Records now works without running a scan first. If logs aren't cached in memory from a scan, the endpoint greps the nginx access logs directly for [Client IP] matches and returns the last 500 lines. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>