"9 systems" while naming eight

Found by driving an eight-system estate — 3,624 findings over 73 pages — which
is the first time anything here has run against more than one SID.

The top-risks page rendered `{instances} systems`, and `instances` counts
FINDINGS. Two ways those diverge, and only one is exotic:

  * one system with several clients: a check firing in 100 and 200 is two
    findings on one SID, and that is the ordinary case
  * two systems sharing a SID across landscapes, which is what this estate has

So the row read "9 instances across 8 systems" and the screen said "9 systems"
above a list of eight names, with a "+5" that made 3 + 5 = 8 sit beside a stated
9. Every number was right about something and none was right about systems.

THE COUNT DID NOT EXIST TO BE DISPLAYED, which is why this took three changes
rather than a relabel. `findings_for_domains` did not select `f.system_id`, so
`_distinct_risks` had only the SID string to group on — a display label, not an
identity. It now counts systems on the system, keeps `systems` as the list of
names a reader recognises, and the page shows that count with the finding count
beside it only when the two differ. The unnamed remainder counts off the
authoritative total too, so the arithmetic reconciles.

THE EXISTING TEST ASSERTED THE BUG. Its fixture was `instances: 6` with four
SIDs, expecting "6 systems" — so this was not merely untested, it was pinned in
place, and any correct implementation would have failed the suite. Replaced, and
three cases added including the two-clients-one-system one. A green suite says a
test agrees with the code, not that either is right.

WHAT THE SAME DRIVE FOUND NOTHING WRONG WITH, worth recording because it is the
first evidence at this scale: paging serves every one of 3,624 findings exactly
once across 73 pages, with no duplicates — the paging fix was made at 8 pages
and had never been seen an order of magnitude up. Dashboard, domains and
findings totals all reconcile. The "one problem on many systems is one risk"
grouping, which the whole page rests on, ran on real data for the first time and
collapsed 50 risks correctly.

A COVERAGE GAIN FALLS OUT OF IT. Suite skips drop from 3 to 1: the scope test
that has been reporting "only one system in this database" now runs, as does the
cross-system finding-detail check. They were never broken, only unreachable.

AND ONE PRODUCT CHARACTERISTIC WORTH KNOWING, measured on the way: scaling the
row counts of an estate 20x left the finding count identical at 405 and grew the
member lists instead. Findings are driven by distinct PROBLEMS, not by estate
size — 297 of 405 are aggregates. The route to a large finding count is more
systems, not bigger files, which is why this estate is eight systems rather than
one enormous one.

5,512 pass with a database; 157 frontend tests.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: Krishcalin

frontend/src/api/types.ts

@@ -1431,10 +1431,17 @@ export interface TopRisk {
   title: string
   sid: string | null
   system_client: string | null
-  /** How many systems this same check fires on, and which. Five rows of the
-   *  same risk are not five risks. */
+  /** How many FINDINGS this same check produced. Five rows of the same risk
+   *  are not five risks — but this is not a system count either: one system
+   *  with two clients gives two findings on one SID. */
   instances: number
+  /** The SIDs, for display. Two systems in different landscapes can share one,
+   *  so the length of this is not a system count either. */
   systems: string[]
+  /** How many systems, counted on the system rather than on its name. Optional:
+   *  an older server does not send it and the caller falls back to
+   *  `systems.length`. */
+  system_count?: number
 }
 
 export interface TopRisksView {

frontend/src/routes/TopRisks.test.tsx

@@ -127,13 +127,52 @@ describe('the five worst in each domain', () => {
     // One problem on six systems is one risk — and the reader still has to
     // know it is six.
     topRisks.mockResolvedValue(view([
-      domain({ shown: [risk({ instances: 6, systems: ['PRD', 'D01', 'T01', 'Q01'] })] }),
+      domain({ shown: [risk({ instances: 6, system_count: 6,
+                              systems: ['PRD', 'D01', 'T01', 'Q01', 'S01', 'X01'] })] }),
     ]))
     draw()
     expect(await screen.findByText(/6 systems: PRD, D01, T01/)).toBeInTheDocument()
-    expect(screen.getByText(/\+1/)).toBeInTheDocument()
+    expect(screen.getByText(/\+3/)).toBeInTheDocument()
   })
 
+  it('counts systems, not findings', async () => {
+    // THIS TEST USED TO ASSERT THE BUG. Its fixture said instances: 6 with four
+    // SIDs and expected "6 systems", because `instances` counts FINDINGS: one
+    // system with two clients gives two findings on one SID, and two systems in
+    // different landscapes can share a SID. Measured on an eight-system estate,
+    // the screen read "9 systems" while naming eight.
+    topRisks.mockResolvedValue(view([
+      domain({ shown: [risk({ instances: 6, system_count: 4,
+                              systems: ['PRD', 'D01', 'T01', 'Q01'] })] }),
+    ]))
+    draw()
+    expect(await screen.findByText(/4 systems \(6 findings\)/)).toBeInTheDocument()
+    expect(screen.queryByText(/6 systems/)).not.toBeInTheDocument()
+  })
+
+  it('counts the unnamed remainder off the system total, not the name list',
+    async () => {
+      // Two systems sharing a SID contribute one name, so "+N" taken from the
+      // name list left the reader adding 3 and 5 and getting 8 beside a stated 9.
+      topRisks.mockResolvedValue(view([
+        domain({ shown: [risk({ instances: 9, system_count: 9,
+                                systems: ['PRD', 'D01', 'T01', 'Q01', 'S01',
+                                          'X01', 'Y01', 'Z01'] })] }),
+      ]))
+      draw()
+      await screen.findByText(/9 systems/)
+      expect(screen.getByText(/\+6/)).toBeInTheDocument()
+    })
+
+  it('falls back to the name list when an older server sends no count',
+    async () => {
+      topRisks.mockResolvedValue(view([
+        domain({ shown: [risk({ instances: 2, systems: ['PRD', 'D01'] })] }),
+      ]))
+      draw()
+      expect(await screen.findByText(/2 systems: PRD, D01/)).toBeInTheDocument()
+    })
+
   it('says nothing of the sort when every domain was assessed', async () => {
     // A caveat that is always on is a caveat nobody reads.
     topRisks.mockResolvedValue(view([domain()]))

