System Log

docs/PROTOCOL.md

@@ -52,8 +52,11 @@ Auth modes at handshake: public key (viewer), capability token / `pd1.` invite,
 | `getChart` | viewer | `{ id }` | Chart summary |
 | `queryData` | viewer | `{ chart, after, before, points, group, tier }` | Time series |
 | `getWeights` | viewer | see below | Metric Correlations / alert weights |
+| `queryLogs` | viewer* | see below | Anomaly / audit / journal lines |
 | `getAllMetrics` | viewer | `{ format: json\|prometheus\|shell }` | Latest export |
 
+\* `queryLogs` method role is viewer so anomaly search works for all dialers; **audit** and **journal** sources require **admin** inside the handler.
+
 `after` / `before`: absolute unix seconds, or relative (negative = relative to `before`/`now`), agent-style.
 
 #### `getWeights`
@@ -69,6 +72,18 @@ Scores charts for [Metric Correlations](../user-guide/metric-correlations.md) (o
 
 REST parity: `GET /api/v*/weights`. Engine: `server/services/weights.js`.
 
+#### `queryLogs`
+
+| Arg | Notes |
+|-----|--------|
+| `source` | `anomaly` (default) \| `audit` \| `journal` |
+| `q` | Case-insensitive substring |
+| `since` / `until` | Absolute ms/sec or relative (`-1h`) |
+| `priority` / `unit` | Journal filters |
+| `limit` / `cursor` | Cap (≤2000) + pagination offset |
+
+Journal requires `PEARDATA_JOURNAL=1` on Linux. REST: `GET /api/v*/logs`. Engine: `server/services/logs.js`. UI: [user-guide/logs.md](../user-guide/logs.md).
+
 ### Live subscriptions
 
 | Method | Role | Args |