Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@lib/api/src/grpc/qdrant.rs`:
- Around line 13308-13309: Update the proto comment that currently reads
"Key=value filters applied to every JSON field" to specify that filters only
apply to dynamic top-level JSON fields (e.g., "Key=value filters applied to
dynamic top-level JSON fields only"), then regenerate the Rust bindings with
prost-build rather than editing lib/api/src/grpc/qdrant.rs directly; modify the
corresponding proto file where the map<string, string> field (tag = "3") is
defined, update the doc comment there, and run the project's proto
build/regeneration step so the new comment is reflected in the generated
qdrant.rs.

In `@lib/storage/src/audit_reader.rs`:
- Around line 56-71: The current loop reads audit files in ascending filename
order because log_files.sort() processes oldest files first, which can cause
results to hit query.limit before recent entries are read; change the ordering
so the newest files are processed first by sorting log_files in descending order
(e.g., use sort_by with b.cmp(a) or call reverse() after sort) before calling
filter_files_by_time_range and iterating to read_entries_from_file, ensuring the
loop that appends to results returns the most recent entries up to query.limit.

In `@src/actix/api/audit_api.rs`:
- Around line 133-134: The parsed timeout value (let timeout =
params.timeout.unwrap_or(DEFAULT_GRPC_TIMEOUT.as_secs()); and the params.timeout
validation) is computed but deliberately ignored (_ = timeout), which is
misleading; either wire this timeout through to your outbound gRPC calls (e.g.,
convert seconds to a Duration and set it as the request deadline/timeout on the
gRPC client used in the audit API call) so cross-peer requests honor
user-specified timeouts, or remove the timeout parameter and its validation from
the API to avoid exposing a non-functional option; update the code paths that
create/dispatch the gRPC request (the place where the audit API sends peer
requests) to accept and apply this Duration if you choose to implement it.
- Line 119: The code currently silences errors by using unwrap_or_default() on
the call to read_local_audit_logs in the handler, which can mask
I/O/configuration issues; change the handling so errors are propagated or at
least logged: replace unwrap_or_default() on read_local_audit_logs with proper
error handling inside the gRPC handler (e.g., map the error to a tonic::Status
and return Err from the handler or call process_logger/error! with the error and
continue only if partial results are acceptable), referencing the
read_local_audit_logs call and the local_entries binding so the handler either
returns the mapped error or logs the failure before using default results.

---

Nitpick comments:
In `@lib/storage/src/audit_reader.rs`:
- Around line 141-152: The file-level time filter in audit_reader.rs currently
uses a 1-day window (using chrono::Duration::days(1)) around file_date when
checking query.time_to and query.time_from; update the logic in the block that
references file_date, query.time_to, and query.time_from to detect
hourly-rotated filenames (e.g., pattern including an hour like
audit.YYYY-MM-DD-HH.log) and use hour-level granularity
(chrono::Duration::hours(1)) for those files instead of days(1), leaving daily
files unchanged; keep entry-level precision in matches_query as-is and only
change the coarse file-selection window for hourly files to avoid scanning extra
files.

In `@src/actix/api/audit_api.rs`:
- Around line 183-190: The sort currently compares timestamp JSON strings
lexicographically in the closure used by all_entries.sort_by; because AuditEvent
stores timestamps as DateTime<Utc> and the code expects RFC3339/ISO-8601 UTC
strings, add a brief comment above this sort (referencing the sort_by closure
and the "timestamp" field / AuditEvent::timestamp) stating that lexicographic
comparison is safe here because timestamps are RFC3339/ISO-8601 in UTC and
consistent across entries; this documents the assumption for future maintainers.

In `@src/tonic/api/qdrant_internal_api.rs`:
- Around line 157-161: Update the handling of req.limit in the
qdrant_internal_api code: instead of silently converting limit == 0 to None
(which causes AuditLogQuery::new to use DEFAULT_LIMIT), explicitly validate
req.limit and return a tonic::Status::invalid_argument when req.limit == 0 to
match the REST endpoint behavior; locate the conversion around the local
variable limit (and references to AuditLogQuery::new) and replace the current if
req.limit == 0 branch with an early return
Err(tonic::Status::invalid_argument("limit must be >= 1")) (or alternatively, if
you prefer the other approach, add/provide proto documentation indicating that
limit=0 means "use default" and keep the existing conversion).

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/actix/api/audit_api.rs`:
- Around line 46-56: The parse_filters function must fail-fast instead of
dropping bad input: change fn parse_filters(query_string: &str) ->
HashMap<String, String> to return a Result<HashMap<String,String>, Error> (or a
custom error) and propagate urlencoding::decode errors (don’t unwrap_or_default)
and return an error when a decoded filter lacks the required key=value pair;
update callers to map that error to a 400 Bad Request response for the audit
endpoint. Ensure you replace the unwrap_or_default() on urlencoding::decode with
proper error handling (map_err/ ? ), validate decoded.split_once('=') and return
an explicit parse error if missing, and apply the same change to any other
filter-parsing sites that use the same logic so malformed filter= params produce
a 400 instead of silently being ignored.

In `@src/common/audit.rs`:
- Around line 93-98: The current sort uses lexical comparison of the
TIMESTAMP_KEY string which misorders RFC3339 timestamps with optional fractional
seconds; update the sort in the all_entries.sort_by closure to parse each
entry's timestamp string into a chrono::DateTime (e.g. DateTime<Utc> via
chrono::DateTime::parse_from_rfc3339 or FromStr) and compare the parsed
DateTimes, falling back to a sensible default (like MIN or MAX datetime or the
string comparison) when parsing fails; ensure the comparison still yields
newest-first order (i.e., compare parsed_b.cmp(&parsed_a)).

---

Duplicate comments:
In `@lib/storage/src/audit_reader.rs`:
- Around line 59-60: The current scan orders files oldest→newest and applies
query.limit/remaining as it goes, which drops newer matches; change the
traversal to newest→oldest or retain the last N matches per file: reverse the
file ordering returned by list_audit_files (e.g., sort and then .reverse() or
sort_by(|a,b| b.cmp(a))) so log_files is iterated newest-first, and/or when
processing reader.lines() for each file (the loop that checks query.limit /
remaining) buffer the per-file matches and keep only the last `remaining` items
before appending to results so the global limit is applied after newest-first
traversal (adjust logic around the reader.lines() loop and the remaining/limit
checks accordingly).

In `@src/common/audit.rs`:
- Around line 25-30: The current call to
cancel::blocking::spawn_cancel_on_drop(...).await...unwrap_or_default() hides
coordinator-local failures by turning them into an empty success; change this so
coordinator read failures are not swallowed: remove unwrap_or_default() and
either propagate the error (e.g., return Err(StorageError::service_error(...))
when the awaited result is None) or explicitly record the coordinator in
missing_peers so callers know local logs were skipped; update the handling
around local_entries (the result of read_local_audit_logs) and the downstream
missing_peers logic to reflect the chosen behavior.

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@src/common/audit.rs`:
- Around line 63-76: The JSON parsing currently ignores failures in the
local_entries loop and the peer response loop; update both spots (where
serde_json::from_str::<serde_json::Value>(entry_str) is called in the
local_entries iteration and inside the loop over response.into_inner().entries)
to log a warning when parsing fails—include the offending entry_str and, for the
peer case, the peer_id/context—to aid debugging; use the project's logging
facility (e.g., log::warn! or tracing::warn!) and keep pushing valid parsed
values into all_entries as before.