As an additional data point, from my Elastic 8.4.2 system where I was having this problem, I have migrated almost 2000 elastic agents to a new system running Elastic 8.9.0.
On that system, if I run this query:
kbn:///api/fleet/agents?kuery=status:offline
this query works totally fine, and I can absolutely verify that the API response returns all offline agents.
In the Fleet UI for 8.9.0, if I toggle Status -> Offline, in the browser inspector, I see the query generated is:
/api/fleet/agents?page=1&perPage=20&kuery=status%3Aoffline&sortField=enrolled_at&sortOrder=desc&showInactive=false&showUpgradeable=false&getStatusSummary=true&withMetrics=true
So even the query generated in the UI is different in 8.9.0.
Without doing any deeper investigation, I can only conclude
that there are some UI and API differences for Fleet between 8.4.2 and 8.9.0 that make these queries behave differently.
I understand that the Fleet APIs are subject to change so that is OK.
I am in the progress of migrating off of 8.4.2 to 8.9.0, so if the Fleet APIs behave more consistently there, that is fine by me.
Thanks for the feedback and following up.