@herbertgao/pi-extensions 2026.8.6 → 2026.8.8

package/node_modules/pi-lens/dist/clients/project-diagnostics/fresh-fetch.js

@@ -82,11 +82,14 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { applyDispositionsMultiFile } from "../diagnostic-dispositions.js";
 import { getKnipIgnorePatterns } from "../file-utils.js";
 import { isAtOrAboveHomeDir } from "../path-utils.js";
 import { GitleaksClient } from "../gitleaks-client.js";
 import { GovulncheckClient } from "../govulncheck-client.js";
+import { isToolInstallAllowedByTrust, projectTrustDenialReason, } from "../project-trust.js";
 import { TrivyClient } from "../trivy-client.js";
+import { reasonFromAvailabilityVerdict } from "./extractors.js";
 import { deadCodeResultToProjectDiagnostics } from "./runner-adapters/dead-code.js";
 import { gitleaksResultToProjectDiagnostics } from "./runner-adapters/gitleaks.js";
 import { govulncheckResultToProjectDiagnostics } from "./runner-adapters/govulncheck.js";
@@ -141,11 +144,13 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
     // / review-graph's buildOrUpdateGraph; like the latter, there is no safe
     // substitute root to fall back to — the caller's `paths` scope only filters
     // REPORTED results, it never narrows what these analyzers walk.
+    const unsafeRootReason = "the working directory resolves at or above the home directory; heavyweight analyzers refuse to walk from there (#747)";
     if (isAtOrAboveHomeDir(analysisRoot, options.homeDir)) {
         return {
             diagnostics: [],
             runners: [],
             cold: [...ANALYZER_IDS],
+            coldReasons: Object.fromEntries(ANALYZER_IDS.map((id) => [id, unsafeRootReason])),
             failed: [],
             timings: {},
             unsafeRoot: true,
@@ -154,13 +159,46 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
     const diagnostics = [];
     const runners = [];
     const cold = [];
+    // #1623: the specific reason each `cold` id was skipped, captured at the
+    // gate that decided it — see FreshProjectDiagnosticsResult.coldReasons.
+    const coldReasons = {};
     const failed = [];
     const timings = {};
+    // #1623: ms-old each id's data was when this call read it, for lanes that
+    // are cache-reads by design (currently only test-runner — see its task
+    // below) rather than a fresh execution this call. Absent for every other
+    // key: this module's other lanes always trigger-or-join a genuine run
+    // when attempted (see the module header), so there is nothing to date.
+    const cachedAgeMs = {};
     const settledIds = new Set();
+    let dispositionSuppressed = 0;
+    const dispositionSuppressedByLane = {};
+    // #1617: this is the ONE choke point every analyzer's findings pass
+    // through on the way into `diagnostics`, so applying the agent/user
+    // disposition filter HERE covers the whole mode=full class (knip/jscpd/
+    // madge/gitleaks/govulncheck/opengrep/trivy/dead-code) in one place — the
+    // same anchor derivation `dispatcher.ts:924` uses, via
+    // `applyDispositionsMultiFile` (`diagnostic-dispositions.ts`), not a
+    // second cloned filter. Unlike the dispatch path's one-file-at-a-time
+    // shape, a project-wide scan's findings span many files, so this groups by
+    // each diagnostic's own `filePath` and reads each file's current content
+    // once — see that function's doc for the fail-open contract when a file
+    // can't be read.
+    function markCold(id, reason) {
+        pushUnique(cold, id);
+        coldReasons[id] = reason;
+    }
     function record(id, adapted, elapsedMs) {
         timings[id] = (timings[id] ?? 0) + elapsedMs;
-        if (adapted.length > 0) {
-            diagnostics.push(...adapted);
+        const kept = applyDispositionsMultiFile(adapted, analysisRoot, (d) => d.filePath);
+        const suppressedHere = adapted.length - kept.length;
+        dispositionSuppressed += suppressedHere;
+        if (suppressedHere > 0) {
+            dispositionSuppressedByLane[id] =
+                (dispositionSuppressedByLane[id] ?? 0) + suppressedHere;
+        }
+        if (kept.length > 0) {
+            diagnostics.push(...kept);
             pushUnique(runners, id);
         }
     }
@@ -194,7 +232,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
         // detection, exactly mirroring session_start's own logic.
         task("jscpd", async () => {
             if (!(await clients.jscpdClient.ensureAvailable())) {
-                cold.push("jscpd");
+                markCold("jscpd", reasonFromAvailabilityVerdict("jscpd", clients.jscpdClient.getAvailabilityVerdict?.()));
                 return;
             }
             const isTsProject = fs.existsSync(path.join(analysisRoot, "tsconfig.json"));
@@ -213,7 +251,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
         // madge — circular-dependency detection.
         task("madge", async () => {
             if (!(await clients.depChecker.ensureAvailable())) {
-                cold.push("madge");
+                markCold("madge", reasonFromAvailabilityVerdict("madge", clients.depChecker.getAvailabilityVerdict?.()));
                 return;
             }
             const startMs = Date.now();
@@ -234,11 +272,11 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
         // "cold" on a project with no explicit gitleaks config.
         task("gitleaks", async () => {
             if (!GitleaksClient.hasGitRepo(analysisRoot)) {
-                cold.push("gitleaks");
+                markCold("gitleaks", "not a git repository (no .git found)");
