Agent Activity: group by host in the grid, and expand in it

[mastacontrola]

The expand never worked

Clicking a host's chevron on this page rendered DataTables Responsive's hidden-column
list. The nested table it was meant to open was never constructed. Measured on a live
install at 1920px with zero columns hidden, so it was not a narrow-viewport artifact:

childTableInDom: false
childRowText:    "Events 134 / Last Activity 2026-09-04 19:08:39 / Last Event agent.usersession"
hiddenColsBeforeExpand: 0   ->   hiddenColsAfterExpand: 3

A DataTables row has one child slot. registerTable() turns Responsive on for every
grid and Responsive claims that slot, so row.child() handed it a table it then
overwrote. Nothing threw — which is why 7b207c2c9 could fix "the expanded host was
stuck at ten rows" by repairing a pager inside a table that did not exist.

What it is now

One grid, grouped by host with rowGroup. The header carries the host, its event count
and the expand control; expanding adds that host's events to the same grid as
ordinary rows. No table nested in a table, no second scrollbar, no second pager. The page
opens with every host visible and every group collapsed.

Three things had to be true for that to hold, each found by measuring rather than
reasoning:

Finding	Consequence
A group whose rows are all filtered out renders no header	Each host's newest event is seeded and never filtered — it anchors the header and is the row worth seeing when all is collapsed
rowGroup starts a new group whenever dataSrc changes down the ordered rows	Ordering by time alone let one host's older events fall past the next host's newest and drew its header twice; a hidden column sorts every row of a host on that host's last-activity time plus its id
listem()'s recordsTotal is every row in auditLog (1435 on the lab install), not the host's	The cap notice reads recordsFiltered; against recordsTotal it told a 134-event host it was truncated at 500

The flat event set stays unbounded — FOG_AUDIT_RETENTION_DAYS defaults to 0, keep
forever — which is why the seed is a summary query, each expansion is capped, and
rowGroup over a serverSide grid was never an option (it groups within one page).

Select and delete, on every page

Not specific to this page. A grid that passes select: false no longer gets Select All
and Deselect All, and a page that declares itself unselectable no longer gets "Delete
selected".

That was decided by a hardcoded list of node names — ['plugin', 'task', 'activity', 'audit'] — which this page was never added to, so it shipped a red Delete selected
over a table with no delete route anywhere in FOG (ADR 0021 Decision 8).
FOGPage::$selectable replaces the list and registerTable() drops the two buttons, so
each half is stated in the layer that enforces it. The 33 tables already passing
select: false stop showing two enabled buttons that did nothing.

Tests

tests/agent-activity-grouping.test.php — 21 checks. Each of its eight gates was
proven by reintroducing the defect and watching it go red, then restored. It strips
comment lines before scanning: the first run failed on row.child() and on the old node
list, both of which appear only inside the comments that say never to go back to them.

tests/agent-activity-page.test.php had pinned the arrangement this replaces ("the grid
does not use rowGroup", the child table going through registerTable). Those three
checks now assert the opposite, and one of them that no child table returns by any route.

Both PHPStan passes clean, unscoped. Full suite 335 passed, 1 failed —
certificate-table.test.php, which fails identically on an unmodified checkout of the
base and is green in CI.

FOG_BCACHE_VER 362 → 363. No route changed, so OpenAPI::document() is untouched.

🤖 Generated with Claude Code

https://claude.ai/code/session_01JWJMQYE2br8E7Ehr55SJp2