0456 build: drop Apache-2.0 zlog dependency and keep nwlog internal

.gitmodules

@@ -29,9 +29,6 @@
 [submodule "third_party/flaim"]
 	path = third_party/flaim
 	url = git@gitea.disconnected-by-peer.at:mars_nwe/mars-flaim.git
-[submodule "third_party/zlog"]
-	path = third_party/zlog
-	url = https://github.com/HardySimpson/zlog.git
 [submodule "third_party/unicodeTables"]
 	path = third_party/unicodeTables
 	url = git@gitea.disconnected-by-peer.at:mars_nwe/mars-unicode-tables.git

AI.md

@@ -47,7 +47,7 @@ unfinished work out of `TODO.md` merely because its architecture is documented.
 
 Latest patch marker expected in an up-to-date bundle:
 
-- `0455 docs: plan shared libnwcore ini reader writer`
+- `0456 build: drop Apache-2.0 zlog dependency and keep nwlog internal`
 
 When a later chat receives a new `mars-nwe-master` bundle, compare `git log -1`
 with this marker.  If the uploaded bundle already contains this commit subject,
@@ -67,14 +67,15 @@ The active line is expected to include:
 
 Last generated patch:
 
-- `0455 docs: plan shared libnwcore ini reader writer`
+- `0456 build: drop Apache-2.0 zlog dependency and keep nwlog internal`
 
 Purpose of that patch:
 
-- Record that INI parsing/writing belongs in a shared `libnwcore` API, not in
-  `nwtui` or `nwi18n`.  Server processes, `nwsetup`, `nwtoolbox` applets and
-  optional translation catalogs should use one `nw_ini_*` policy layer.  `minIni`
-  is the preferred small C read/write candidate to audit before any later import.
+- Remove the unused bundled zlog build dependency and the offline zlog staging
+  step.  zlog is Apache-2.0 and therefore not a GPL-2.0-only core target.
+  Keep `nwlog` as the stable project facade and plan small in-tree backends for
+  stderr/file, journald-friendly output, syslog, GELF and JSON-lines/Filebeat
+  style forwarding.
 
 Rejected or superseded patches that must not be reused as-is:
 
@@ -100,8 +101,10 @@ map to `nwlog_detail()` later.  `nwlog_detail()` is not part of the normal
 `1..5` threshold ladder: normal builds return `0`, while `MAINTAINER_BUILD`
 builds may emit detail whenever such a call site is reached.  No INI option may
 enable it in a normal build.
-`nwlog`/zlog remains a facade/backend plan, not a reason to call zlog directly.
-See `include/nwlog.h` and `doc/LOG_LEVEL_AUDIT.md`.
+`nwlog` is the facade/backend plan.  Do not add zlog calls or reintroduce a
+zlog build dependency; zlog is Apache-2.0 and is not compatible with the
+repository's GPL-2.0-only core policy.  See `include/nwlog.h` and
+`doc/LOG_LEVEL_AUDIT.md`.
 
 Before namespace code changes, keep the terminal-tooling decision in mind when
 touching FLAIM tests or admin tools: do not add new direct `curses.h` users.
@@ -267,7 +270,6 @@ work.
   new chat or clean checkout, use this script as the first dependency/bootstrap
   step before CMake/build attempts:
   - `yyjson-0.12.0` into `third_party/yyjson`
-  - `zlog-1.2.18` into `third_party/zlog`
   - `libsodium-1.0.20` into the nested libsodium snapshot path
   - `gdbm-1.26` built locally under `.local-deps/prefix`
   - PAM and ncurses headers staged while linking to system libraries

REDESIGN.md

@@ -45,9 +45,9 @@ legacy thresholds, but write normal call sites through semantic facade levels:
 `1=error`, `2=warn`, `3=info`, `4=debug` and `5=trace`.  Legacy levels `6..99`
 collapse into a single `nwlog_detail()` maintainer-diagnostic path that is
 compiled out or returns `0` unless `MAINTAINER_BUILD` is active.  There must be
-no INI switch that enables maintainer-detail logging in production builds.  Future
-zlog integration must stay behind a wrapper rather than spreading raw `XDPRINTF`
-or zlog calls into new libraries.  Detailed observations live in
+no INI switch that enables maintainer-detail logging in production builds.  Do not add zlog as a backend target: it is Apache-2.0 and not compatible with
+the repository's GPL-2.0-only core policy.  Keep backend choices behind
+`nwlog`, and keep direct `XDPRINTF` or backend calls out of new libraries.  Detailed observations live in
 `include/nwlog.h` and `doc/LOG_LEVEL_AUDIT.md`.
 
