Join our Newsletter — 33% off our NHI Course

What do teams get wrong when they rely on Compose reports without filtering for unstable functions?

A common mistake is treating every generated Compose report as equally useful. In practice, teams get more value when they merge reports across modules and keep only functions with unstable parameters, because that focuses review on real optimization candidates. Without that filtering, the signal can be noisy, making it harder to prioritise fixes that improve UI performance.

Why Unfiltered Compose Reports Mislead Optimisation Work

Compose reports are only useful when they separate stable implementation detail from functions that are still changing under experimentation. If teams review every function equally, they dilute attention across low-value findings and miss the small set of unstable paths that usually matter most for UI performance. That creates a false sense of coverage: the report looks comprehensive, but the review process is not selective enough to drive practical improvements. In practice, many teams discover the cost of noise only after they have already spent a release cycle chasing reports that never translated into measurable user experience gains.

How Filtering Changes the Review Workflow

The practical task is not to discard Compose reports, but to treat them as raw input that needs curation before anyone uses them for prioritisation. Filtering for unstable functions helps teams focus on code paths where behaviour is still likely to change, where recomposition costs may still be under active development, and where optimisation work has a clearer chance of sticking. That is especially important when reports are generated across multiple modules, because isolated module views can exaggerate importance or hide repeated patterns that only become obvious when the data is merged.

A disciplined workflow usually starts by grouping reports at the module or feature level, then removing stable functions from the working set, then ranking the remaining functions by how often they appear, how broad their call surface is, and whether they sit on hot interaction paths. That makes the report more actionable because it turns a long list into a short review queue. It also reduces the risk of polishing code that already performs adequately while leaving unstable, user-visible code untouched.

  • Merge reports across modules before judging severity, because a single-module view can overstate or understate a pattern.
  • Keep unstable functions in the review set, because they are the most likely to yield worthwhile optimisation candidates.
  • Use the filtered output to guide profiling and code review, not to replace them.

The guidance breaks down when teams treat “unstable” as a permanent label rather than a signal that should be rechecked as the codebase evolves.

When the Filter Needs Human Judgment

Filtering improves signal, but it is not a substitute for understanding why a function is unstable or whether that instability matters in the current release context. Tighter filtering often improves prioritisation, but it also increases the risk of overlooking edge cases where a seemingly stable function still sits on a critical interaction path. Teams need to balance report cleanliness against the chance of hiding a real performance issue behind an overly narrow filter.

This is one of the places where guidance-vs-consensus matters: there is broad agreement that noisy reports are hard to act on, but there is no universal consensus on a single “correct” instability threshold across applications. The safest approach is to treat the filter as a triage tool, then confirm any high-impact candidate with profiling, user-path analysis, or regression checks before making optimisation decisions. The same logic applies when report output is being used to compare releases, because changing thresholds can make trends look better or worse without changing actual app behaviour.

Practitioner takeaway: The useful question is not whether a function appears in the report, but whether it remains unstable enough to justify attention in the current release and user journey.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK address the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework Control / Reference Relevance
CIS Controls v8 8.6 — Audit Log Management Filtered report review relies on usable telemetry and signal quality.
Recommendation — Filter noisy findings so reviewers can act on the most relevant performance signals.
NIST CSF 2.0 DE.CM-1 — Monitoring for Security Events Report triage depends on monitoring output that can be interpreted accurately.
GV.2 — Roles, Responsibilities, and Authorities Merged report review needs clear ownership for deciding which findings matter.
Recommendation — Triage monitoring output to separate meaningful signals from low-value noise. Assign clear ownership for deciding which findings enter optimisation review.
MITRE ATT&CK T1036 — Masquerading Noise and ambiguity can obscure what is genuinely significant in technical output.
Recommendation — Investigate ambiguous output patterns before treating them as trustworthy indicators.

Practitioner Guidance

What to prioritise: Prioritise unstable functions that appear repeatedly across merged reports and sit on user-facing interaction paths, because those are the findings most likely to convert into measurable performance gains.

What to verify: Verify that the filtered report still reflects the current codebase, module boundaries, and release state; stale report data can make a low-value function look urgent or hide a newly important path.

Common mistake: Teams often use the report as a ranking exercise instead of a triage aid, which encourages broad review effort without proving that the candidate functions actually matter to users.

Practitioner takeaway: Filtering is valuable only when it improves decision quality, so the final test is whether the remaining functions are clear candidates for profiling, review, or optimisation.