fix(vulnhunter-fix): pair cluster annotations by identity, not by name

vulnhunter-fix/scripts/cluster_score.py

@@ -134,10 +134,14 @@ def annotate_clusters_json(payload: dict[str, Any]) -> dict[str, Any]:
         )
         for c in raw
     ]
+    # `name` is not unique (the documented "Other clusters" overflow slot can
+    # appear twice), so pair each Cluster with its source dict by identity,
+    # not by re-deriving it from a name lookup after sorting.
+    original_by_id = {id(cluster): c for cluster, c in zip(clusters, raw)}
     sorted_clusters = sort_clusters(clusters)
     out_clusters = []
     for i, c in enumerate(sorted_clusters):
-        original = next(r for r in raw if r.get("name") == c.name)
+        original = original_by_id[id(c)]
         annotated = dict(original)
         annotated["score"] = c.score
         annotated["recommended"] = (i == 0)

vulnhunter-fix/tests/test_cluster_score.py

@@ -158,6 +158,28 @@ def test_allows_topic_derived_names(self):
             "Other clusters",
         ]
 
+    def test_duplicate_names_keep_their_own_members(self):
+        """Two clusters can legitimately share a name (the "Other clusters"
+        overflow slot, parse_issues.md Step 3(c)); each output entry must
+        carry its own members/severity_breakdown, not a same-named sibling's."""
+        payload = {
+            "clusters": [
+                {"name": "Other clusters", "members": [{"vuln": "VULN-LOW"}],
+                 "severity_breakdown": {"Low": 1}},
+                {"name": "Other clusters",
+                 "members": [{"vuln": "VULN-A"}, {"vuln": "VULN-B"}],
+                 "severity_breakdown": {"Critical": 2}},
+            ]
+        }
+        out = annotate_clusters_json(payload)
+        assert [c["score"] for c in out["clusters"]] == [16, 1]
+        assert out["clusters"][0]["members"] == [
+            {"vuln": "VULN-A"}, {"vuln": "VULN-B"},
+        ]
+        assert out["clusters"][0]["severity_breakdown"] == {"Critical": 2}
+        assert out["clusters"][1]["members"] == [{"vuln": "VULN-LOW"}]
+        assert out["clusters"][1]["severity_breakdown"] == {"Low": 1}
+
 
 class TestCli:
     def test_round_trip_via_file(self, tmp_path):