                 return;
             }
             if (!(await clients.gitleaksClient.ensureAvailable())) {
-                cold.push("gitleaks");
+                markCold("gitleaks", reasonFromAvailabilityVerdict("gitleaks", clients.gitleaksClient.getAvailabilityVerdict?.()));
                 return;
             }
             const startMs = Date.now();
@@ -257,11 +295,22 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
         // govulncheck — Go module CVE detection. Go-module-gated per #132.
         task("govulncheck", async () => {
             if (!GovulncheckClient.hasGoModule(analysisRoot)) {
-                cold.push("govulncheck");
+                markCold("govulncheck", "no go.mod found (not a Go module)");
                 return;
             }
             if (!(await clients.govulncheckClient.ensureAvailable())) {
-                cold.push("govulncheck");
+                // #1623 fix-round F1: `GovulncheckClient.doEnsureAvailable` has a
+                // branch (`assertInstallAllowed`, govulncheck-client.ts) that returns
+                // false WITHOUT ever touching its availability latch — a
+                // project-trust install denial, deliberately not latched so a later
+                // trust grant can retry (see that file's own comment). The latch's
+                // verdict is genuinely absent in that case, not merely unread, so
+                // check trust denial FIRST via the same taxonomy project-trust.ts
+                // already exposes, and only fall back to the probe-based verdict
+                // (a real timeout/absence) when trust isn't the reason.
+                markCold("govulncheck", isToolInstallAllowedByTrust()
+                    ? reasonFromAvailabilityVerdict("govulncheck", clients.govulncheckClient.getAvailabilityVerdict?.())
+                    : (projectTrustDenialReason() ?? "govulncheck binary unavailable"));
                 return;
             }
             const startMs = Date.now();
@@ -291,7 +340,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
         // `lens_diagnostics mode=full` — the honesty gap (#533) this task closes.
         task("opengrep", async () => {
             if (!(await clients.opengrepClient.ensureAvailable())) {
-                cold.push("opengrep");
+                markCold("opengrep", reasonFromAvailabilityVerdict("opengrep", clients.opengrepClient.getAvailabilityVerdict?.()));
                 return;
             }
             const startMs = Date.now();
@@ -308,11 +357,11 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
         // trivy — dependency CVE detection. Explicit opt-in per #131.
         task("trivy", async () => {
             if (!TrivyClient.shouldScan(analysisRoot)) {
-                cold.push("trivy");
+                markCold("trivy", "not opted in (.pi-lens.json trivy.enabled) or no dependency manifest found");
                 return;
             }
             if (!(await clients.trivyClient.ensureAvailable())) {
-                cold.push("trivy");
+                markCold("trivy", reasonFromAvailabilityVerdict("trivy", clients.trivyClient.getAvailabilityVerdict?.()));
                 return;
             }
             const startMs = Date.now();
@@ -332,7 +381,7 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
         task("dead-code", async () => {
             const applicable = clients.deadCodeClients.filter((c) => c.detect(analysisRoot));
             if (applicable.length === 0) {
-                cold.push("dead-code");
+                markCold("dead-code", "no dead-code client detected an applicable language for this project");
                 return;
             }
             await Promise.all(applicable.map(async (client) => {
@@ -380,9 +429,16 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
             const startMs = Date.now();
             const cached = cacheManager.readCache("test-runner-findings", analysisRoot);
             if (!cached?.data) {
-                cold.push("test-runner");
+                markCold("test-runner", "no turn_end test-runner cache entry yet this session");
                 return;
             }
+            // #1623: unlike every other lane in this module, test-runner is a
+            // cache-read BY DESIGN (see the task's own header comment above) — it
+            // never performs a fresh run this call, so its age must be surfaced
+            // the same way a genuinely-stale cache read would be, rather than
+            // looking indistinguishable from a lane that just executed.
+            cachedAgeMs["test-runner"] =
+                Date.now() - new Date(cached.meta.timestamp).getTime();
             record("test-runner", testRunnerFindingsToProjectDiagnostics(cached.data, analysisRoot, options.runtime), Date.now() - startMs);
         }),
     ];
@@ -414,11 +470,25 @@ export async function fetchFreshProjectDiagnostics(cacheManager, cwd, clients, s
             diagnostics,
             runners,
             cold,
+            coldReasons,
             failed,
             timings,
+            cachedAgeMs,
             aborted: true,
             abortedIds,
+            dispositionSuppressed,
+            dispositionSuppressedByLane,
         };
     }
-    return { diagnostics, runners, cold, failed, timings };
+    return {
+        diagnostics,
+        runners,
+        cold,
+        coldReasons,
+        failed,
+        timings,
+        cachedAgeMs,
+        dispositionSuppressed,
+        dispositionSuppressedByLane,
+    };
 }

