CHANGELOG: the 2026-09-18 board — fifty-four entries from two seats' fifty-nine merged PRs, spliced once

[erikdarlingdata]

What this is

Fifty-nine PRs merged to dev on 2026-09-18 across two seats — the coordinator's lanes and the wave-2 worker's — and by rule none of them touched CHANGELOG.md: each returned its entry to a buffer so that fifty-plus PRs would not each rebase the same twenty lines of [Unreleased]. This is the one splice. Docs-only; one file.

Mechanism

• 54 entries land under ## [Unreleased]: 6 under a new ### Added (placed above ### Fixed, Keep-a-Changelog order — Added, Changed, Fixed) and 48 appended to ### Fixed after the 21 wave-1 bullets, in PR-number order. [Unreleased] goes from 21 to 75 bullets.
• Riders fold into their parent's entry, one line per pair, as the buffers already wrote them: Lite's get_query_trend carries the same source/effective_start/truncated block its Darling twin has had since #2353, so the last cross-SKU envelope mismatch in the trend family closes (#3541 A2 follow-up) #3599 under The duration-trend trio routes by retention tier and discloses its source like get_query_trend already does, so a 7-day request no longer returns 4 days labelled quiet (#3541 A2) #3590, Two TimescaleSupport doc sentences #3610 falsified are corrected: the job_history evidence read lives on StoreSelfMetrics with two callers, and an unlogged store still records FAILED runs (#3581 riders) #3619 under The twenty continuous aggregates join the compression ladder: compress_after derived from each tier's refresh window, a once-a-day band off the hourly grid, and the backlog staged one aggregate per night, largest first (#3581) #3611, ObservedHours states what its zero-coverage fallback defends and pins it: the nominal window, never a near-zero divisor, moot behind the collectors' unobserved guard (#3538 A7 follow-through from #3616 review) #3623 under The scorer's wait thresholds carry their measurement: WRITELOG stops saturating on a third of routine windows, deadlocks grade 5/hr apart from 90/hr, and the absolute gates scale with the hours actually observed (#3538 A5/A7) #3616, IAlertDeliverer.DeliverAndReportAsync is required, not defaulted: CONTRIBUTING names this seam, so Lite's deliverer and every fake state their answer by hand (#3580 follow-up) #3640 under The daily digest and sweep rollup asked 'did I send' when the channel asks 'was it delivered': the once-a-day gate now stamps delivered-today in the store, so a restart re-announces nothing and a failed delivery still retries (#3580) #3633. Swapping the theme-text provider empties the stock-palette cache (#3577 review follow-up) #3617 (test-only follow-up to The operator can maintain the twelve palette colors of each theme from Settings, with a measured contrast readout and a reset to default (#3577, arm B) #3606) and The Darling viewer's trend charts and calendar tell the same truth the MCP tools learned today: routed by retention tier and saying so, no fabricated first point, and a purged day is grey, not green (#3653 viewer ports) #3661 (same head as The Darling viewer's trend charts and calendar tell the same truth the MCP tools learned today: routed by retention tier and saying so, no fabricated first point, and a purged day is grey, not green (#3653 viewer ports) #3666, closed and re-cut) carry no entry by design.
• A Claude review that posted nothing no longer finishes green: read-only tools end the denial churn, the job fails when no verdict was submitted, and the transcript survives the runner #3657 is in. It merged to dev at 1dae2ade (gh pr view 3657 --json state → MERGED); the twin to main (A Claude review that posted nothing no longer finishes green: read-only tools end the denial churn, the job fails when no verdict was submitted, and the transcript survives the runner (main copy, lands first) #3656, closed) is what is still pending under the release train. The entry describes the dev workflow, which is what shipped.
• Every entry is one line. tools/changelog/changelog_archive.py's compact() reads the first bold span as the title and folds the entry's [#N]s after it; a wrapped entry would archive as two. Shape matches the file byte-for-byte: - **Title** ([#N]) - prose, ([#N], [#M]) for the one two-issue entry (The log said what the spill cost and what the vacuum cost, and the store kept the sentence: two parser families lift bytes and run figures into V130 columns of pg_log_events, and autovacuum health shows per-table run cost beside the catalog (#3602, #3603) #3664 → Per-event temp spill attribution from log_temp_files — counters know a database spilled, not which execution spilled 4 GB at 03:07 #3602, Autovacuum per-run cost from log_autovacuum_min_duration — the health view says whether it ran, not what it cost #3603). Annotated parentheticals (([#3541] A2), ([#3542] v1 plumbing)) follow the released precedent of ([#2138] phase 1) and ([#1840] review).
• 36 reference definitions added — one for every [#N] the new entries cite that the index did not already define. The [Unreleased] definition group (the leading run before 3.8.0's) is now one ascending run of 57; the only deleted line in the diff is [#3557], which sat after [#3563] and moved into its sorted slot. Context refs [#2159], [#2711], [#3287] were already defined and are reused; bare #3579-style mentions inside prose need no definition (house style, e.g. the get_memory_trend: join the grants series so total_granted_mb carries real data (complete fix for #3529) #3548 bullet). All 36 verified as issues, not PRs, so the /issues/N path is right. Definitions: 1,331 → 1,367.
• Nothing under ## [3.8.0] or older is touched. The archive script was not run (split is for the release cut).
• One editorial touch, stated: the buffered get_store_metrics: the job_history block said 'recording' and never said whose eyes the rows are visible to — it now evaluates the view's ownership filter for its own reader and proves rows exist where it can (#3574) #3585 entry ended in a dangling word — …produced by construction. Darling — and now reads Darling only. (get_store_metrics exists only in the Darling MCP host; verified by grep).

