# Dummy: Result DB / Work count reconciliation

Read-only snapshot captured at 2026-09-18T12:11:13.513Z. Only project `project-7cbcb7ad`, verified as `Dummy`, was queried. No application or database changes were made. The companion `dummy-result-count-audit.mjs` uses scoped GET requests and reconstructs Work through the actual production selectors, projection and status filter.

## Result

| Measure | Screenshot and reproduced output | Correct current population under existing rules |
| --- | ---: | ---: |
| Result DB GPO deviation comparisons | 179 | 127 |
| Work unique settings with Fail verdict | 16 selected by Deviation | 25 |

The two corrected numbers are not meant to be equal: 127 baseline-package comparisons belong to 25 unique technical policy identities. Both stored runs contain the same 25 failing identities and the same 127 distinct identity/baseline-package pairs. The issues are therefore not explained by different granularity alone.

## 1. Result DB selects an older run with repeated baseline versions

Both runs use aggregation `policy-snapshot-aggregation-d0bd18c02cbc8d8e4102391f089c4c7f` and evaluator 1.9.0.

| Property | Result DB selection | Work selection |
| --- | --- | --- |
| Run | policy-evaluation-run-84d8b95c8e7610994abb842a4de05e0e | policy-evaluation-run-ac3189bde3afae087102bc4e77ad9cba |
| Completed (UTC) | 2026-09-17T13:53:44.060Z | 2026-09-18T11:24:05.072Z |
| Baseline analysis references | 15 | 11 |
| Distinct baseline packages | 11 | 11 |
| Evaluation results | 5492 | 3872 |
| Fail comparisons | 179 | 127 |

The PostgreSQL selector in `server/postgres/postgres-assessor-repository.ts:1101` ranks raw `baselineAnalysisIds` count before completion time. Fifteen references therefore outrank eleven, even though both cover eleven packages. Work's selector in `src/domain/unified-result.ts:599` measures distinct compared `baselineId` values instead and selects the newer run.

The older run contains repeated analysis versions for Windows 11 23H2, 24H2, 25H2 and Windows Server 2025. Deduplicating its Fail comparisons by technical identity plus baseline package yields exactly the newer run's 127 pairs: zero old-only and zero new-only pairs. The excess is exactly 52 comparisons.

Result DB returned 5493 GPO results: 179 misconfigured, 227 match, 5080 not-configured, 6 review-required, and 1 duplicate diagnostic. The extra diagnostic explains the difference from 5492 evaluation results. All 179 deviations belong to Dummy assessment `assessment-batch-1785225371107-78`.

## 2. Work suppresses nine authoritative Fail verdicts

Reconstructed Work contains 948 records: 25 Fail, 25 Pass, 879 Not configured and 19 No baseline rule. Running the production Deviation filter returns only 16.

The guard in `src/profiles/profile-factory.ts:67` rejects a record whenever its displayed Configured Value equals Not configured, even when its authoritative status is Fail. This contradicts the rule that status filters follow the authoritative verdict and the explicit required-registry-presence exception.

The excluded records are eight required key-presence states and one required present empty string. Each retained comparison is independently Different and its retained baseline variant assessment is all-fail. Missing required presence is Fail under the binding rules; ordinary missing recommendations remain score-neutral Not configured.

| Excluded setting | Current Fail comparisons |
| --- | ---: |
| Software\Policies\Microsoft\Windows\SrpV2\Dll | 3 |
| Software\Policies\Microsoft\Windows\SrpV2\Msi | 3 |
| Software\Policies\Microsoft\Windows\SrpV2\Script | 3 |
| Software\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging | 1 |
| fbaenabledhosts (present empty string, Microsoft 365 Apps 2512) | 1 |
| Software\Policies\Microsoft\Windows\Safer | 5 |
| Software\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging | 1 |
| Software\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig | 1 |
| Software\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging | 1 |

These nine settings account for 19 comparisons. The 16 visible failing settings account for the other 108 comparisons, totaling 127.

The exact screenshot filter counts were reproduced: Deviation 16, Passed 25, Not configured 879, No baseline rule 19, Not comparable 0, Conflicts 0, Duplicates 1. Diagnostic categories overlap verdicts and must not be summed as exclusive status buckets.

## Repair scope identified, not implemented

Align PostgreSQL current-run selection with the shared distinct-baseline-coverage rule, and remove the display-value override of authoritative GPO Fail verdicts. Preserve ordinary Not configured neutrality, diagnostic overlap and historical evaluations. Permanent synthetic behavioral tests must cover current-run selection with repeated baseline versions and both GPO Work entry paths for a missing required key/empty-string presence.

## Follow-up: authorized fix and verification

The user subsequently authorized implementation. The diagnosis above is preserved as the pre-fix snapshot; the following is the post-fix acceptance, captured at **2026-09-18T12:40:30.253Z**.

- PostgreSQL now counts distinct nonempty compared baseline IDs, falls back to declared analysis references only when no compared baseline is named, and retains completion time / run ID ordering. No evaluation record was edited or removed.
- Work Deviation now follows the authoritative Fail verdict without a Configured Value text override. Ordinary Not configured, historical readiness and diagnostic flags retain their existing behavior.
- Both views select `policy-evaluation-run-ac3189bde3afae087102bc4e77ad9cba` for the same Dummy aggregation and assessment.
- Result DB: **127 Fail comparisons**, **25 distinct technical identities**, 3873 total results (3872 evaluations plus one duplicate diagnostic). Classification counts: misconfigured 127, match 162, not-configured 3578, review-required 5, duplicate 1.
- Work: **25 Deviation**, 25 Passed, 879 Not configured, 19 No baseline rule, 0 Not comparable, 0 Conflicts, 1 Duplicates. Total 948 rows.
- Identity sets are exactly equal in both directions. There are 127 distinct identity/package comparison pairs, no additional pairs and **zero hidden Fail settings**.
- The running backend reports PostgreSQL and release `3e9d353e9e4d5e96d395252edbc02a4826b55075ab155b3d094954e27ae55c90`, matching the SHA-256 of the built server bundle containing the corrected selection SQL. The existing managed development process applied the update; no alternate datastore was started.

Verification: 50 targeted tests passed, including five actual PostgreSQL executions of the repository's production SELECT over fully synthetic CTE relations on a read-only connection. Cases cover repeated versions, broader versus newer coverage, deterministic ties, unavailable baseline-ID fallback and empty-result fallback, plus foreign project and independent snapshot scope. Permanent Work interaction tests cover both entry paths and required presence versus ordinary absence and history; Result DB interaction checks current comparison counts and filtering. Client and server production builds, local-only security and design checks passed.

The initial full suite reported 1357 passed, two failures and 13 optional skips, including a transient schema-file read/RPC timeout during an approximately six-minute runtime interruption. The schema test passed immediately on isolated rerun. The unrelated `gpo-xml-presentation` assertion remains reproducible: it forbids any code tag in the entire Reader, including the existing Policy Analyzer search-key control. The configured/expected XML value blocks remain inert text. Neither that Reader feature nor its test was changed for this fix.

The final full-suite rerun completed in 97.73 seconds: **1358 passed, one failed, 13 optional tests skipped**, with no timeout or unhandled RPC error. Only the unchanged XML-Reader assertion above fails. Five of the optional PostgreSQL cases are the new read-only parity checks, all separately executed successfully among the 50 targeted tests. The remaining eight are existing opt-in mutating integration tests and were not run against the canonical populated database. Local-only and design checks were run separately and passed because the full-suite command stops at the unrelated failed assertion.