Trends and deltas

A single check answers “what is wrong now?” A sequence of runs answers “what is getting better, worse, or staying put?” Pass --state-dir and pgdba persists snapshot.json; every later run compares against it.

• baseline — the finding existed in the first recorded run
• resolved — present before, gone now
• new — not present before
• unchanged — present in both

The report’s trend block carries runs_compared and the per-finding statuses; the new and resolved transitions are what alerting usually cares about (--warning/--critical thresholds operate on absolute counts, so pair them with trend review for direction of travel).

pgdba why <finding-id> reads the last report, so a cron run + pgdba why is a complete incident drill-down with no dashboard.