docker_events asked for three hours across the 2026-10-09 resolver outage on the control node answered zero events: the runtime keeps only its last ~256 events in memory, and health-check execs filled them with the last ten minutes. The answer now carries held, oldest_held and complete, and a history line when the window reaches further back than what the runtime still holds. The type filter moves into the tool, since the history's start is only known from all of it.