Add filters and context to host operation history

docs/native-hosts.md

@@ -60,10 +60,20 @@ or enrolling another host needs no manual propagation. Setup waits for an active
 healthy host with sufficient storage. Failed operations retry automatically with
 backoff from one minute to fifteen minutes; their errors remain visible in the
 host's setup panel and **Hosts → Operation history**. This shared history lists
-operations across hosts, newest first, with a host column and 25 rows per page.
+operations across hosts, newest first, with 25 rows per page and host, target,
+and source details. It defaults to **Actions & errors**; **Routine checks** and
+**All operations** include successful monitoring reads. Older records may lack
+source details.
 Disconnected hosts resume when they
 reconnect. Draining and disabled hosts do not receive new automatic setup work.
 
+**Settings → Routine operation history retention (days)** controls cleanup of
+successful monitoring and file-read records. The default is one day; zero keeps
+them indefinitely. Actions, failures, negative checks, and unresolved operations
+are retained. Agent 1.4.9 also cleans up successful routine journal records after
+the controller confirms their final receipt. Older unconfirmed journal entries
+remain until a replay supplies that confirmation. Cleanup runs in bounded batches.
+
 An automatic download that has not been delivered to the agent can be replaced
 when a newer upload becomes available. A delivered operation finishes safely
 before the host prepares the latest files. Failed or incomplete uploads never
@@ -287,8 +297,11 @@ explicit installer `--reenroll` when local credentials already exist.
 API outline:
 
 - `GET /api/hosts/:id`: host details and deletion blockers.
-- `GET /api/hosts/operations?page=1`: operation history across hosts, newest first,
-  with 25 summaries per page and total/page counts. Payloads and results are omitted.
+- `GET /api/hosts/operations?page=1&filter=important`: operation history across
+  hosts, newest first, with 25 summaries per page and filtered total/page counts.
+  Filters are `important` (default), `routine`, and `all`. Summaries include the
+  server, safe target path or status command, and initiating source when recorded.
+  Payloads and results are omitted.
 - `DELETE /api/hosts/:id`: administrator requests cleanup of an unused host;
   returns `202` while remote removal is pending, `200` for an unenrolled host,
   or `409` when the agent needs updating or unresolved ownership remains.
@@ -551,8 +564,14 @@ of which task delayed a previous deployment.
 Campaign, beta and maintenance observers run independently of provisioning.
 New requests and completed agent commands wake provisioning; an arrival during a
 pass schedules another pass. Routine file drift scans run every five minutes;
-manual checks bypass that interval. Overlapping identical native observations
-share one operation until it completes, without caching results for later checks.
+manual checks bypass that interval. Agent 1.4.9 supports one hash manifest per
+drift scan, avoiding separate list/stat/read operations for unchanged files.
+Older agents use the existing file checks. Overlapping identical native
+observations share one operation until it completes. Routine status monitoring
+and maintenance additionally share successful health results for up to 30 seconds
+from the request start, preserving the original observation time. Changed server
+identity or lifecycle intent invalidates reuse. Manual checks and disruption
+safety checks continue to request fresh evidence.
 Agent 1.4.5 reserves two observation workers for instance health and read-only RCON,
 and one for files, logs, and host inventory. Background reads arrive in batches of
 up to four. File receipt uploads release the instance lock before contacting the