Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@internal/cmd/context.go`:
- Around line 215-229: The code currently calls fileeventstore.New
unconditionally when cfg.EventStore.Enabled is true, causing unnecessary disk
work even when the process is on the shared-nothing worker “fast path”; update
the guard so that before invoking fileeventstore.New you check for the
shared-nothing worker fast-path/early-return condition (the worker fast-path
check used elsewhere in this file) and skip event store initialization when that
condition is true, otherwise proceed to call fileeventstore.New and then
eventstore.New and eventstore.WithContext (keep references to baseCtx,
eventSourceInstance, eventSvc, eventSourceServiceForCommand(cmd.Name())
unchanged).

In `@internal/persis/fileeventstore/collector.go`:
- Around line 179-211: The appendGroup function can return on Flush/Sync
failures after partially writing some items, which causes duplicates on retry;
fix by tracking how many items were successfully written (e.g. increment a
writtenCount after each successful writer.Write and WriteByte), and on any error
(including Flush/Sync) still mark c.seenIDs for group[:writtenCount] and remove
their inbox files (using the existing item.path logic, skipping os.IsNotExist
errors); ensure the final-success path also processes all items, and reference
appendGroup, c.seenIDs, pendingInboxEvent.event.ID, pendingInboxEvent.path,
writer.Flush and f.Sync when making the change.
- Around line 264-293: The bufio.Scanner in loadSeenIDsFromFile (and likewise in
readCommittedEvents used by Query) uses the default 64KiB token limit which can
drop long lines; after creating each scanner (i.e., right after scanner :=
bufio.NewScanner(f)) call scanner.Buffer(make([]byte, 64*1024), 10*1024*1024) to
raise the maximum token size to 10 MiB (keeping a 64 KiB initial buffer) so long
event lines are read instead of causing scanner errors and skipping events/IDs.
- Around line 296-355: cleanupExpired currently deletes expired files but never
prunes the in-memory dedupe map c.seenIDs, so add logic to prune seen IDs when
files are removed: in cleanupExpired, after successfully removing a committed
file (when you have variable window/path) call a new helper like
c.removeSeenIDsForWindow(window) that locks c.seenIDs and deletes IDs associated
with that committed window (e.g., IDs with timestamps <= window.end or otherwise
mapped to that file); likewise after removing a quarantined file (using
info.ModTime()/modDay and path) call a helper (e.g.,
c.removeSeenIDsBefore(cutoff) or c.removeSeenIDsForQuarantine(path)) to remove
seen IDs older than cutoff; implement these helpers to safely lock and modify
c.seenIDs (use existing sync primitives on Collector) so the in-memory dedupe
set does not grow forever.

In `@internal/persis/fileeventstore/store.go`:
- Around line 70-80: The event's RecordedAt is being synthesized into recordedAt
for the filename but not written into the marshaled JSON; before calling
json.Marshal(event) update event.RecordedAt when it is zero (set
event.RecordedAt = time.Now().UTC()) so the payload matches the
filename/timestamp; make this change in the block around json.Marshal(event) /
recordedAt / name (references: event.RecordedAt, recordedAt,
json.Marshal(event), name, fileutil.WriteFileAtomic, inboxSuffix, s.inboxDir).
- Around line 174-213: readCommittedEvents uses bufio.NewScanner without
increasing the default 64KiB token limit which will fail on oversized JSONL
lines; update the scanner initialization in readCommittedEvents to call
scanner.Buffer with a larger max token size (e.g. several megabytes) and an
appropriately sized initial buffer to accommodate large JSON events, do the same
change for the scanner usage in the collector (collector.go) and the fileaudit
store (internal/persis/fileaudit/store.go) to prevent scanner.Err() from failing
on long lines; reference the scanner variable created by bufio.NewScanner and
ensure the new max size is a named constant so it’s reusable across
readCommittedEvents and the other scanner sites.

In `@internal/service/coordinator/handler.go`:
- Around line 191-196: The coordinator is not using event-enriched contexts for
all terminal status writes, so functions like
markPreparedAttemptDispatchFailed() call attempt.Write() with the plain ctx and
miss event metadata; update all coordinator-originated terminal status write
calls (e.g., markPreparedAttemptDispatchFailed, any other places that call
attempt.Write for terminal statuses, and ReportStatus) to use
h.eventContext(ctx) (via Handler.eventContext) instead of the raw ctx so
eventstore.WithContext attaches the Source metadata and those failures appear in
/event-logs.

