Reports: a host returning more than 1,000 rows stores nothing and the report isn't marked clipped #58658

Fleet versions

• Discovered: rc-minor-fleet-v4.95.0 (f231ce6)

Web browser and operating system: Chromium (Playwright) on macOS; also seen via the API

💥 Actual behavior

When one host returns more than 1,000 rows for a scheduled report, Fleet saves none of that host's results and the report isn't marked as clipped. The report page says "Nothing to report yet. This report has returned no data so far", and GET /api/v1/fleet/reports/:id/report returns "count": 0, "report_clipped": false, even though the host ran the report and sent its results. An admin can't tell the report ran.

Most likely to come up with wide inventory reports, e.g. a scheduled SELECT … FROM amcache_application_files (fleetd 1.64), which returned 1,544 rows on a lightly used Windows 11 VM.

🛠️ Expected behavior

The report shows that this host's results weren't saved, as it does for a report that's over the report cap: the "Report clipped" banner and report_clipped: true. (Whether to keep the first 1,000 rows or none is a product call.)

🧑‍💻 Steps to reproduce

These steps:

• Have been confirmed to consistently lead to reproduction in multiple Fleet instances.
• Describe the workflow that led to the error, but have not yet been reproduced in multiple Fleet instances.

1. Create two reports with Store data on (interval 2 min), targeting a fleet with one online host:
   • WITH RECURSIVE n(x) AS (SELECT 1 UNION ALL SELECT x+1 FROM n WHERE x < 1000) SELECT x FROM n;
   • the same with x < 1001
2. Wait for both to run, then open each report.
3. The 1,000-row report shows "1,000 results". The 1,001-row report shows "Nothing to report yet" and no clipped banner.

🕯️ More info (optional)

• server/datastore/mysql/query_results.go:33 returns early when one host's result has more than 1,000 rows, without setting Rejected. So server/service/osquery.go:4609 never sets the clipped marker. The limit is a hard-coded 1000, not report_cap.
• The early return came with Improve performance when recording schedule query results #38524 (shipped in 4.81.0). Report clipping (Get reports working for numa and cisneros #43723 / Update reports cap to allow one result per host #53122, 4.93.0) covers only the report-total cap. The other per-host limit, results over 512 KB (osquery.go:4772), does store a fetch-time row, so that host still shows as reporting.
• Workaround: run it as a live report, which isn't capped (1,544 rows came back live from the same host).