 
@@ -2362,9 +2362,6 @@ third_party/matrixssl
   candidate crypto/TLS backend for the FLAIM CCS/NICI compatibility layer
   converted to a native standalone-and-subdirectory CMake build
 
-third_party/zlog
-  optional advanced logging backend used only through nwlog
-
 mars-tinyldap/
   forked/integrated tinyldap-derived component in the repository root
   upstream/standalone project identity remains tinyldap
@@ -2383,8 +2380,8 @@ not a promise that every compatibility layer is complete.
 
 Current source layout decisions:
 
-- `third_party/yyjson` and `third_party/zlog` remain external upstream snapshots
-  pinned by release tag in `update-submodules.sh`.
+- `third_party/yyjson` remains an external upstream snapshot pinned by release
+  tag in `update-submodules.sh`.
 - `third_party/yyjson` is being compiled into `libnwcore`; consumers should use
   the `nwcore` include namespace and link the core target instead of exposing a
   standalone yyjson API as a mars-nwe public dependency.
@@ -2430,8 +2427,8 @@ Current local dependency-test policy:
   `admin`, `directory`, and the `third_party/*` mars-maintained submodules).
 - Upstream point-release tarballs are copied only into the paths where the root
   build already expects external snapshots: `yyjson-0.12.0` into
-  `third_party/yyjson`, `zlog-1.2.18` into `third_party/zlog`, and
-  `libsodium-1.0.20` into the nested `third_party/libsodium/libsodium` source
+  `third_party/yyjson` and `libsodium-1.0.20` into the nested
+  `third_party/libsodium/libsodium` source
   directory owned by the mars-libsodium wrapper submodule.
 - `gdbm-1.26` is a local build dependency for verification.  Build it into an
   isolated prefix and pass `GDBM_INCLUDE_DIR` plus `GDBM_LIBRARY` to CMake; do
@@ -2463,11 +2460,10 @@ Terminal UI, toolbox and curses replacement plan:
   required dependency.  Catalog storage may be INI-like or generated C tables,
   but the INI parser/writer must not belong to `nwi18n`.
 - Add a shared `libnwcore` INI reader/writer API for server configuration,
-  setup/toolbox editing and optional `nwi18n` catalog loading.  Candidate
-  backend: audit `minIni` because it is small C code with read/write support;
-  import it only after verifying license/provenance compatibility with the
-  GPL-2.0-only repository.  Tools and daemons must call `nw_ini_*`, not the
-  backend directly.
+  setup/toolbox editing and optional `nwi18n` catalog loading.  The uploaded
+  `minIni` code is only an API/feature reference because it is Apache-2.0; the
+  core implementation should be small project-owned GPL-2.0-only code.  Tools
+  and daemons must call `nw_ini_*`, not any backend directly.
 - Future interactive admin tools should be one multi-call binary.  `nwtoolbox`
   opens a main menu; symlink/`argv[0]` names such as `nwsetup`, `nwfiler`,
   `nwsalvage`, `nwmetadata` and `nwbackup` enter the matching applet directly.
@@ -2724,21 +2720,28 @@ project TLS API and must not be used by mars-nwe LDAP, provider IPC, or service
 code.  MatrixSSL import and CMake conversion must be separate from the later
 FLAIM CCS/NICI implementation, so each patch stays mechanical and reviewable.
 
-### zlog dependency rule
+### Logging backend dependency rule
 
-`zlog` should be treated as an optional advanced logging backend under
-`third_party/zlog`, not as a direct API used by handlers.  The mars-nwe public
-logging API remains `include/nwlog.h`.  If zlog is enabled, it is reached through
-`src/nwlog_zlog.c` only:
+`zlog` is not a mars-nwe backend target.  It was considered for advanced
+category/rule/format routing, but it is Apache-2.0 and must not be vendored into
+this GPL-2.0-only core.  The mars-nwe public logging API remains
+`include/nwlog.h`; endpoint/provider code must not call zlog or any other
+backend directly.
+
+The preferred direction is a small project-owned backend set behind `nwlog`:
 
 ```text
-endpoint/provider code -> nwlog -> optional zlog backend
+endpoint/provider code -> nwlog -> stderr/file backend
+                              -> journald-friendly stderr backend
+                              -> optional syslog backend
+                              -> optional GELF backend
+                              -> optional JSON-lines file backend for Filebeat/Elastic Agent
 ```
 
