
 | Weights REST | `curl -sG 'http://127.0.0.1:19999/api/v3/weights' --data-urlencode 'method=volume' --data-urlencode 'after=-60' --data-urlencode 'before=0'` |
-| Logs | Logs tab → Anomalies search; admin → Audit; with `PEARDATA_JOURNAL=1` → Journal |
+| Logs | Logs tab defaults to Journal (admin); Anomalies for viewers; Audit admin-only |
 | Logs REST | `curl -sG 'http://127.0.0.1:19999/api/v3/logs' --data-urlencode 'source=anomaly' --data-urlencode 'limit=20'` |
 
 ## Soak test