package/node_modules/pi-lens/dist/clients/project-diagnostics/runner-adapters/gitleaks.js

@@ -2,19 +2,31 @@ import * as path from "node:path";
 /**
  * A gitleaks finding is a leaked secret at a concrete `file:startLine`. Secrets
  * are treated as **blocking** — a committed credential is not a style nit.
+ *
+ * Exception: `pathStatus: "scratch"` (#1562 review-round F2) — a finding
+ * `classifyAndFilterFindings` demoted rather than dropped, so the observability
+ * criterion ("record carries tracked/ignored/scratch status") stays honest
+ * about a fourth REACHABLE value instead of silently deleting it. Demoted to
+ * `severity: "info"`/`semantic: "none"` so it can never read as a blocking
+ * "leaked secret" alarm, while remaining visible for an audit read.
  */
 export function gitleaksFindingToProjectDiagnostic(cwd, finding) {
+    // #1562 observability criterion: surface the git status right in the
+    // finding's message so a triage is a read, not a re-derivation. Omitted
+    // when git itself degraded (`pathStatus` undefined) rather than guessed.
+    const statusSuffix = finding.pathStatus ? ` [git: ${finding.pathStatus}]` : "";
+    const isScratch = finding.pathStatus === "scratch";
     return {
         filePath: path.isAbsolute(finding.file)
             ? finding.file
             : path.resolve(cwd, finding.file),
         line: finding.startLine,
-        severity: "error",
-        semantic: "blocking",
+        severity: isScratch ? "info" : "error",
+        semantic: isScratch ? "none" : "blocking",
         tool: "gitleaks",
         runner: "gitleaks",
         rule: `gitleaks:${finding.ruleId}`,
-        message: `Potential secret: ${finding.description || finding.ruleId}`,
+        message: `Potential secret: ${finding.description || finding.ruleId}${statusSuffix}`,
         source: "project-scan",
     };
 }

package/node_modules/pi-lens/dist/clients/project-diagnostics/runner-adapters/trivy.js