-This keeps secret redaction, structured correlation fields, fallback logging, and
-future backend changes centralized.  zlog can provide administrator-controlled
-category/rule/format routing, but it must never receive raw decoded NCP or
-handoff payloads from bypass paths.
+GELF and JSON-lines output should be implemented by mars-nwe code when needed,
+with redaction and correlation fields applied before formatting.  Do not add a
+third-party logging router merely to regain features that `nwlog` can provide in
+a small controlled backend.
 
 ### libflaim storage engine rule
 
@@ -2868,7 +2871,7 @@ equivalent note listing:
 
 ### Forked tinyldap / nwdirectory rule
 
-`tinyldap` is different from yyjson, MatrixSSL, zlog, and libflaim.  It is not a
+`tinyldap` is different from yyjson, MatrixSSL, and libflaim.  It is not a
 small library dependency and it is not merely a storage engine.  It becomes the
 LDAP service component used by mars-nwe, so it follows the existing root-level
 component pattern used by `admin`, `dosutils`, `mail`, and `smart`.
@@ -3508,7 +3511,7 @@ Use that code to understand SPX headers, connection IDs, sequence/ack/allocation
 fields, watchdogs, retransmit queues and disconnect handling; do not compile the
 old kernel code or copy its old locking/socket architecture into Mars.
 
-## Logging subsystem and optional zlog backend
+## Logging subsystem and project-owned backends
 
 The dispatch, provider, directory, and transport redesigns all need better
 logging than scattered ad-hoc debug messages.  The goal is not only prettier
@@ -3578,7 +3581,7 @@ semantic form:
 ```ini
 [logging]
 level = info          ; off|0, error|1, warn|12, info|123, debug|1234, trace|12345
-backend = simple      ; simple|syslog|zlog later; facade API unchanged
+backend = simple      ; simple|syslog|journald|gelf|jsonfile later; facade API unchanged
 
 [logging.process.nwserv]
 level = info
@@ -3603,7 +3606,7 @@ means that process emits `error`, `warn`, `info`, `debug`, and `trace`
 events.  A process override replaces only
 that process threshold; missing process entries inherit `[logging] level`.  The
 first implementation should not require per-category thresholds.  Categories
-are still recorded on every event for routing, filtering, and later zlog
+are still recorded on every event for routing, filtering, and later backend
 configuration, but the stable configuration contract is global plus process
 overrides first.
 
@@ -3691,12 +3694,13 @@ include/nwlog.h   public internal logging facade used by mars-nwe modules
 src/nwlog.c          facade implementation, redaction, common formatting
 src/nwlog_simple.c   simple stderr/stdout/file/callback backend
 src/nwlog_syslog.c   optional syslog(3)-style backend derived from simple
-src/nwlog_zlog.c     optional zlog backend, if enabled at build time
+src/nwlog_gelf.c     optional GELF UDP/TCP backend
+src/nwlog_jsonfile.c optional JSON-lines file backend for Filebeat/Elastic Agent
 ```
 
 Protocol handlers, providers, `nwconn`, `nwserv`, `nwbind`, future `nwqueue`,
 `nwdirectory`, and `nwnds` should include `include/nwlog.h` only.  They should
-not include zlog headers or call zlog macros directly.
+not include backend headers or call backend-specific macros directly.
 
 That facade can initially keep using the existing mars-nwe logging functions,
 `stderr`, or a small vendored backend.  Later it may grow simple and advanced
@@ -3715,88 +3719,51 @@ stable severities.  The exception is explicit and narrow: legacy high levels
 `6..99` should migrate, when still needed, to `nwlog_detail()`, a
 maintainer-build-only API for unsafe deep diagnostics.
 
