Histogram EventData group-by, spike-outline cleanup, and timeline-aware single-log sort

[jschick04]

Summary

Three histogram follow-ups on top of the merged event-timeline feature (#650):

1. EventData group-by dimensions: adds Logon Type and Ticket Encryption Type to the timeline's Group by picker, decoded from a curated EventData allowlist.
2. Removes the spike (anomaly) outline: the tall bar already signals a volume spike, and the colored outline added no meaning for users unfamiliar with it.
3. Timeline-aware single-log sort: a single log's table now defaults to Date/Time order while the timeline is visible (so it reads in the same order as the time axis) and to Record ID order while it is hidden.

EventData group-by (Logon Type / Ticket Encryption Type)

• A columnar Eventing scan (CountEventDataValues / BucketTimeTicksByEventData) buckets survivor-scoped time ticks keyed on the canonical numeric code, so a value written as 23, 0x17, or a typed integer folds into one band.
• A shared EventDataValueDecoder maps the code to a label (for example 2 to Interactive, 23 to AES256), reused by both the histogram and the Details Pane field explainer.
• Always shown, with an empty state ("No {dimension} values in this view.") when the field is absent in the current view; the Group by picker widened to fit the longer label.
• A direct-read path (TryGetWholeNumberFromRawField) reads the raw field bits without materializing an event property, keeping the scan allocation-free and O(1) per row.

Timeline-aware single-log sort

• ResolvedEventOrdering.ResolveDefaultOrderBy now factors in timeline visibility: a single log with no explicit sort resolves to Date/Time when the timeline is shown and to Record ID when hidden. Combined views (always Date/Time) and explicit user sorts are unchanged.
• LogTableState.TimelineVisible mirrors the histogram's visibility (synced through SetHistogramVisibleAction). Toggling the timeline republishes the single-log view through the existing async sort pipeline, and the display-version bump is gated to that same case so it cannot strand an in-flight explicit-sort republish.

Accessibility

• The removed spike outline keeps its non-visual equivalent: the keyboard bin-cursor still announces ", spike" for a statistically anomalous bin, so screen-reader users retain the cue that the tall bar gives sighted users.
• Follow-up tracked: a polite announcement when a timeline toggle reorders a single-log table (the header aria-sort reflects only explicit sorts today, matching the pre-existing default-sort behavior).

Validation

• Test suites green: Eventing 665, Runtime 1877, UI 1121. Touched projects build 0 warnings / 0 errors.
• Governance: pre-implementation and post-code multi-model panels reached unanimous convergence on each change.

Manual acceptance (WebView2)

• Group by Logon Type / Ticket Encryption Type; confirm the decoded band labels and the empty state on logs without those fields.
• Confirm the timeline no longer draws a colored outline around tall / spike bars.
• With a single log open, toggle View > Timeline: the table reorders to Date/Time (shown) versus Record ID (hidden), and an explicit column sort is not overridden.

[Copilot]

Pull request overview

This PR extends the event timeline histogram and related runtime plumbing by adding EventData-backed group-by dimensions (Logon Type / Ticket Encryption Type), removing the visual “spike” outline, and making default single-log table ordering depend on timeline visibility.

Changes:

• Add EventData numeric-code scanning and shared decoding for Logon Type and Ticket Encryption Type histogram group-by.
• Remove anomaly/spike outline rendering while preserving non-visual cues and add an explicit “field absent” empty state.
• Make single-log default sort resolve to Date/Time when the timeline is visible and Record ID when hidden (including reducer/effect wiring and tests).

