Metrics

BRD §13's headline alert KPI, and the number ADR-0017 says an MLRO manages by.

`rate` is null whenever either component was suppressed, or when nothing closed in the window. Publishing "3%" against a visible denominator of 100 republishes the numerator that was suppressed for a reason, and one division is not a defence. "0% false positives" and "nothing was closed" are opposite reports of the same fact, so the second is an absent rate rather than a zero.

`breakdown` carries every closing disposition rather than only the numerator: an MLRO managing false positives needs to see what the other closures were.

BRD §8.8's ageing tile, computed in the database over every open case rather than in the browser over a bounded page of them. The dashboard previously derived this from `?limit=100`: at a microfinance bank that is wasteful, at a tier-1 bank the tile describes the first hundred rows and looks exactly as confident as a correct one.

What a dashboard should render before it renders a single tile: per stream, whether anybody publishes it and when they last did. A stream that stopped being published a fortnight ago must not read as a quiet fortnight, and a stream nobody has ever published must name the module that owes it.

`review_queue.pending_screening_hits` is the one live count on this surface and is deliberately NOT an analytics metric. It is a count of work in progress rather than a KPI over a period, screening already owns it, and routing it through a published fact would add publication lag to a number whose entire value is being current (ADR-0027).

BRD §8.8-05..10's aggregate executive surface. Risk is the complete CURRENT active customer book at `risk_as_of`; the filing window does not filter customers by their relationship start and is not presented as historical risk. `historical_risk_available` remains false until an append-only/SCD risk source exists.

Sector is derived from the legal party's shipped industry vocabulary or the natural party's bounded occupation risk codes. Unknown/free-text values collapse to `other`, and geography admits only a two-letter code or `UNKNOWN`, so a suppressed cell label cannot itself contain a customer's name. Counts below five are replaced by null inside SQL and complementary cells are withheld in the service. Projection coverage compares analytics' active rows with onboarding's authoritative active-customer control total; matrices are withheld when those differ. Every successful read is appended to the tenant audit chain.

Computes one ExecutiveAnalytics object and serialises that same object once; the CSV path does not issue a second query. Content-Disposition names the artifact, Digest and X-Content-SHA256 identify its exact bytes, and the query plus digest are appended to the tenant's audit chain before any bytes leave the process.

Reporting creates deadlines from governed reporting.deadlines configuration, publishes each current state, sweeps breached items and marks submitted filings met. A tenant for which the stream has never been published still returns UNAVAILABLE, never a confident zero; `coverage.reason` names reporting and freshness remains visible.

Configured intervals retain their compliance-validation provenance rather than being presented here as hard-coded statutory claims.

How long hits have been waiting, which the pending count on the dashboard has never been able to say. Forty hits raised this morning and forty raised five weeks ago are the same tile and are not the same institution, and the second one is what an examiner opens with.

Counts only hits that are still pending. A decided hit has an age, but "how long did we take" and "how long has this been sitting" are different questions, and conflating them is how an ageing chart improves by deciding nothing. The bands are the same ones the case ageing panel uses, so the two can be read side by side without rescaling.

BRD §8.4-08 asks for configurable match sensitivity balancing false positives against risk. This is the half of that sentence the product could not previously show.

Screening is the highest-volume false-positive generator in the platform — one common surname against a consolidated sanctions list produces hits by the thousand — and until the `screening.outcome` stream existed the only number held about it was a live count of the pending queue. Nothing said how many decided hits were wrong, so a tenant moving `screening.match.threshold` was turning a dial with no gauge attached.

Identical semantics to the alert rate, deliberately: `rate` is null whenever either component was suppressed or nothing was decided in the window, and `breakdown` carries every disposition — `true_positive`, `false_positive` and `suppressed` — because the other decisions are what make the rate interpretable. A hit cleared by a standing suppression is counted as decided at the instant it was raised, since the human decision it rests on was made before the hit existed.