[derekxmartin]

writeReportJson collects target IDs from data, but errors can be stored under an active target ID with no data rows. That leaves the target out of the report. For example, if target 1 has results and target 2 has only an error, the report includes target 1 and drops target 2.

This change collects IDs from both data and errors, so both groups are included. Ordering, deduplication, report assembly, and the empty-report fallback are unchanged. The docstring clarifies the existing format. One group produces a flat report; multiple groups use targets. Recovering an omitted group can therefore change a report from flat to targets.

Error-only groups still have no URL identity, and global errors under ID 0 are not reassigned to another target.

The patch makes one functional query change in api.py and adds 10 tests in test_report.py. On native Windows, all 17 existing report tests passed. Before the fix, four new tests failed and six passed. Afterward, all 27 passed. Testing used synthetic in-memory SQLite data and temporary JSON files, with network and subprocess calls blocked. No scans or full-project CI were run.

[stamparm]

Thank you for the report. We made our own version. Each target in the report now carries its URL, so failed targets show up with their errors instead of as anonymous error-only groups.