fix(mcp): get_anomaly keeps the events nearest the occurrence and says how many it left out (#5861)

Each source in an anomaly's `around` was cut to its oldest 40 with
nothing in the reply to say so; on a busy host the events nearest the
occurrence were the ones dropped. Each source now keeps the 40 nearest
the occurrence's start, and `around_left_out` counts the rest. Sources
return everything their bounded query read (Docker and the host agent
no longer cut at 40 and 20 themselves), so the count is honest.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

plugins/docker/mcp_tools.py

@@ -758,7 +758,7 @@ async def mcp_events(db, host_id: str, host_name: str, since, until) -> list[dic
     from steward.mcp.tools._events import event
     rows = (await db.execute(select(DockerEvent).where(
         DockerEvent.host_id == host_id, DockerEvent.at >= since, DockerEvent.at <= until)
-        .order_by(DockerEvent.at).limit(40))).scalars()
+        .order_by(DockerEvent.at).limit(500))).scalars()
     return [event(e.at, "container", f"{e.container_name} {e.event}" + (f" ({e.detail})" if e.detail else ""),
                   subject=f"{host_name}/{e.container_name}") for e in rows]
 

plugins/host_agent/mcp_tools.py

@@ -303,7 +303,7 @@ async def mcp_events(db, host_id: str, host_name: str, since, until) -> list[dic
     jobs = (await db.execute(select(HostMaintenanceJob).where(
         HostMaintenanceJob.host_id == host_id, HostMaintenanceJob.created_at <= until,
         (HostMaintenanceJob.finished_at.is_(None)) | (HostMaintenanceJob.finished_at >= since))
-        .order_by(HostMaintenanceJob.created_at).limit(20))).scalars()
+        .order_by(HostMaintenanceJob.created_at).limit(200))).scalars()
     for job in jobs:
         out.append(event(job.created_at, "maintenance", f"Maintenance: {maintenance.summary(job)}",
                          until=job.finished_at, ids={"job_id": job.id}))
@@ -311,7 +311,7 @@ async def mcp_events(db, host_id: str, host_name: str, since, until) -> list[dic
     rows = (await db.execute(select(HostDowntime).where(
         HostDowntime.host_id == host_id, HostDowntime.started_at <= until,
         (HostDowntime.ended_at.is_(None)) | (HostDowntime.ended_at >= since))
-        .order_by(HostDowntime.started_at).limit(20))).scalars()
+        .order_by(HostDowntime.started_at).limit(200))).scalars()
     for row in rows:
         seen = downtime.describe(row, now)
         out.append(event(row.started_at, "downtime",

plugins/traefik/mcp_tools.py

@@ -323,7 +323,7 @@ async def service_events(db, router: str, since, until) -> list[dict]:
     host: a router anomaly has no host of its own to read events by (#5862).
     [] without the Docker plugin, or when no single service matches."""
     from steward.core.plugin_manager import loaded_plugin_submodule
-    from steward.mcp.tools._events import PER_SOURCE, event
+    from steward.mcp.tools._events import event
     from steward.models.hosts import Host
     models = loaded_plugin_submodule("docker", "models")
     if models is None:
@@ -335,7 +335,7 @@ async def service_events(db, router: str, since, until) -> list[dict]:
     rows = (await db.execute(
         select(e, Host.name).join(Host, Host.id == e.host_id)
         .where(e.container_name.startswith(f"{service}.", autoescape=True), e.at >= since, e.at <= until)
-        .order_by(e.at).limit(PER_SOURCE))).all()
+        .order_by(e.at).limit(500))).all()
     return [event(ev.at, "container", f"{ev.container_name} {ev.event}" + (f" ({ev.detail})" if ev.detail else ""),
                   subject=f"{host}/{ev.container_name}") for ev, host in rows]