-There are three useful backend classes:
+There are several useful backend classes, but they should be implemented as
+small project-owned backends rather than through zlog:
 
-1. **Simple built-in backend.**  A tiny C backend derived from `rxi/log.c` can be
-   imported into the source tree for simple builds.  It should be treated as
-   vendored implementation code, renamed and namespaced for mars-nwe.  The base
-   upstream code only provides local-style logging primitives such as stderr,
-   file output, and callback hooks; it is not an out-of-the-box syslog, GELF, or
-   remote routing solution.  That is fine for the built-in backend, but mars-nwe
-   must adapt it for the project requirements: redaction hooks, category mapping,
-   context/correlation fields, optional file output, and journald-friendly
-   stderr/stdout formatting should live behind `nwlog`, not in endpoint code.
+1. **Simple built-in backend.**  A small in-tree backend handles stderr/stdout,
+   optional local file output and callback hooks.  It should emit structured,
+   grep-friendly lines so systemd services can rely on journald capture without
+   linking to libsystemd.
+2. **Native journald backend, optional.**  If native journald fields are wanted,
+   add an optional build path using `sd_journal_send()` behind `nwlog`.  The
+   default systemd path remains stderr/stdout capture, so libsystemd is never a
+   hard dependency.
+3. **Syslog bridge backend.**  Classic syslog output should live in its own
+   backend using `openlog()`, `syslog()` and `closelog()` or the platform
+   equivalent.
+4. **GELF backend.**  Implement a small GELF formatter/sender in mars-nwe when
+   needed, initially using UDP/TCP sockets.  No external Graylog library is
+   required.
+5. **JSON-lines backend.**  Write one JSON event per line to a file so Filebeat
+   or Elastic Agent can ship logs.  Do not implement the Beats protocol directly
+   inside mars-nwe.
 
-   This backend is the right default for systemd deployments: services can log to
-   stderr/stdout and let journald capture, timestamp, rotate, and forward logs
-   according to the unit configuration.  mars-nwe should still emit structured,
-   grep-friendly lines so `journalctl -u ...` remains useful without requiring a
-   heavier routing backend.
-
-   The project layout should make the imported code clearly internal, for
-   example:
-
-   ```text
-   include/nwlog_simple.h   internal/simple backend declarations, if needed
-   src/nwlog_simple.c       imported/adapted rxi/log.c-style backend
-   ```
-
-   Imported symbols such as `log_info`, `log_error`, or `log_add_fp` must be
-   renamed, hidden, or made `static` so they do not leak into the global mars-nwe
-   namespace.  Public entry points should look like `nwlog_simple_init()` and
-   `nwlog_simple_emit()`.
-2. **Syslog bridge backend.**  If classic syslog integration is wanted, do not
-   overload the simple backend with syslog-specific behavior.  Instead clone the
-   adapted simple backend structure into a separate implementation:
-
-   ```text
-   include/nwlog_syslog.h   internal syslog backend declarations, if needed
-   src/nwlog_syslog.c       syslog(3)-style backend derived from simple
-   ```
-
-   `nwlog_syslog.c` may reuse the same level/category mapping, redaction hooks,
-   event formatting helpers, and callback shape as `nwlog_simple.c`, but its
-   output path should be explicit: `openlog()`, `syslog()`, and `closelog()` or
-   the platform equivalent.  This keeps `backend = simple` predictable for
-   stderr/stdout/file/journald use, while `backend = syslog` clearly means the
-   traditional syslog path.  Provider and endpoint code must not care which of
-   the two is active.
-3. **Advanced routing backend.**  `zlog` remains the preferred candidate for
-   administrator-controlled routing because it is a C logging library with
-   category, format, and rule based configuration.  That model fits mars-nwe
-   well: code can emit category-specific events such as `ncp`, `handoff`,
-   `queue`, `directory`, `auth`, or `transport`, while the administrator decides
-   in the logging configuration whether those categories go to a file,
-   stdout/stderr, syslog-style output, a pipe, or an external log-forwarder path.
-   The zlog project documentation describes these three core concepts as
-   categories, formats, and rules, where rules bind a category/level to an output
-   and format.
-
-Before choosing any backend, packaging, license compatibility, portability, and
-maintenance state still need to be verified for the target distributions.  The
-architecture must not depend on one backend being available.
+Before choosing any optional backend, packaging, license compatibility,
+portability, and maintenance state still need to be verified for the target
+distributions.  The architecture must not depend on one backend being available.
 