Added vs Fixed — the judgment

New capabilities are Added; honesty fixes to existing surfaces are Fixed.

PR	Issue	Why Added
#3606	#3577 arm B	A Settings Colors section, per-user theme-overrides.json, live re-apply — a feature that did not exist (flagged Added by the lane).
#3668	#3598	A new config_notification_routes table (V131), a closed family taxonomy, three MCP tools, a viewer grid, hot-reload — new routing capability (flagged Added by the lane).
#3643	#3607	get_pg_logging_audit is a new MCP tool; nothing existing was corrected.
#3645	#3604	A service-side wait sampler is a new third instrument tier for PostgreSQL targets; the "empty chart" it replaces was the absence of a capability, not a wrong reading.
#3646	#3601	New collector (collect.pg_log_events, V129), new shared tailer, new get_pg_log_events tool.
#3664	#3602, #3603	New parser families and V130 columns on that collector, plus recent_runs on get_pg_autovacuum_health — extends #3646's new capability rather than correcting an existing surface.

One I left in Fixed per the brief's "everything else" rule but would flag for a second look: #3665 (#3542 v1 plumbing, "PostgreSQL targets enter the analysis pipeline"). Its branch is feat/, it introduces a pg_ fact vocabulary and a second engine component set, and "no schema, no content" is true but it is still a capability PostgreSQL targets did not have. If the coordinator reads it as Added it is a one-line move. The feat/3540-* pair (#3595 V127, #3630 V128) stays Fixed with confidence: the schema columns exist to stop a fabricated 0.00 reading, which is an honesty fix.