@@ -24,8 +24,56 @@ export function trivyFindingToProjectDiagnostic(cwd, finding) {
         source: "project-scan",
     };
 }
+/**
+ * A trivy *secret* finding (`TrivyResult.secrets`) is a leaked credential at a
+ * concrete `file:line` — the trivy-scanned sibling of
+ * `gitleaksFindingToProjectDiagnostic`, and treated the same way: **blocking**,
+ * since a committed credential is not a style nit.
+ *
+ * Rule id is namespaced `trivy-secret:<ruleId>`, deliberately distinct from the
+ * CVE lane's `trivy:<vulnerabilityId>` (#1628) — trivy's own rule-id spaces for
+ * secrets and CVEs are independent, so without this prefix a secret rule id
+ * could collide with a vulnerability id and silently share (or steal) that
+ * finding's disposition anchor.
+ */
+export function trivySecretFindingToProjectDiagnostic(cwd, finding) {
+    return {
+        filePath: path.isAbsolute(finding.file)
+            ? finding.file
+            : path.resolve(cwd, finding.file),
+        line: finding.line,
+        severity: "error",
+        semantic: "blocking",
+        tool: "trivy",
+        runner: "trivy",
+        rule: `trivy-secret:${finding.ruleId}`,
+        message: `Potential secret: ${finding.title || finding.ruleId}`,
+        source: "project-scan",
+    };
+}
+function trivySecretsToProjectDiagnostics(cwd, secrets) {
+    return secrets.map((finding) => trivySecretFindingToProjectDiagnostic(cwd, finding));
+}
+/**
+ * Adapts BOTH of trivy's finding kinds from one scan pass — CVEs (`findings`)
+ * and secrets (`secrets`, #1628) — into the single `ProjectDiagnostic[]`
+ * `lens_diagnostics mode=full` surfaces. Before #1628, `secrets` was silently
+ * unread here: a trivy-only secret (no gitleaks/ast-grep corroboration) had no
+ * `lens_diagnostics`-visible identity at all for an agent to anchor a mark
+ * against, even though `runtime-turn.ts`'s turn_end gate already blocked on it.
+ */
 export function trivyResultToProjectDiagnostics(cwd, result) {
-    if (!result.success || result.findings.length === 0)
+    if (!result.success)
         return [];
-    return result.findings.map((finding) => trivyFindingToProjectDiagnostic(cwd, finding));
+    return [
+        ...(result.findings ?? []).map((finding) => trivyFindingToProjectDiagnostic(cwd, finding)),
+        // `secrets` defaults to `[]` here rather than assuming the field is
+        // always present: `fetchFreshProjectDiagnostics` swallows a task
+        // rejection into a silent "completed" outcome (its
+        // `.catch(() => "completed")`), so an unguarded `.map` on a missing
+        // field here would drop this lane's CVE diagnostics too, not just the
+        // secrets — a caller-visible regression for a field this adapter
+        // doesn't itself require.
+        ...trivySecretsToProjectDiagnostics(cwd, result.secrets ?? []),
+    ];
 }

package/node_modules/pi-lens/dist/clients/project-diagnostics/scanner.js

@@ -89,6 +89,11 @@ function fromDispatchDiagnostic(diagnostic, runner) {
  */
 async function scanFileMajorRules(cwd, files, signal) {
     const client = getSharedTreeSitterClient();
+    // #1715: grow the tree cache to span this scan's working set BEFORE
+    // parsing starts, so a project bigger than the interactive default (50
+    // entries) still gets cross-scan reuse instead of every file re-parsing
+    // on every scan.
+    client?.ensureTreeCacheCapacity(files.length);
     const treeSitterReady = !!client && client.isAvailable() && (await client.init());
     // Same singleton the dispatch runner uses (tree-sitter.ts:444) — memoized
     // per root, so repeated scans stop re-reading the ~180 query YAMLs.
@@ -283,17 +288,26 @@ async function scanFileMajorRules(cwd, files, signal) {
             // phase-major scans.
             durationMs: Date.now() - startedAt - astGrepDurationMs,
             stats,
+            // #1935 review: ast-grep's own cost is often a scan's most expensive
+            // phase (production evidence: 13168ms over 86 files, the single
+            // biggest contributor). Its duration is subtracted above so it stays
+            // comparable to the historical phase-major scans; carry it here too
+            // so it stays visible SOMEWHERE instead of disappearing when the
+            // vacuous `project_diagnostics_ast_grep_scan` cache_stats record
+            // (below) was removed.
+            astGrep: { durationMs: astGrepDurationMs, fileCount: astGrepFilesScanned },
         });
     });
-    await client.withParseCacheMeasurement(async () => { }, (stats) => {
-        logTreeSitterCacheStats({
-            scope: "project_diagnostics_ast_grep_scan",
-            filePath: cwd,
-            fileCount: astGrepFilesScanned,
-            durationMs: astGrepDurationMs,
-            stats,
-        });
-    });
+    // #1935: no `project_diagnostics_ast_grep_scan` cache_stats record here.
+    // `scanAstGrepFile` parses through ast-grep-napi's own `lang.parse()` — a
+    // separate native engine, not `TreeSitterClient`'s WASM `TreeCache` — so a
+    // cache_stats record for this scope would always read all-zero (0
+    // lookups, 0 hits, every counter 0) no matter how the scan behaves. That
+    // was a vacuous observability record, not a real one: it looked like a
+    // signal but could never carry information. `astGrepDurationMs` and
+    // `astGrepFilesScanned` still feed the `project_diagnostics_scan` record
+    // above (`astGrep` sub-field), so this cost stays observable without a
+    // second, always-zero record to carry it.
     return { treeSitter, factRules, astGrep, filesScanned, wasmAborted };
 }
 export async function scanProjectDiagnostics(options) {