In `@internal/service/eventstore/context.go`:
- Around line 48-57: The helper EmitPersistedStatusFromContext should not use
the caller's cancellable RPC/request context when emitting an already-persisted
event; build a non-cancellable context (e.g., context.Background() or
context.WithTimeout(context.Background(), shortTimeout)) and call service.Emit
with that instead of ctx so a client disconnect or deadline won't drop the
event; locate EmitPersistedStatusFromContext (which calls FromContext,
PersistedDAGRunEventTypeForStatus, NewDAGRunEvent and service.Emit) and replace
the emitted context with a safe background/timeout context.

In `@internal/service/eventstore/eventstore_test.go`:
- Around line 22-30: The test currently excludes core.Rejected from the
centralized event feed (ok: false), which hides user rejections shown by
internal/service/frontend/api/v1/dagruns.go (it marks runs Rejected and sets
FinishedAt); update the test table in eventstore_test.go so core.Rejected is
treated as a terminal event (ok: true) and set want to the appropriate terminal
event type used by the codebase (prefer TypeDAGRunRejected if you add that
constant, or fold it into an existing terminal type such as
TypeDAGRunFailed/TypeDAGRunAborted consistent with the production mapping),
ensuring the test's mapping mirrors how Rejected is emitted or folded in the
event-emission code.

In `@internal/service/eventstore/eventstore.go`:
- Around line 315-317: The stableID function currently concatenates parts with
"\x1f", which is not collision-safe; update stableID to perform collision-safe
framing by hashing incrementally (use sha256.New, Write each part prefixed by
its length or write a fixed-size length header using encoding/binary) instead of
strings.Join, so that sequences like ["a","b\x1fc"] and ["a\x1fb","c"] produce
different digests; ensure you still return hex.EncodeToString of the final sum
to preserve the API.

In `@internal/service/frontend/api/v1/api.go`:
- Around line 734-736: The current updateDAGRunStatus always wraps writes with
withEventContext which causes duplicate lifecycle events; change
updateDAGRunStatus (the shared mutator used by handlers in dagruns.go) to fetch
the current persisted DAGRun status via dagRunMgr (or use an existing read
method) and only call dagRunMgr.UpdateStatus with a context that includes
withEventContext when the persisted top-level status actually changes to a
different lifecycle state; otherwise perform the update without withEventContext
(or skip emitting) so node-level rewrites while status is Waiting or terminal do
not append duplicate waiting/succeeded/failed/aborted events.

In `@internal/service/frontend/api/v1/events.go`:
- Around line 81-130: The handler should defensively handle a nil QueryResult
and nil entries from eventService.Query: after calling a.eventService.Query(ctx,
filter) check if result == nil and treat it like an empty result (returning zero
entries) or return a well-formed Error; when iterating result.Entries skip any
nil element (if e == nil continue) before accessing fields like e.ID,
e.SchemaVersion, etc.; also guard the make([...], len(result.Entries))
allocation by using 0 when result is nil. Update the code paths around the
symbols result, result.Entries, and the loop over for _, e := range
result.Entries in the function that calls a.eventService.Query to avoid panics.

---

Nitpick comments:
In `@api/v1/api.yaml`:
- Around line 3500-3580: Extract the repeated query parameters startTime,
endTime, limit, and offset into reusable parameter definitions under
components/parameters (e.g., add parameters: StartTime, EndTime, Limit, Offset
with the same schema/constraints), then replace the inline definitions in this
operation with $ref references (for example use $ref:
"#/components/parameters/StartTime" etc.); ensure any other audit/log-list
endpoints that currently duplicate these fields are updated to reference the new
components to avoid drift and keep names/types identical to the existing
audit-style filters.

In `@internal/cmn/config/key_hints.go`:
- Around line 139-141: The key mapping table in key_hints.go is missing a
legacy-to-current entry for the eventstore enabled flag; add a mapping for the
legacy key "eventstore.enabled" to the canonical key "event_store.enabled"
alongside the existing "eventstore" and "eventstore.retentiondays" entries so
lookups in the map that reference eventstore enabled will resolve correctly
(update the same mapping literal where "eventstore" and
"eventstore.retentiondays" are defined).

In `@internal/core/exec/enqueue_retry.go`:
- Around line 113-117: The OnQueued callback (opts.OnQueued) is invoked after
status persistence and queue enqueue and, if it returns an error, the item
remains queued and the status stays as Queued; update the field/comment for
OnQueued to explicitly document this behavior and its semantics (i.e., that
OnQueued is for supplementary actions like event emission, runs post-enqueue,
its returned error is propagated but does not roll back the enqueue or status).
Locate the OnQueued field/type definition and add a short note mentioning when
it is called, that failures are returned to the caller but do not undo
persistence/enqueue, and recommend any alternative patterns (e.g., compensating
actions) if needed.