A count taken from truncated output describes the window, not the data

The lesson

tail -45, head -20, a page size of 50: each is a decision about how much to look at, taken before anyone knew what they would need to count. A window truncates silently, and every row in it is a real row, so a count taken over it is a real-looking number. It is the size of the window's overlap with the data, and it is always less than or equal to the truth — never above it, so it never looks alarming.

The failure is not the truncation; trimming output to fit is sensible. It is using a view made for looking as the source of a number. Once a figure will be written down, count at the source — grep -c, wc -l on the unfiltered stream, the API's total field — never the listing you happened to scroll.

The failure that taught it

Investigating a usage report, an agent grepped an append-only event log for one session's denials and piped the result through tail -45 so it would fit on screen. It read that window, confirmed the report's shape, and wrote "that session took 13 denials" into a permanent decision record and into its summary to the user. A later check counted the same filter without the tail: 21. The first eight rows had scrolled off the top of the window, and nothing in the 45 lines shown suggested it was incomplete. The number was plausible, it supported the claim being made, and it was wrong by 40%.

How to apply it

• Before writing any count into a record, a commit message or a report, re-derive it with a command whose last stage is the counter — grep -c pattern file, ... | wc -l — with no head, tail or limit anywhere upstream.
• A head/tail piped into wc -l, grep -c or uniq -c is a counter over a window: the answer is capped by the flag, not the data. The scanner flags that shape.
• For a paginated API or UI, read the total the source reports (a count field, a header), or page to exhaustion — never multiply or read off page one.
• When a count comes out lower than expected and still plausible, that is the case to recheck. Truncation can only undercount, so it never looks alarming.

Signature tightened 2026-09-26

The first pattern allowed anything but a pipe or newline between the window and the counter, so it joined a head -5 in one command to a | wc -l in the next command on the same line (head -5; echo …; grep -o x f | wc -l). Measured over 14,324 recorded Bash commands, it matched 102, almost all of that shape, and the scanner's record for this signature was 5 dismissed and 0 changed. The defect is counting output that head or tail cut earlier in the same pipeline, so the gap now also stops at ;, & and ), the characters that end a pipeline.