frontend/src/routes/TopRisks.tsx

@@ -64,10 +64,29 @@ function Row({ risk }: { risk: TopRiskDomain['shown'][number] }) {
         <span className="block text-[11px] text-ink3 font-mono truncate">
           {risk.check_id}
           {/* The systems it lands on, because one problem on six systems is
-              one risk — and the reader still has to know it is six. */}
+              one risk — and the reader still has to know it is six.
+
+              SIX SYSTEMS, NOT SIX FINDINGS. This said `{instances} systems`,
+              and `instances` counts findings: a check firing in two clients of
+              one system, or on two systems that share a SID across landscapes,
+              made the label overstate. Measured on an eight-system estate it
+              read "9 systems" while naming eight. `system_count` counts the
+              systems; `instances` is shown beside it only when the two differ,
+              because that difference is itself worth seeing. */}
           {risk.instances > 1
-            ? <> · {risk.instances} systems: {risk.systems.slice(0, 3).join(', ')}
-                {risk.systems.length > 3 && ` +${risk.systems.length - 3}`}</>
+            ? <> · {risk.system_count ?? risk.systems.length} system
+                {(risk.system_count ?? risk.systems.length) === 1 ? '' : 's'}
+                {risk.instances !== (risk.system_count ?? risk.systems.length)
+                  && ` (${risk.instances} findings)`}
+                : {risk.systems.slice(0, 3).join(', ')}
+                {/* "and N more" counted off the authoritative total, not off
+                    the name list. Two systems sharing a SID contribute one
+                    name, so "DEV, DV2, PR2 +5" beside "9 systems" left the
+                    reader adding 3 and 5 and getting 8. */}
+                {(risk.system_count ?? risk.systems.length)
+                   > Math.min(3, risk.systems.length)
+                  && ` +${(risk.system_count ?? risk.systems.length)
+                          - Math.min(3, risk.systems.length)}`}</>
             : risk.sid && <> · {risk.sid}{risk.system_client ? `/${risk.system_client}` : ''}</>}
         </span>
       </span>

server/queries.py

@@ -969,9 +969,26 @@ def _distinct_risks(rows: List[Dict[str, Any]]) -> List[Dict[str, Any]]:
     """
     out: List[Dict[str, Any]] = []
     seen: Dict[str, Dict[str, Any]] = {}
+    ids: Dict[str, set] = {}
     for row in rows:
         check = str(row.get("check_id") or "")
         system = row.get("sid")
+        # HOW MANY SYSTEMS, COUNTED ON THE SYSTEM AND NOT ON ITS NAME.
+        #
+        # `systems` is the DISPLAY list and is keyed by SID, which is what a
+        # reader recognises. It is not a count: two systems can share a SID —
+        # the same SID recorded in two landscapes — and one system carries
+        # several clients, so a check firing in client 100 and 200 is two
+        # findings on one SID. Counting the display list therefore understates,
+        # and counting `instances` (which counts FINDINGS) overstates.
+        #
+        # Found on an eight-system estate, where AUTH-001 read "9 instances
+        # across 8 systems" and the screen rendered "9 systems" while naming
+        # eight. Both numbers were right about something and neither was right
+        # about systems.
+        holder = ids.setdefault(check, set())
+        if row.get("system_id") is not None:
+            holder.add(row["system_id"])
         if check in seen:
             entry = seen[check]
             entry["instances"] += 1
@@ -983,6 +1000,11 @@ def _distinct_risks(rows: List[Dict[str, Any]]) -> List[Dict[str, Any]]:
         entry["systems"] = [system] if system else []
         seen[check] = entry
         out.append(entry)
+    for entry in out:
+        # Falls back to the display list where the rows carry no system id, so
+        # a caller that does not select it is no worse off than before.
+        entry["system_count"] = (len(ids.get(entry["check_id"]) or ())
+                                 or len(entry["systems"]))
     return out
 
 
@@ -1085,6 +1107,10 @@ def findings_for_domains(scope: Optional[Sequence[int]]) -> List[Dict[str, Any]]
         # above it.
         "SELECT f.id, f.check_id, f.severity, f.priority_tier, "
         "       f.priority_score, f.state, cd.category, cd.title, "
+        # The system ITSELF, not only the name it goes by. `_distinct_risks`
+        # counts systems on this: a SID is a display label that two systems can
+        # share across landscapes, and one system carries several clients.
+        "       f.system_id, "
         "       s.sid, s.client AS system_client "
         "FROM finding f "
         "JOIN check_definition cd ON cd.check_id = f.check_id "