 The preferred dependency shape is therefore:
 
 ```text
 mars-nwe code
   -> nwlog facade
-       -> simple backend: src/nwlog_simple.c from imported/adapted rxi/log.c-style code
-            -> stderr/stdout for systemd/journald, optional local file/callback
-       -> syslog backend: src/nwlog_syslog.c derived from the simple backend shape
-            -> classic syslog(3) output when explicitly configured
-       -> optional advanced backend: src/nwlog_zlog.c using zlog
-            -> admin-configured zlog rules/formats/outputs
+       -> simple backend: stderr/stdout for systemd/journald capture, optional local file/callback
+       -> native journald backend: optional libsystemd build path
+       -> syslog backend: classic syslog(3) output when explicitly configured
+       -> gelf backend: project-owned GELF formatter/sender
+       -> jsonfile backend: JSON-lines file for Filebeat/Elastic Agent
 ```
 
-Do not make endpoint code depend on `zlog_category_t` or zlog macros directly.
+Do not make endpoint code depend on any backend-specific type or macro.
 Keeping `nwlog` in the middle gives mars-nwe one place to:
 
 - inject correlation fields such as `connection_id`, `request_id`, `sequence`,
   `task_id`, provider name, and NCP selector path;
 - redact or suppress sensitive fields before formatting;
 - enforce no-secret logging rules even when logs are routed to remote systems;
-- keep a fallback backend for minimal builds or platforms without zlog;
+- keep a fallback backend for minimal builds or platforms without optional logging integrations;
 - change or add backends later without touching protocol handlers.
 
 Remote logging is useful, but it must be treated as a security boundary.  A GELF
@@ -3812,11 +3779,10 @@ include a switch for maintainer-detail output:
 
 ```ini
 [logging]
-backend = simple        ; simple, syslog, zlog
+backend = simple        ; simple, journald, syslog, gelf, jsonfile
 level = info
 legacy_threshold = 1    ; compatibility with INI 100..106 style debug levels
 redact_secrets = yes
-config = /etc/mars-nwe/zlog.conf
 
 [logging.category]
 ncp = info
@@ -3876,7 +3842,7 @@ WARN NCP 23/130 LAYOUT-MISMATCH sdk="32-bit JobNumber" code="16-bit parser"
 ```
 
 Until the `nwlog` facade exists, endpoint-dispatch cleanup should still reuse
-existing mars-nwe logging functions.  Do not add direct zlog calls or a parallel
+existing mars-nwe logging functions.  Do not add direct backend calls or a parallel
 logging path just to support one endpoint family.  New namespace/libnwfs code may
 wrap old logging locally, but the wrapper must keep the legacy `1..5` threshold
 meaning and must not introduce raw/sensitive traces.

TODO.md

@@ -167,8 +167,8 @@ Follow-up:
   consumer remains.
 - Keep the offline dependency bootstrap aligned with the root/submodule layout:
   `mars-nwe-master` is the root, uploaded `mars-*` bundles populate their
-  configured submodule paths, `yyjson`/`zlog`/nested `libsodium` release tarballs
-  go into the existing third-party snapshot locations, `gdbm` is locally built,
+  configured submodule paths, `yyjson`/nested `libsodium` release tarballs go
+  into the existing third-party snapshot locations, `gdbm` is locally built,
   and PAM/ncurses provide headers only while linking to system libraries.
 
 ### 3. Administration, queues, printing and operational behaviour
@@ -325,4 +325,7 @@ Concrete follow-up for the future facade:
 - make maintainer builds allow `nwlog_detail()` independently from the normal
   configured `1..5` threshold;
 - do not expose maintainer-detail logging through `nw.ini`;
-- remove obsolete high-level traces instead of preserving all of them.
+- remove obsolete high-level traces instead of preserving all of them;
+- keep zlog out of the build and dependency plan because it is Apache-2.0;
+- implement the default `nwlog` backend in-tree, then add optional project-owned
+  journald/syslog/GELF/JSON-lines backends behind the same facade as needed.

doc/LOG_LEVEL_AUDIT.md

@@ -149,17 +149,22 @@ instead of translating by the old number alone:
 - use a debug mask for noisy categories that developers may want independently
   of the numeric threshold.
 
