Function filter_of 

fn filter_of(r: &Rule) -> String

The rule’s where terms, spelled in the filter-bar grammar both UIs read.

Split out of link because it is the half that is useful without a link_base: the TUI has no URL to open, and an agent asked “why did this fire” wants the predicate rather than a link it cannot click. Both surfaces paste this straight into a filter box, so the alert and the query it came from cannot drift into two different spellings.