Audit trail — every entry's PR → issue

#	Section	PR(s)	Issue(s)	Seat	Title
1	Added	#3606	[#3577]	coordinator	Maintain your own theme colors, per theme, with a reset to default
2	Added	#3643	[#3607]	coordinator	A PostgreSQL target with every logging setting off no longer looks identical to an instrumented one
3	Added	#3645	[#3604]	coordinator	A stock PostgreSQL target without pg_wait_sampling now has a wait profile instead of an empty chart
4	Added	#3646	[#3601]	coordinator	PostgreSQL's server log is read by a classifier, not by two regexes
5	Added	#3664	[#3602], [#3603]	coordinator	The log said what the spill cost and what the vacuum cost; the store kept the sentence and threw away the number
6	Added	#3668	[#3598]	coordinator	Alert families route to their own channels
7	Fixed	#3583	[#3576]	coordinator	The Locking & Contention grid names the table as schema.table
8	Fixed	#3584	[#3526]	wave-2	Extreme, corroborated anomaly findings can now cross the notify floor, so the baseline engine is no longer notification-inert at shipped settings
9	Fixed	#3585	[#3574]	coordinator	get_store_metrics' job_history block now says whose eyes its rows are visible to, and proves rows exist where it can
10	Fixed	#3586	[#3573]	coordinator	The forced-plan-failures alert read no longer walks the whole fleet's two-hour slice of Query Store rows to find one server's
11	Fixed	#3587	[#3570]	coordinator	The viewer's tray Snooze now silences the toast itself
12	Fixed	#3588	[#3575]	coordinator	The compression-stuck self-alert no longer pages on a healthy job's run instant
13	Fixed	#3589	[#3577]	coordinator	Text on an accent fill gets a measured ink in every theme, and the FinOps row marks become theme brushes Dark can actually see
14	Fixed	#3590, #3599	[#3541] A2	wave-2	The duration-trend trio routes by retention tier and says what it served, so a 7-day request no longer returns 4 days labelled quiet
15	Fixed	#3592	[#3538] A2	wave-2	Analysis facts divide by the time the collector actually observed, and a window with a hole in it says so
16	Fixed	#3593	[#3539] A4	wave-2	SQL Server's Poison Wait alert measures accumulated starvation over a ten-minute window like its PostgreSQL twin, so one slow wait no longer pages and a THREADPOOL storm no longer sleeps
17	Fixed	#3594	[#3541]	wave-2	Six MCP pages now say what bounded them, so a limited page stops passing for a complete answer
18	Fixed	#3595	[#3540]	wave-2	The four naked delta families store the interval their deltas accrued over, so a restart's fabricated zero reads as unknowable instead of 0.00 ms/sec
19	Fixed	#3596	[#3539] A2/A3/A8d	wave-2	Blocking and CPU health bands are rates over the window they were measured in, tiered from 14 days of fleet blocking and CPU data
20	Fixed	#3610	[#3582]	coordinator	get_store_metrics stops answering for 38% of the store: continuous aggregates and the named plain tables join the inventory, every sweep is reconciled against pg_database_size, and the block says its own coverage
21	Fixed	#3611, #3619	[#3581]	coordinator	The twenty continuous aggregates join the compression ladder
22	Fixed	#3613	[#3541] A7	wave-2	PostgreSQL MCP percents name their denominator, so a three-row page stops summing to 100% of everything
23	Fixed	#3614	[#3540] A4	wave-2	Every delta family is seeded from the store at service start, and the series-age rescue finally has passes to read, so a restart no longer fabricates one interval of quiet for six families
24	Fixed	#3615	[#3541] A14	wave-2	MCP write tools report what happened
25	Fixed	#3616, #3623	[#3538] A5/A7	wave-2	The scorer's wait thresholds carry their measurement: WRITELOG stops saturating on a third of routine windows, deadlocks grade 5/hr apart from 90/hr, and the absolute gates scale with the hours actually observed
26	Fixed	#3618	[#3612]	coordinator	Analysis pages with long compound stories now reach Slack instead of dying with invalid_attachments
27	Fixed	#3621	[#3620]	coordinator	Continuous-aggregate materializations are chunked at one raw chunk, like every raw table
28	Fixed	#3624	[#3608]	coordinator	The PostgreSQL first-target runbook stops denying three capabilities that ship
29	Fixed	#3625	[#3622]	coordinator	Slack text cuts land on whole characters, not UTF-16 indexes
30	Fixed	#3626	[#3517]	coordinator	A not-yet-valid web TLS certificate now raises the self-alert instead of reading as healthy
31	Fixed	#3627	[#3609]	coordinator	Light and Cool Breeze status colors read against their own page, and text on a status fill gets a theme ink
32	Fixed	#3628	[#3579]	coordinator	Forced Plan Failing fires once per observation, not once per cooldown
33	Fixed	#3629	[#3591]	coordinator	The compression dead-job alert now says what a -infinity row is on the store's TimescaleDB
34	Fixed	#3630	[#3540], Darling V128 / Lite v61	wave-2	Every delta family now stores the interval its deltas accrued over, and query_stats stores the statement offsets its delta key is made of
35	Fixed	#3631	[#3539] A8c	wave-2	The File Growth threshold means one thing — megabytes per hour — at every surface that shows it
36	Fixed	#3632	[#3538] A6/A9	wave-2	Story confidence measures corroboration instead of path length, and the nightly rebuild's three cards become one incident that names the job
37	Fixed	#3633, #3640	[#3580]	coordinator	The daily digest and sweep rollup no longer re-announce on a service restart
38	Fixed	#3634	[#3538] A3	wave-2	compare_analysis bands each delta by the server's own dispersion and folds one cause into one row, so same-hour-yesterday noise stops reading as a verdict
39	Fixed	#3635	[#3539]	wave-2	A server nothing has banded yet is Unknown, not Healthy, and the alert-history grids show the severity the alert fired at instead of the colour its name implies
40	Fixed	#3637	[#3541] A10	wave-2	Every latest-snapshot MCP read says when it was captured, and no tool accepts a window it does not read
41	Fixed	#3638	[#3539]	wave-2	PostgreSQL servers get a measured deadlock band from their own counters, their Long-Running Query alert skips maintenance like SQL Server's does, and every one-sided alert says why it is one-sided
42	Fixed	#3639	[#3636]	coordinator	Database File Growth's rise arm fires once per hourly observation, not once per cooldown
43	Fixed	#3641	[#3541] A9/A13	wave-2	The daily summary stops painting purged months green, and every MCP filter is part of the query
44	Fixed	#3642	[#3541] A12	wave-2	Zero is a measurement: health parsers say whether their source was ever seen, a regression with no baseline stays null, and the first point of a differenced trend is no longer a fabricated 0
45	Fixed	#3647	[#3597]	coordinator	The interval-hourly Query Store refresh stops paying twelve index inserts per re-materialized row for eleven indexes nothing reads, and the capture-down alert read stops decompressing a server's whole collection log to learn two statuses
46	Fixed	#3649	[#3644]	coordinator	Top CPU Queries reads as one record per query on Slack, not seven fields interleaved across a two-column grid
47	Fixed	#3651	[#3648]	coordinator	Top Cpu Queries' Max Dop is the newest plan's reading, with the cross-plan maximum kept as a dated history
48	Fixed	#3655	[#3652]	coordinator	The force-plan remediation said "eligible, no blockers" for plans automatic plan correction already owned, had failed to force, or had withdrawn
49	Fixed	#3657	[#3650]	coordinator	A Claude review that posted nothing no longer finishes green
50	Fixed	#3658	[#3653]	wave-2	The deprecated Dashboard mirrors five of the brains-review honesty fixes in its own idiom
51	Fixed	#3659	[#3653]	wave-2	Six small honesty riders from the brains-review residue
52	Fixed	#3660	[#3653]	wave-2	The PostgreSQL poison-wait host holds on silence like the SQL Server engine does, and three presence-flat alerts grade their severity from the bars the health bands already measured
53	Fixed	#3665	[#3542] v1 plumbing	wave-2	PostgreSQL targets enter the analysis pipeline
54	Fixed	#3666	[#3653]	wave-2	The Darling viewer's trend charts and calendar tell the same truth the MCP tools learned today

