pxl_scripts/dx: freshness reports over retention, not the picker

src/pxl_scripts/dx/evidence_graph/evidence_graph.pxl

@@ -204,10 +204,12 @@ def stack_diff(start_time: str, clickhouse_dsn: str, order_id: str):
 
 
 def freshness(start_time: str, clickhouse_dsn: str):
-    # Seconds since the newest order. Distinguishes "quiet" from "dead": an empty
-    # panel with a small age means nothing happened; a large age means nothing is
-    # arriving. Without it both render as an empty table.
-    df = px.DataFrame('dx_src__orders', clickhouse_dsn=clickhouse_dsn, start_time=start_time)
+    # Deliberately ignores start_time. Freshness is a property of the store, not
+    # of the picker: asked over the picker's window this returned an empty table
+    # whenever the window held nothing, which is the exact reading it exists to
+    # rule out. The lookback is the retention period, so an empty result here
+    # means the store holds nothing at all rather than nothing recently.
+    df = px.DataFrame('dx_src__orders', clickhouse_dsn=clickhouse_dsn, start_time='-720h')
     df.one = 1
     agg = df.groupby(['one']).agg(newest=('row_time', px.max), orders=('order_id', px.count))
     agg.age_seconds = (px.now() - agg.newest) / 1000000000

src/pxl_scripts/dx/profile_coverage/profile_coverage.pxl

@@ -18,10 +18,19 @@ import px
 
 
 def governed(start_time: str, clickhouse_dsn: str):
+    # Governed means an authored profile governs the container. It does NOT mean
+    # signed: signature verification is off on these clusters, so an unsigned
+    # authored profile is adopted and governs exactly as a signed one would.
+    # This counted signed == 1 and so reported zero for containers that are
+    # governed today. signed stays a column beside kind, never the definition.
     df = px.DataFrame('dx_profiles__latest', clickhouse_dsn=clickhouse_dsn, start_time=start_time)
-    df = df[df.signed == 1]
-    agg = df.groupby(['namespace']).agg(signed_profiles=('name', px.count))
-    return agg[['namespace', 'signed_profiles']]
+    df = df[df.kind == 'user']
+    df.verified = px.select(df.signed == 1, 1, 0)
+    df.unsigned = px.select(df.signed == 1, 0, 1)
+    agg = df.groupby(['namespace']).agg(governed=('name', px.count),
+                                        verified=('verified', px.sum),
+                                        unsigned=('unsigned', px.sum))
+    return agg[['namespace', 'governed', 'verified', 'unsigned']]
 
 
 def ungoverned(start_time: str, clickhouse_dsn: str):

src/pxl_scripts/dx/shadow_trace/shadow_trace.pxl

@@ -203,8 +203,12 @@ def creds(start_time: str, clickhouse_dsn: str, shadow_id: str):
 
 
 def freshness(start_time: str, clickhouse_dsn: str):
-    # Seconds since the newest trace update. Quiet and dead read differently here.
-    df = px.DataFrame('dx_shadow__trace', clickhouse_dsn=clickhouse_dsn, start_time=start_time)
+    # Deliberately ignores start_time. Freshness is a property of the store, not
+    # of the picker: asked over the picker's window this returned an empty table
+    # whenever the window held nothing, which is the exact reading it exists to
+    # rule out. The lookback is the retention period, so an empty result here
+    # means the store holds nothing at all rather than nothing recently.
+    df = px.DataFrame('dx_shadow__trace', clickhouse_dsn=clickhouse_dsn, start_time='-720h')
     df.one = 1
     agg = df.groupby(['one']).agg(newest=('updated_at', px.max), traces=('shadow_id', px.count))
     agg.age_seconds = (px.now() - agg.newest) / 1000000000