Address Copilot review findings on #839

Reword the combined-field regression test docstrings: the DKIM/SPF
auth results are dynamic-mapped as plain `object`, not the `nested`
mapping type the previous wording implied — the distinction is the
crux of the fix. Also drop the inert renameByName entries Copilot
flagged on the Grafana Overview and DKIM Alignment Details panels,
which referenced fields those panels' queries no longer (or never)
produced.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

dashboards/grafana/Grafana-DMARC_Reports.json

@@ -2681,9 +2681,7 @@
               "date_range": "Date",
               "disposition.keyword": "Disposition",
               "dkim_aligned": "DKIM",
-              "dkim_results.domain.keyword": "DKIM Domain",
               "dkim_results_combined.keyword": "DKIM Auth Result",
-              "dkim_results.selector.keyword": "DKIM Selector",
               "envelope_from.keyword": "Envelope From",
               "header_from.keyword": "Email Domain",
               "org_name.keyword": "Reporter",
@@ -3710,8 +3708,7 @@
               "envelope_from.keyword": "Envelope From",
               "header_from.keyword": "Header From",
               "source_base_domain.keyword": "Reverse DNS Base",
-              "spf_aligned": "SPF Aligned",
-              "spf_results.result.keyword": "SPF Result"
+              "spf_aligned": "SPF Aligned"
             }
           }
         }

tests/test_elastic.py

@@ -631,11 +631,12 @@ class TestAggregateDocCombinedResults(unittest.TestCase):
 
     def test_add_dkim_result_appends_combined_string(self):
         """Regression guard for issue #169: dkim_results/spf_results are
-        stored as nested object arrays, which Kibana/Grafana tables cannot
-        terms-aggregate without producing a cross-product of selector/
-        domain/result values. The composed "selector / domain / result"
-        string preserves per-signature pairing that the object-mapped
-        array loses."""
+        arrays of objects that the engine dynamic-maps as plain ``object``
+        (not ``nested``) and flattens, so Kibana/Grafana tables cannot
+        terms-aggregate their subfields without producing a cross-product
+        of selector/domain/result values. The composed
+        "selector / domain / result" string preserves the per-signature
+        pairing that the flattened array loses."""
         doc = elastic_module._AggregateReportDoc()
         doc.add_dkim_result(
             domain="example.net", selector="net1", result="fail", human_result=None

tests/test_opensearch.py

@@ -684,11 +684,12 @@ class TestAggregateDocCombinedResults(unittest.TestCase):
 
     def test_add_dkim_result_appends_combined_string(self):
         """Regression guard for issue #169: dkim_results/spf_results are
-        stored as nested object arrays, which Kibana/Grafana tables cannot
-        terms-aggregate without producing a cross-product of selector/
-        domain/result values. The composed "selector / domain / result"
-        string preserves per-signature pairing that the object-mapped
-        array loses."""
+        arrays of objects that the engine dynamic-maps as plain ``object``
+        (not ``nested``) and flattens, so Kibana/Grafana tables cannot
+        terms-aggregate their subfields without producing a cross-product
+        of selector/domain/result values. The composed
+        "selector / domain / result" string preserves the per-signature
+        pairing that the flattened array loses."""
         doc = opensearch_module._AggregateReportDoc()
         doc.add_dkim_result(
             domain="example.net", selector="net1", result="fail", human_result=None