-The long-term `nwlog`/zlog bridge should preserve this compatibility initially:
+The long-term `nwlog` facade should preserve this compatibility initially:
 
 - INI entries `100` through `106` remain accepted as legacy thresholds;
 - the optional mask token remains accepted for `MDEBUG` categories;
-- zlog severities should be a presentation layer, not a silent semantic rewrite
-  of old `XDPRINTF` call sites;
+- backend presentation severities are a formatting/routing layer, not a silent
+  semantic rewrite of old `XDPRINTF` call sites;
 - new libnwfs/namespace code should use a small wrapper that can later map
   `1..5` to presentation severities without spreading `XDPRINTF` further;
 - the wrapper should treat legacy numbers as verbosity thresholds first and only
   then map them to backend severities/categories.
 
+`zlog` is not the advanced-backend target anymore: it is Apache-2.0 and must not
+be vendored into this GPL-2.0-only core.  Future routing should use small
+project-owned backends behind `nwlog` such as simple stderr/file, optional
+journald, syslog, GELF and JSON-lines output.
+
 A practical first mapping for the future facade is:
 
 | New facade call | Numeric level | Backend presentation hint |

doc/NWCORE_INI_PLAN.md

@@ -25,9 +25,8 @@ The same project API should support:
 The INI API belongs in `libnwcore`, not in `nwtui` or an individual tool:
 
 ```text
-third_party/minini/        candidate upstream reader/writer, if vendored later
 include/core/ini.h         public mars-nwe core INI API
-src/core/ini.c             wrapper/adaptation and policy
+src/core/ini.c             project-owned parser/writer and policy
 ```
 
 Server code, `nwtoolbox`, `nwsetup`, `nwfiler`, `nwsalvage` and `nwi18n` should
@@ -37,14 +36,14 @@ centralized.
 
 ## Candidate backend
 
-`minIni` is the current preferred candidate to audit because it is small,
-C-based and includes both read and write operations.  Before importing it, check
-and preserve its exact upstream license/provenance files and only import it if
-that license is compatible with the repository's GPL-2.0-only policy.
+The uploaded `minIni` source is technically a good reference for the desired
+feature set, but it is Apache-2.0 and must not be imported into this
+GPL-2.0-only core.  Treat it as an API/feature reference only.
 
-`inih` remains a useful fallback candidate for parsing only, but using it would
-require more project-owned writer logic.  A parser-only backend is not enough for
+`inih` remains a useful parser reference, but parser-only code is not enough for
 `nwsetup`, because setup and toolbox applets must be able to update INI files.
+The preferred implementation is therefore a small project-owned `nw_ini`
+reader/writer in `libnwcore`, with GPL-2.0-only provenance.
 
 ## Project API shape
 

prepare-local-deps.sh

@@ -144,7 +144,6 @@ clone_bundle third_party/flaim "$(find_one 'mars-flaim-master*.bundle')"
 clone_bundle third_party/unicodeTables "$(find_one 'mars-unicode-tables-master*.bundle')"
 
 copy_tree_from_tar "$(find_one 'yyjson-0.12.0.tar*.gz')" third_party/yyjson
-copy_tree_from_tar "$(find_one 'zlog-1.2.18.tar*.gz')" third_party/zlog
 copy_tree_from_tar "$(find_one 'libsodium-1.0.20.tar*.gz')" third_party/libsodium/libsodium
 
 build_gdbm "$(find_one 'gdbm-1.26.tar*.gz')"

src/core/CMakeLists.txt

@@ -1,9 +1,5 @@
 find_package(Threads REQUIRED)
 
-set(NWCORE_ZLOG_DIR
-    "${CMAKE_SOURCE_DIR}/third_party/zlog"
-    CACHE PATH "Path to bundled zlog source tree")
-
 set(NWCORE_YYJSON_DIR
     "${MARS_NWE_YYJSON_SOURCE_DIR}"
     CACHE PATH "Path to bundled yyjson source tree")
@@ -12,10 +8,6 @@ set(NWCORE_UNICODE_TABLES_DIR
     "${CMAKE_SOURCE_DIR}/third_party/unicodeTables"
     CACHE PATH "Path to bundled mars-unicode-tables source tree")
 
