Add Error Code histogram grouping for update failure HRESULTs

[jschick04]

What: Adds an "Error Code" dimension to the timeline group-by, splitting the histogram by the update/servicing failure HRESULT in the errorCode EventData field.

Why: Microsoft-Windows-WindowsUpdateClient stores errorCode as win:HexInt32, so high-bit failure codes (e.g. 0x800F0823) sign-extend to a negative Int32 that the existing whole-number reader drops; Microsoft-Windows-Servicing stores it as a hex string. This dimension reads both forms, scoped to those two providers, and charts the distribution of distinct failure codes over time.

Behavior: Groups by nonzero errorCode scoped to the update/servicing providers; labels each band with the 8-digit hex plus a curated CBS/WU HRESULT symbol when known (e.g. 0x800F081F CBS_E_SOURCE_MISSING), hex-only otherwise; success and non-eligible-provider rows are omitted so "Other" holds only real failure codes beyond the top-N; the curated symbol now also shows in the details-pane field explanation; announcements use a subset-accurate noun and the empty-states distinguish "no update error codes in this view" from a zoomed-empty range.

Tests: Unit coverage for the HRESULT-32 normalizer, the columnar scan (provider gate, omit semantics, sealed/pending parity, allocation-free hot path, ordinal matching), the builder (hex+symbol labels, subset noun, empty-state), and the decoder + details-pane parity. Eventing +18, Runtime +13.

[Copilot]

Pull request overview

Adds an Error Code histogram grouping for Windows Update / Servicing failures by normalizing provider-specific errorCode encodings into a consistent 32-bit HRESULT, enabling timeline distributions split by distinct failure codes (with curated symbols where known) and improving accessibility announcements/empty-states for this “failure-only” subset view.

Changes:

• Introduces an HRESULT-aware EventData scan/bucketing path gated to update/servicing providers, omitting successes (errorCode = 0) and ineligible providers.
• Adds HistogramDimension.ErrorCode end-to-end (builder, labels, curated decoding, UI selection + empty states, announcements/tooltip nouning).
• Adds unit + parity coverage for HRESULT normalization, column-store scans, histogram building, and details-pane decoding parity.

Reviewed changes

Copilot reviewed 24 out of 24 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/Unit/EventLogExpert.Runtime.Tests/LogTable/TestSupport/LegacyEventColumnView.cs	Exposes new HRESULT scan/bucket APIs for test view wrapper.
tests/Unit/EventLogExpert.Runtime.Tests/Histogram/HistogramSummaryTests.cs	Updates window announcement API usage to include event noun.
tests/Unit/EventLogExpert.Runtime.Tests/Histogram/HistogramBuilderTests.cs	Adds ErrorCode histogram builder coverage (omit semantics, labels/symbols, empty state).
tests/Unit/EventLogExpert.Runtime.Tests/DetailsPane/EventFieldExplainerTests.cs	Ensures details pane decodes HRESULT errorCode negatives to curated symbols.
tests/Unit/EventLogExpert.Runtime.Tests/Common/Display/EventDataValueDecoderTests.cs	Adds curated HRESULT decode coverage for errorCode.
tests/Unit/EventLogExpert.Eventing.Tests/Common/Events/EventFieldValueTests.cs	Adds TryGetHResult32 normalization coverage for numeric/string encodings.
tests/Unit/EventLogExpert.Eventing.Tests/Common/Events/EventColumnStoreReaderParityTests.cs	Adds sealed/pending parity tests for HRESULT scans vs legacy reader.
tests/Unit/EventLogExpert.Eventing.Tests/Common/Events/EventColumnStoreEventDataTests.cs	Adds classification/omission + allocation behavior tests for HRESULT scans/counts.
tests/Shared/EventLogExpert.Eventing.TestUtils/Common/Events/LegacyEventColumnReader.cs	Implements legacy-side HRESULT scanning and counting for parity.
src/EventLogExpert.UI/LogTable/Histogram/HistogramPane.razor.cs	Adds Error Code dimension label, noun-aware announcements/tooltips, and tailored empty states.
src/EventLogExpert.UI/LogTable/Histogram/HistogramPane.razor	Adds Error Code to dimension picker and distinguishes zoom-empty vs view-empty states.
src/EventLogExpert.Runtime/LogTable/IEventColumnView.cs	Adds HRESULT scan/bucket methods to view abstraction for ErrorCode dimension.
src/EventLogExpert.Runtime/LogTable/EventColumnView.cs	Implements new IEventColumnView HRESULT scan/bucket delegations.
src/EventLogExpert.Runtime/LogTable/CombinedColumnView.cs	Propagates HRESULT scan/bucket across combined views.
src/EventLogExpert.Runtime/Histogram/HistogramSummary.cs	Makes region/window announcements use a caller-supplied event noun.
src/EventLogExpert.Runtime/Histogram/HistogramDimension.cs	Adds ErrorCode histogram dimension.
src/EventLogExpert.Runtime/Histogram/HistogramData.cs	Adds EventNoun for accessible summaries (subset-accurate).
src/EventLogExpert.Runtime/Histogram/HistogramBuilder.cs	Implements ErrorCode histogram build path using HRESULT scans + hex+symbol labels.
src/EventLogExpert.Runtime/DetailsPane/EventFieldExplainer.cs	Decodes errorCode via HRESULT reader to handle sign-extended HexInt32 failures.
src/EventLogExpert.Runtime/Common/Display/EventDataValueDecoder.cs	Adds curated HRESULT-to-symbol mapping for errorCode.
src/EventLogExpert.Eventing/Common/Events/IEventColumnReader.cs	Adds HRESULT bucket/count APIs at the reader interface level.
src/EventLogExpert.Eventing/Common/Events/EventFieldValue.cs	Adds TryGetHResult32 + parser to normalize numeric/string HRESULT spellings.
src/EventLogExpert.Eventing/Common/Events/EventColumnStoreReader.cs	Wires new HRESULT operations through the column store.
src/EventLogExpert.Eventing/Common/Events/EventColumnStore.cs	Implements allocation-conscious sealed/pending HRESULT scans with provider gating.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 24 out of 24 changed files in this pull request and generated no new comments.

[ryanriesMSFT]

👍