Merge-state check (all 59 PRs above): every one reads MERGED with base dev, and every merge commit is an ancestor of this branch's base (git merge-base --is-ancestor). The buffers' [PR open] markers on #3583, #3587, #3588, #3589 were stale — all four had merged. No header in either buffer was still marked PROVISIONAL (already cleaned before I read them); no PR number appears twice.

Not placed (merged after the buffers closed, no buffered entry): #3669 (#3542 durability posture, 6ddee19d) and #3670 (#3542 PG_BAD_ACTOR top statements, e0041b5c) merged to dev while this lane ran. Their entries belong to the #3542 content lanes' buffer and are not in either file I was given; this branch is fast-forwarded onto them (neither touched CHANGELOG.md) so the next splice appends cleanly.

What it does NOT do

• Does not close any issue (no Closes keyword — there is none to close).
• Does not touch docs/changelog/*, tools/changelog/archive-census.txt, or any released section.
• Does not re-order or re-word the 21 wave-1 bullets.
• Does not judge the 48 Fixed entries' prose beyond the one dangling-word fix — the lanes' voice is the lanes'.

Verification

• python3 tools/changelog/changelog_archive.py verify — all PASS: 356,539 bytes (ceiling 768,000); CRLF throughout (the .gitattributes eol=crlf checkout form — the splice was done in Python with explicit \r\n so no line was silently converted); every [#N] resolves (1,358 distinct); 1,420 bold entries against the 1,329 floor; every archive's census row still matches.
• Darling.Tests/ChangelogIndexAndArchiveTests — 5/5 pass, executed on this Mac via a throwaway net10.0 xunit harness compiling that one file with its output under Darling/Darling.Tests/bin/ so the walk-up to PerformanceMonitor.sln resolves (the harness output was removed before commit; git status clean but for CHANGELOG.md).
• Client-identifying-text scan over the added lines (hostnames, brands, instance ids, IPs, store prefixes): nothing.
• The mapping table above was generated by the same parser that produced the splice, not transcribed.

Review-dark self-review

1. File touched: CHANGELOG.md only — the [Unreleased] section and its definition group.
2. Three riskiest lines: (a) the ### Added heading — new subsection in [Unreleased]; pinned by verify's section parse and the archiver's group_prose, which treats ### as a group boundary. (b) The moved [#3557] definition — a move, not a loss; pinned by "every [#N] resolves" on both instruments. (c) The get_store_metrics: the job_history block said 'recording' and never said whose eyes the rows are visible to — it now evaluates the view's ownership filter for its own reader and proves rows exist where it can (#3574) #3585 Darling only. edit — the one word I wrote; pinned only by the grep that get_store_metrics lives under Darling/.
3. What I'd want a reviewer to check: whether PostgreSQL targets enter the analysis pipeline: the pass routes by registry engine_kind inside the service, a pg_database_stats coverage witness replaces the tombstone, and every shared switch gains its one pg_ arm so the content lanes can build in parallel (#3542 v1 plumbing) #3665 belongs in Added; whether [#3542]'s single definition is right when three more PostgreSQL-target analysis engine: design and v1 build #3542 lanes (A PostgreSQL target's durability posture is stated, not inferred: fsync and full_page_writes off are CRITICAL policy cards, synchronous_commit off names the commits a crash discards, Aurora's managed pair is present and ungraded, and no tuning path can reach any of them (#3542 lane 8) #3669, A PostgreSQL analysis pass now names the statement: PG_BAD_ACTOR facts from pg_statement_stats carry one shape's share of the window's execution time, its calls/sec and mean, and a drill-down with the normalised text — the query-shaped leaf every PostgreSQL story needs (#3542 lane 7) #3670, and the rest) will cite it — it is, definitions are per file not per entry.