jcoffey-dev
21fb68a0d4
No code changes -- alert rules already accepted query_language: "sql" with zero validation restricting it to the pipe syntax, and the web UI's rule-creation form already auto-detects SQL vs. pipe syntax via the shared QueryBar component. This was simply never exercised in this specific combination before. Live-verified with three agents: a threshold rule on count(DISTINCT host) against an expected fleet size correctly evaluated ok with all three healthy, then correctly fired when one was killed and its heartbeat rows aged out of the window -- one rule covering a whole named group of hosts instead of one rule per host. Documented as an honest aggregate check, not true per-host alerting: that would need the alerting engine's own per-group state tracking, already named a Phase 3 non-goal for the whole engine, not something specific to agents -- explicitly out of scope here rather than quietly built as a side effect.