Assessor_2.0/outputs/dummy-result-count-audit-2026-09-18.md

Dummy: Result DB / Work count reconciliation

Read-only snapshot captured at 2026-09-18T12:11:13.513Z. Only project project-7cbcb7ad, verified as Dummy, was queried. No application or database changes were made. The companion dummy-result-count-audit.mjs uses scoped GET requests and reconstructs Work through the actual production selectors, projection and status filter.

Result

Measure	Screenshot and reproduced output	Correct current population under existing rules
Result DB GPO deviation comparisons	179	127
Work unique settings with Fail verdict	16 selected by Deviation	25

The two corrected numbers are not meant to be equal: 127 baseline-package comparisons belong to 25 unique technical policy identities. Both stored runs contain the same 25 failing identities and the same 127 distinct identity/baseline-package pairs. The issues are therefore not explained by different granularity alone.

1. Result DB selects an older run with repeated baseline versions

Both runs use aggregation policy-snapshot-aggregation-d0bd18c02cbc8d8e4102391f089c4c7f and evaluator 1.9.0.

Property	Result DB selection	Work selection
Run	policy-evaluation-run-84d8b95c8e7610994abb842a4de05e0e	policy-evaluation-run-ac3189bde3afae087102bc4e77ad9cba
Completed (UTC)	2026-09-17T13:53:44.060Z	2026-09-18T11:24:05.072Z
Baseline analysis references	15	11
Distinct baseline packages	11	11
Evaluation results	5492	3872
Fail comparisons	179	127

The PostgreSQL selector in server/postgres/postgres-assessor-repository.ts:1101 ranks raw baselineAnalysisIds count before completion time. Fifteen references therefore outrank eleven, even though both cover eleven packages. Work's selector in src/domain/unified-result.ts:599 measures distinct compared baselineId values instead and selects the newer run.

The older run contains repeated analysis versions for Windows 11 23H2, 24H2, 25H2 and Windows Server 2025. Deduplicating its Fail comparisons by technical identity plus baseline package yields exactly the newer run's 127 pairs: zero old-only and zero new-only pairs. The excess is exactly 52 comparisons.

Result DB returned 5493 GPO results: 179 misconfigured, 227 match, 5080 not-configured, 6 review-required, and 1 duplicate diagnostic. The extra diagnostic explains the difference from 5492 evaluation results. All 179 deviations belong to Dummy assessment assessment-batch-1785225371107-78.

2. Work suppresses nine authoritative Fail verdicts

Reconstructed Work contains 948 records: 25 Fail, 25 Pass, 879 Not configured and 19 No baseline rule. Running the production Deviation filter returns only 16.

The guard in src/profiles/profile-factory.ts:67 rejects a record whenever its displayed Configured Value equals Not configured, even when its authoritative status is Fail. This contradicts the rule that status filters follow the authoritative verdict and the explicit required-registry-presence exception.

The excluded records are eight required key-presence states and one required present empty string. Each retained comparison is independently Different and its retained baseline variant assessment is all-fail. Missing required presence is Fail under the binding rules; ordinary missing recommendations remain score-neutral Not configured.

Excluded setting	Current Fail comparisons
Software\Policies\Microsoft\Windows\SrpV2\Dll	3
Software\Policies\Microsoft\Windows\SrpV2\Msi	3
Software\Policies\Microsoft\Windows\SrpV2\Script	3
Software\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging	1
fbaenabledhosts (present empty string, Microsoft 365 Apps 2512)	1
Software\Policies\Microsoft\Windows\Safer	5
Software\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging	1
Software\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig	1
Software\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging	1

These nine settings account for 19 comparisons. The 16 visible failing settings account for the other 108 comparisons, totaling 127.

The exact screenshot filter counts were reproduced: Deviation 16, Passed 25, Not configured 879, No baseline rule 19, Not comparable 0, Conflicts 0, Duplicates 1. Diagnostic categories overlap verdicts and must not be summed as exclusive status buckets.

Repair scope identified, not implemented

Align PostgreSQL current-run selection with the shared distinct-baseline-coverage rule, and remove the display-value override of authoritative GPO Fail verdicts. Preserve ordinary Not configured neutrality, diagnostic overlap and historical evaluations. Permanent synthetic behavioral tests must cover current-run selection with repeated baseline versions and both GPO Work entry paths for a missing required key/empty-string presence.

Follow-up: authorized fix and verification

The user subsequently authorized implementation. The diagnosis above is preserved as the pre-fix snapshot; the following is the post-fix acceptance, captured at 2026-09-18T12:40:30.253Z.

• PostgreSQL now counts distinct nonempty compared baseline IDs, falls back to declared analysis references only when no compared baseline is named, and retains completion time / run ID ordering. No evaluation record was edited or removed.
• Work Deviation now follows the authoritative Fail verdict without a Configured Value text override. Ordinary Not configured, historical readiness and diagnostic flags retain their existing behavior.
• Both views select policy-evaluation-run-ac3189bde3afae087102bc4e77ad9cba for the same Dummy aggregation and assessment.
• Result DB: 127 Fail comparisons, 25 distinct technical identities, 3873 total results (3872 evaluations plus one duplicate diagnostic). Classification counts: misconfigured 127, match 162, not-configured 3578, review-required 5, duplicate 1.
• Work: 25 Deviation, 25 Passed, 879 Not configured, 19 No baseline rule, 0 Not comparable, 0 Conflicts, 1 Duplicates. Total 948 rows.
• Identity sets are exactly equal in both directions. There are 127 distinct identity/package comparison pairs, no additional pairs and zero hidden Fail settings.
• The running backend reports PostgreSQL and release 3e9d353e9e4d5e96d395252edbc02a4826b55075ab155b3d094954e27ae55c90, matching the SHA-256 of the built server bundle containing the corrected selection SQL. The existing managed development process applied the update; no alternate datastore was started.

Verification: 50 targeted tests passed, including five actual PostgreSQL executions of the repository's production SELECT over fully synthetic CTE relations on a read-only connection. Cases cover repeated versions, broader versus newer coverage, deterministic ties, unavailable baseline-ID fallback and empty-result fallback, plus foreign project and independent snapshot scope. Permanent Work interaction tests cover both entry paths and required presence versus ordinary absence and history; Result DB interaction checks current comparison counts and filtering. Client and server production builds, local-only security and design checks passed.

The initial full suite reported 1357 passed, two failures and 13 optional skips, including a transient schema-file read/RPC timeout during an approximately six-minute runtime interruption. The schema test passed immediately on isolated rerun. The unrelated gpo-xml-presentation assertion remains reproducible: it forbids any code tag in the entire Reader, including the existing Policy Analyzer search-key control. The configured/expected XML value blocks remain inert text. Neither that Reader feature nor its test was changed for this fix.

The final full-suite rerun completed in 97.73 seconds: 1358 passed, one failed, 13 optional tests skipped, with no timeout or unhandled RPC error. Only the unchanged XML-Reader assertion above fails. Five of the optional PostgreSQL cases are the new read-only parity checks, all separately executed successfully among the 50 targeted tests. The remaining eight are existing opt-in mutating integration tests and were not run against the canonical populated database. Local-only and design checks were run separately and passed because the full-suite command stops at the unrelated failed assertion.