Reviewed changes

Copilot reviewed 29 out of 29 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/Unit/EventLogExpert.Runtime.Tests/LogTable/TimelineDefaultSortTests.cs	Adds coverage for timeline-aware default sort resolution and version-bump behavior on timeline visibility toggles.
tests/Unit/EventLogExpert.Runtime.Tests/LogTable/TestSupport/LegacyEventColumnView.cs	Extends test view wrapper to support EventData bucketing/counting APIs.
tests/Unit/EventLogExpert.Runtime.Tests/LogTable/LogTableStoreTests.cs	Updates tests to pass timeline visibility into default ordering resolution.
tests/Unit/EventLogExpert.Runtime.Tests/LogTable/LogTableReducerInvariantTests.cs	Updates invariant oracle to include timeline visibility in default ordering resolution.
tests/Unit/EventLogExpert.Runtime.Tests/LogTable/LogTableReducerDifferentialTests.cs	Updates differential harness to include timeline visibility in effective default ordering.
tests/Unit/EventLogExpert.Runtime.Tests/LogTable/LogTabGroupTests.cs	Updates grouping tests to include timeline visibility in ordering resolution.
tests/Unit/EventLogExpert.Runtime.Tests/Histogram/HistogramBuilderTests.cs	Adds histogram tests for EventData group-by behavior (absent field empty state, “Other”, decode, hex folding).
tests/Unit/EventLogExpert.Runtime.Tests/Common/Display/EventDataValueDecoderTests.cs	Adds unit tests for shared EventData numeric code decoding.
tests/Unit/EventLogExpert.Eventing.Tests/Common/Events/EventColumnStoreEventDataTests.cs	Adds EventColumnStore reader tests for EventData scanning/bucketing, allocation behavior, and hex folding/overflow handling.
tests/Shared/EventLogExpert.Eventing.TestUtils/Common/Events/LegacyEventColumnReader.cs	Adds EventData bucketing/counting support to the legacy test reader implementation.
src/EventLogExpert.UI/LogTable/Histogram/HistogramPane.razor.css	Widens the group-by picker and removes styling for the deleted anomaly outline.
src/EventLogExpert.UI/LogTable/Histogram/HistogramPane.razor.cs	Adds dimension labels, supports “field absent” announcements, and clears stale absent-field base data on dimension switch.
src/EventLogExpert.UI/LogTable/Histogram/HistogramPane.razor	Adds new dimensions to the picker, removes anomaly outline SVG rect, and adds a “No {dimension} values” empty state.
src/EventLogExpert.Runtime/LogTable/ResolvedEventOrdering.cs	Extends default order resolution to consider timeline visibility for single-log views.
src/EventLogExpert.Runtime/LogTable/Reducers.cs	Threads timeline visibility into effective sort context and adds reducer handling for timeline/histogram visibility changes.
src/EventLogExpert.Runtime/LogTable/LogTableState.cs	Adds TimelineVisible state and uses it in default sort context resolution.
src/EventLogExpert.Runtime/LogTable/IEventColumnView.cs	Adds EventData code-based bucketing/counting APIs for histogram group-by.
src/EventLogExpert.Runtime/LogTable/EventColumnView.cs	Implements new IEventColumnView EventData methods by delegating to the reader.
src/EventLogExpert.Runtime/LogTable/CombinedColumnView.cs	Aggregates EventData bucketing/counting across constituent views in combined view.
src/EventLogExpert.Runtime/Histogram/HistogramDimension.cs	Adds LogonType and TicketEncryptionType dimensions.
src/EventLogExpert.Runtime/Histogram/HistogramData.cs	Adds GroupingFieldAbsent flag to support an explicit empty state when the EventData field is missing.
src/EventLogExpert.Runtime/Histogram/HistogramBuilder.cs	Implements EventData-based histogram building, including top-code selection and code-to-label decoding.
src/EventLogExpert.Runtime/EventLog/FilteringEffects.cs	Republishes single-log views on timeline visibility toggles when it affects the default order.
src/EventLogExpert.Runtime/DetailsPane/EventFieldExplainer.cs	Switches value decoding to shared EventDataValueDecoder using TryGetWholeNumber.
src/EventLogExpert.Runtime/Common/Display/EventDataValueDecoder.cs	Introduces a shared decoder for well-known numeric EventData codes used in multiple UI surfaces.
src/EventLogExpert.Eventing/Common/Events/IEventColumnReader.cs	Adds reader APIs for EventData code bucketing and value counting.
src/EventLogExpert.Eventing/Common/Events/EventFieldValue.cs	Adds allocation-free whole-number parsing (decimal + 0x-hex) for EventData values.
src/EventLogExpert.Eventing/Common/Events/EventColumnStoreReader.cs	Implements new reader APIs by validating arguments and delegating to EventColumnStore.
src/EventLogExpert.Eventing/Common/Events/EventColumnStore.cs	Adds allocation-aware EventData code scanning/bucketing paths with per-schema field-index memoization and raw-field parsing.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 29 out of 29 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 29 out of 29 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 29 out of 29 changed files in this pull request and generated no new comments.