package/node_modules/pi-lens/dist/clients/project-lens-config.js

@@ -84,6 +84,9 @@ const PROJECT_OWN_CONFIG_KEYS = [
     "maxProjectFiles",
     "reviewGraph",
     "trivy",
+    // `helm.renderValidation.enabled` — the opt-in for rendered-manifest
+    // validation, read via `.raw` in the helm-render runner (#1283).
+    "helm",
 ];
 /** Clamp bounds for `reviewGraph.maxFiles` — see the field's doc comment above. */
 const REVIEW_GRAPH_MAX_FILES_MIN = 100;

package/node_modules/pi-lens/dist/clients/project-report.js

@@ -36,6 +36,7 @@
 import * as path from "node:path";
 import { normalizeMapKey, toProjectRelativePath } from "./path-utils.js";
 import { loadProjectSnapshotWithoutWordIndex } from "./project-snapshot.js";
+import { formatReviewGraphRevisionDriftNote, } from "./review-graph/revision-drift.js";
 const DEFAULT_LIMIT = 10;
 const STALE_THRESHOLD_MS = 15 * 60_000; // 15 minutes
 const LOW_COVERAGE_THRESHOLD = 0.8;
@@ -113,7 +114,11 @@ function buildFileDegrees(graph) {
     return { fanIn, fanOut };
 }
 // --- section 1: trust header --------------------------------------------------
-function computeTrust(graph, cwd) {
+function computeTrust(graph, cwd, 
+// Passed in rather than looked up here: the builder is imported dynamically
+// by `projectReport` to keep the module graph acyclic, and the value must be
+// computed per render, never cached (#1961 review F3).
+drift) {
     const filesCovered = graph.fileNodes.size;
     const snapshot = loadProjectSnapshotWithoutWordIndex(cwd);
     const snapshotFileCount = snapshot ? Object.keys(snapshot.files).length : 0;
@@ -151,6 +156,11 @@ function computeTrust(graph, cwd) {
     const lowCoverage = coverage < LOW_COVERAGE_THRESHOLD ||
         graph.persistCoverage?.partial === true;
     const notes = [];
+    // #1961: the blind read now SERVES a snapshot stamped at a different HEAD
+    // rather than dropping it. Age alone would not catch a branch switch made
+    // minutes ago, so the revision difference gets its own note.
+    if (drift)
+        notes.push(formatReviewGraphRevisionDriftNote(drift));
     if (stale) {
         const ageMin = Math.round(ageMs / 60_000);
         notes.push(`Graph is stale: built ${ageMin}m ago. Sections below may miss recent edits — run pilens_rebuild or re-analyze to refresh.`);
@@ -184,6 +194,7 @@ function computeTrust(graph, cwd) {
             sampleSize,
         },
         stale,
+        ...(drift ? { revisionDrift: drift } : {}),
         lowCoverage,
         persistCoverage: graph.persistCoverage?.partial
             ? graph.persistCoverage
@@ -493,25 +504,23 @@ const inFlightGraphBuilds = new Set();
 export function _resetProjectReportBuildGuardForTests() {
     inFlightGraphBuilds.clear();
 }
-function triggerBackgroundGraphBuild(cwd) {
+function triggerBackgroundGraphBuild(cwd, deps) {
     const key = normalizeMapKey(path.resolve(cwd));
     if (inFlightGraphBuilds.has(key))
-        return false;
+        return "already_running";
+    // Ask the builder, not just this module's own guard: a build kicked off by
+    // the edit pipeline or another reader never touches `inFlightGraphBuilds`.
+    // The probe and the call are in ONE synchronous block on purpose — awaiting
+    // between them (the pre-#1962 dynamic imports did) reopens the race.
+    const deduped = deps.isGraphBuildInFlight(key, []);
     inFlightGraphBuilds.add(key);
-    void (async () => {
-        try {
-            const { buildOrUpdateGraph } = await import("./review-graph/builder.js");
-            const { FactStore } = await import("./dispatch/fact-store.js");
-            await buildOrUpdateGraph(key, [], new FactStore());
-        }
-        catch {
-            // buildOrUpdateGraph records the durable failure and surfaced status.
-        }
-        finally {
-            inFlightGraphBuilds.delete(key);
-        }
-    })();
-    return true;
+    const build = deps
+        .buildOrUpdateGraph(key, [], new deps.FactStore())
+        .catch(() => {
+        // buildOrUpdateGraph records the durable failure and surfaced status.
+    });
+    void build.finally(() => inFlightGraphBuilds.delete(key));
+    return deduped ? "already_running" : "started";
 }
 // --- entry point ---------------------------------------------------------------
