fix: report pinned trees the source record lacks

scripts/check_freshness.py

@@ -1242,8 +1242,10 @@ def _check_installer_pins() -> Finding:
 
 def check_source_paths(profiles: dict) -> Finding:
     """The site links a cited path only where source-paths.json records it
-    in the tree the profile pins. A recorded tree no profile pins any more
-    means a pin moved and `sitesources.py --fetch` was not run after it."""
+    in the tree the profile pins. A recorded tree no profile pins any more,
+    or a pinned tree the record lacks, means a pin moved or a profile was
+    added and `sitesources.py --fetch` was not run after it. Every tree a run
+    tries is recorded, read or not, so a lacking one was never tried."""
     import sitesources  # noqa: PLC0415
 
     pinned = {
@@ -1256,14 +1258,18 @@ def check_source_paths(profiles: dict) -> Finding:
     except (OSError, ValueError) as exc:
         return Finding("profiles", "source-paths.json", ERROR, detail=str(exc))
     orphaned = sorted(recorded - pinned)
+    unrecorded = sorted(pinned - recorded)
+    problems = [f"{len(found)} {words}" for found, words in (
+        (orphaned, "recorded trees no profile pins"),
+        (unrecorded, "pinned trees not recorded"),
+    ) if found]
     return Finding(
         "profiles",
         "source-paths.json",
-        STALE if orphaned else OK,
+        STALE if problems else OK,
         local=f"{len(recorded)} trees",
-        detail=(f"{len(orphaned)} recorded trees no profile pins: run "
-                "scripts/sitesources.py --fetch") if orphaned
-        else "every recorded tree is a pinned one",
+        detail=(", ".join(problems) + ": run scripts/sitesources.py --fetch") if problems
+        else "every pinned tree is recorded, and only those",
     )
 
 

scripts/sitesources.py

@@ -311,9 +311,9 @@ def build_source_paths(
             if tree is None:
                 unread.add(tree_key(repo, pin))
                 continue
-            found = paths & tree
-            if found:
-                held.setdefault(tree_key(repo, pin), set()).update(found)
+            # Recorded even when it holds no cited path, so a pinned tree
+            # missing from the record is one no run has read.
+            held.setdefault(tree_key(repo, pin), set()).update(paths & tree)
     return {key: sorted(paths) for key, paths in sorted(held.items())}, sorted(unread)
 
 
@@ -323,12 +323,13 @@ def keep_unread(
     """Carry over what the last record held for the trees this run could not read.
 
     A tree key names a pinned sha, so what it held then it holds now. A run
-    that GitLab rate-limited dropped about twenty trees it never read.
+    that GitLab rate-limited dropped about twenty trees it never read. A tree
+    no run could read is recorded empty: confirming no path, it links none,
+    and check_freshness tells it from a pin no run has tried.
     """
     kept = dict(held)
     for key in unread:
-        if key not in kept and key in previous:
-            kept[key] = previous[key]
+        kept.setdefault(key, previous.get(key, []))
     return dict(sorted(kept.items()))