-if(NOT EXISTS "${NWCORE_ZLOG_DIR}/src/zlog.h")
-    message(FATAL_ERROR "Bundled zlog is required. Run: git submodule update --init --recursive third_party/zlog")
-endif()
-
 if(NOT EXISTS "${NWCORE_YYJSON_DIR}/src/yyjson.c" OR
    NOT EXISTS "${NWCORE_YYJSON_DIR}/src/yyjson.h")
     message(FATAL_ERROR "Bundled yyjson is required. Run: git submodule update --init --recursive third_party/yyjson")
@@ -27,13 +19,6 @@ if(NOT EXISTS "${NWCORE_UNICODE_TABLES_DIR}/TAB/unicodeTables.c" OR
     message(FATAL_ERROR "Bundled Unicode/codepage tables are required. Run: git submodule update --init --recursive third_party/unicodeTables")
 endif()
 
-file(GLOB NWCORE_ZLOG_SOURCES CONFIGURE_DEPENDS
-    "${NWCORE_ZLOG_DIR}/src/*.c")
-
-list(REMOVE_ITEM NWCORE_ZLOG_SOURCES
-    "${NWCORE_ZLOG_DIR}/src/zlog_win.c"
-    "${NWCORE_ZLOG_DIR}/src/zlog-chk-conf.c")
-
 set(NWCORE_BUILD_INCLUDE_DIR "${CMAKE_BINARY_DIR}/include/nwcore")
 file(MAKE_DIRECTORY "${NWCORE_BUILD_INCLUDE_DIR}")
 
@@ -129,10 +114,6 @@ configure_file(
     "${CMAKE_SOURCE_DIR}/include/core/enable.h"
     "${NWCORE_BUILD_INCLUDE_DIR}/enable.h"
     COPYONLY)
-configure_file(
-    "${NWCORE_ZLOG_DIR}/src/zlog.h"
-    "${NWCORE_BUILD_INCLUDE_DIR}/zlog.h"
-    COPYONLY)
 configure_file(
     "${NWCORE_YYJSON_DIR}/src/yyjson.h"
     "${NWCORE_BUILD_INCLUDE_DIR}/yyjson.h"
@@ -206,7 +187,6 @@ set(NWCORE_IMPORTED_NSS_SOURCES
 
 add_library(nwcore SHARED
     core.c
-    ${NWCORE_ZLOG_SOURCES}
     ${NWCORE_IMPORTED_NSS_SOURCES}
     "${NWCORE_UNICODE_TABLES_DIR}/TAB/unicodeTables.c"
     "${NWCORE_UNICODE_TABLES_DIR}/TAB/codepageTables.c"
@@ -238,7 +218,6 @@ target_include_directories(nwcore
     PRIVATE
         "${CMAKE_SOURCE_DIR}/include/core"
         "${NWCORE_UNICODE_TABLES_DIR}/TAB"
-        "${NWCORE_ZLOG_DIR}/src"
         "${NWCORE_YYJSON_DIR}/src")
 
 target_link_libraries(nwcore PUBLIC Threads::Threads)

third_party/README.md

@@ -166,19 +166,12 @@ directly.  Access should go through the future `libnwdirectory` C API.  The
 imported FLAIM libraries should be renamed to `libnwflaimtk` and `libnwflaim`
 to avoid collisions with a system FLAIM installation.
 
-## Planned: zlog
+## Logging backend policy
 
-zlog is the planned optional advanced logging backend.  If added, it should live
-under `third_party/zlog` and be used only through the mars-nwe `nwlog` facade:
-
-```text
-include/nwlog.h
-src/nwlog.c
-src/nwlog_zlog.c
-```
-
-Endpoint and provider code must not call zlog APIs directly.  This keeps secret
-redaction, request correlation fields, and fallback logging centralized.
+Logging is no longer planned as a third-party backend import.  The previously
+considered zlog dependency is Apache-2.0 and must not be vendored into the
+GPL-2.0-only core.  mars-nwe logging should go through `include/nwlog.h` and
+small in-tree backends owned by the project.
 
 ## Forked components are not third_party
 

update-submodules.sh

@@ -15,7 +15,6 @@ set -eu
 # PATH is relative to the mars-nwe root.
 # -----------------------------------------------------------------------------
 EXTERNAL_TAG_PINS='third_party/yyjson=0.12.0
-third_party/zlog=1.2.18
 third_party/libsodium/libsodium=1.0.20-FINAL'
 
 # -----------------------------------------------------------------------------