 /**
@@ -523,7 +532,7 @@ export async function projectReport(cwd, options) {
     const limit = clampLimit(options?.limit);
     const focusTerms = normalizeFocus(options?.focus);
     const view = options?.view;
-    const { getCachedReviewGraph, getReviewGraphSizeSkipVerdict, getLastReviewGraphBuildAttempt, } = await import("./review-graph/builder.js");
+    const { getCachedReviewGraph, getReviewGraphSizeSkipVerdict, getLastReviewGraphBuildAttempt, buildOrUpdateGraph, isGraphBuildInFlight, getReviewGraphRevisionDrift, } = await import("./review-graph/builder.js");
     let graph;
     try {
         graph = getCachedReviewGraph(cwd);
@@ -556,22 +565,48 @@ export async function projectReport(cwd, options) {
             };
         }
         const previousAttempt = getLastReviewGraphBuildAttempt(cwd);
-        const kickedOff = triggerBackgroundGraphBuild(cwd);
-        const lastBuildAttempt = previousAttempt ?? getLastReviewGraphBuildAttempt(cwd);
+        const { FactStore } = await import("./dispatch/fact-store.js");
+        const trigger = triggerBackgroundGraphBuild(cwd, {
+            buildOrUpdateGraph,
+            isGraphBuildInFlight,
+            FactStore,
+        });
+        const started = trigger === "started";
+        // #1962: report the attempt that is CURRENT. When this call started a
+        // build, `buildOrUpdateGraph` has already recorded a fresh `running`
+        // attempt synchronously, and the previous outcome belongs in the hint
+        // text, not in a field labelled "last attempt". When no build started,
+        // the earlier attempt genuinely IS the current one.
+        const lastBuildAttempt = started
+            ? (getLastReviewGraphBuildAttempt(cwd) ?? previousAttempt)
+            : previousAttempt;
+        // A terminal previous outcome is the useful half of the message: it says
+        // WHY the graph is missing. It is prefixed to whichever verdict follows,
+        // rather than selecting between two parallel sentence pairs — the first
+        // version of this branch did that, and its terminal-plus-deduped arm was
+        // unreachable (#1962 review F1). A pending build always records a
+        // `running` attempt synchronously, so "terminal" and "not started" cannot
+        // both hold for the same key.
+        const terminal = previousAttempt?.outcome === "failed" ||
+            previousAttempt?.outcome === "skipped";
+        const cause = terminal
+            ? `Review graph unavailable: ${previousAttempt?.reason ?? previousAttempt?.outcome}. `
+            : "";
         return {
             available: false,
-            hint: lastBuildAttempt?.outcome === "failed" ||
-                lastBuildAttempt?.outcome === "skipped"
-                ? `Review graph unavailable: ${lastBuildAttempt.reason ?? lastBuildAttempt.outcome}. A retry was ${kickedOff ? "started" : "not started"}.`
-                : kickedOff
-                    ? "No review graph cached for this workspace yet — a build was kicked off in the background; retry this call shortly."
-                    : "No review graph cached for this workspace yet — the background build is still running; retry this call shortly.",
+            hint: started
+                ? terminal
+                    ? `${cause}A retry was started.`
+                    : "No review graph cached for this workspace yet — a build was kicked off in the background; retry this call shortly."
+                : `${cause}A build is already running for this workspace; retry this call shortly.`,
             ...(lastBuildAttempt ? { lastBuildAttempt } : {}),
             ...(view ? { view } : {}),
         };
     }
     const degrees = buildFileDegrees(graph);
-    const trust = computeTrust(graph, cwd);
+    // Computed on THIS render, from the workspace entry's stamped commit and the
+    // worktree's HEAD right now — never from a value cached beside the graph.
+    const trust = computeTrust(graph, cwd, getReviewGraphRevisionDrift(cwd));
     const hubs = await computeHubs(graph, degrees, cwd, limit, focusTerms);
     const { entryPoints, entryPointFiles } = computeEntryPoints(graph, degrees, cwd, limit, focusTerms);
     const subsystems = computeSubsystems(graph, cwd, limit);