Splice the pending CHANGELOG entries merged through 2026-09-26T17:37:33Z UTC

[erikdarlingdata]

Moves the CHANGELOG entries carried in merged PR descriptions into [Unreleased]. Cut: PRs merged at or before 2026-09-26T17:37:33Z UTC; the next splice starts after it.

What changes

One Python script (not committed, run under /tmp) read a pre-fetched JSONL of 150 merged pull requests (all merged after 2026-09-25T07:08:52Z, the last time CHANGELOG.md was touched before this window, and at or before the cut) and mechanically spliced each PR's ## CHANGELOG entry section into [Unreleased].

Spliced: 128 PRs total.

• Fixed: 87 (2 bullets) — [Decide a re-created statement entry's counters row-coherently in pg_statement_stats (#4428) #4435, Detect a server-wide wait-stats clear once per pass (#4428) #4434, The raw purge gate judges each rollup against the rows that rollup can hold (#4300) #4432, Decide a cached plan's restarted counters row-coherently in query_stats (#4428) #4431, After an outage across an upgrade, the raw purge gate releases within the hour on a running store (#4300) #4430, Take raw query-statistics tables out of the catalog sweep's drop path (#4427) #4429, Stop query_stats from recording a false zero CPU when only the CPU delta is unknowable (#4394) #4423, FinOps raw totals apply the hourly rollups' zero-interval filter; idle detection counts a recent execution (#4394) #4417, Fix the alert notebook's collector-freshness check (#4378) #4416, Thread request cancellation through get_store_host (#4203) #4412, Thread cancellation through 5 more web reads: 2 trends, 3 analysis (#4203) #4411, Thread cancellation through 5 PostgreSQL web reads (#4203) #4409, Warm the settings redactor's patterns before their first timed match (#4348) #4408, Rewrite darling-managed.conf only when its settings change (#4215) #4407, Don't re-hold the raw purge for an empty successor mid-upgrade (#4300) #4406, Carry an operator's postgresql.conf lines below the include across a major upgrade (#4358) #4405, Thread cancellation through 10 store/fleet web reads (#4203) #4402, Hold the raw purge on any hole in the frozen legacy's span, and fill the successor down to raw's floor (#4301) #4401, Thread cancellation through 11 more SQL Server web reads (#4203) #4393, Bound the settings redactor's matching time (#4348) #4392, Raw retention purges run only when the service triggers them, never at PostgreSQL start (#4299) #4391, Thread cancellation through 10 PostgreSQL web reads (#4203) #4390, Thread CancellationToken through 9 PostgreSQL-target MCP reads (#4203) #4388, Thread cancellation through 15 core web reads (#4203) #4387, Thread cancellation through 10 Alerts/MemoryGrants/Health web reads (#4203) #4386, Thread cancellation through 10 PostgreSQL-target web reads (#4203) #4373, Thread cancellation through 8 object-stats and config-history web reads (#4203) #4372, Gate the deprecated Dashboard's XE ring-buffer shred on execution_count (#4213) #4371, Bucket the memory-grant and TempDB usage viewer trend charts (#4349) #4364, Bucket the blocking-trend reads: lock waits, waiting tasks, blocked sessions (#4349) #4362, Bucket the CPU scheduler, session stats, and plan cache trend reads (#4349) #4361, Thread cancellation through 7 Blocking web reads (#4203) #4360, Thread cancellation through 9 Health Parser web reads (#4203) #4359, Thread cancellation through 4 Performance-Trends web reads (#4203) #4357, Run the Darling bootstrap's first CREATE DATABASE once, on its own deadline (#4352) #4355, Redact passwords and other secrets from stored PostgreSQL settings (#4348) #4351, Queries-tab web reads stop their store query when the request is abandoned (#4203) #4350, Web reads stop their store query when the request is abandoned (first slice) (#4203) #4347, Detect a pending restart on Windows PostgreSQL targets from pg_file_settings (#4251) #4345, Heal the v8 sizing block on stores resized before #4225 (#4207) #4342, Fleet Sweeps reports an error instead of "no sweeps" when its store read fails (#4315) #4328, Lite Overview baseline bands use the server's actual hour under a custom range (#4320) #4325, Dashboard query comparison grids use the server's local time (#4313) #4321, get_collection_health's default fits the MCP response budget (#4198) #4319, Dashboard Overview ghost line uses the server's local time under a preset range (#4305) #4317, Narrow the Query Store slicer's clock-skew margin to an hour; the interval-table move is blocked (#3953) #4311, Fix Lite Overview ghost-line comparison offset under a preset range (#4296) #4309, AG tab refreshes cards in place and virtualizes the list (#4238) #4308, Daily Summary calendar caches closed days for an hour (#4232) #4307, Bound the Query Store backfill candidate read at its horizon (#4197) #4306, WPF Wait Stats and Perfmon trend charts bucket server-side (#4234) #4304, Fetch Active Queries plan XML on demand instead of every snapshot row (#4239) #4303, Lite: Queries-tab comparisons read the grid's UTC window, not a server-shifted one (#4284) #4302, Lite: fetch Active Queries plan XML on click, not on every grid read (#4239) #4297, Query heatmap resolves preview text for cell winners only, not every row (#4233) #4295, Drop five write-heavy, barely-read runtime indexes on the raw hypertables (#4247) #4294, Web viewer: stop sending exception text to the browser on the remaining paths (#4283) #4293, Drop an empty superseded baseline aggregate on sight (#4289) #4292, Cache the I/O-latency and CPU baselines by UTC day, not the hour (#4248) #4291, Skip locking fresh dimension rows; halve the Query Store liveness-touch rate (#4249, #4250) #4288, Managed stores compress WAL page images with lz4 (#4246) #4287, Web failure log: keep the log batch on a split character, answer bad requests with their own status #4286, Pin every STORE connection's session time zone to UTC (#4277) #4285, Log and answer web-viewer read failures instead of an empty 500 (#4276) #4281, Carry postgresql.auto.conf across a store major upgrade (#4253) #4280, Lite MCP tools disclose a truncated query-stats window (#4231) #4279, MCP top-queries/top-procedures disclose a shortened raw-tier window (#4231) #4278, MCP budget: get_query_store_top's default stays under 32 KB (#4198) #4273, MCP budget: describe_custom_view_catalog groups measures by source, under the response budget (#4198) #4272, MCP budget: get_collection_health compacts healthy collectors under the size budget (#4198) #4268, MCP budget: get_blocking / get_blocked_process_reports default under 32 KB (#4198) #4267, MCP budget: add get_collection_log per-server response budget and error_message preview (#4198) #4265, MCP budget: default get_query_store_regressions under the response budget (#4198) #4264, MCP budget: get_pg_io_trend's default call now fits the 32 KB budget (#4198) #4263, MCP budget: size get_active_queries defaults to the response budget (#4198) #4261, MCP budget: lower get_index_usage's default row limit under budget (#4198) #4260, MCP budget: shrink get_query_heatmap's default cell cap and text preview (#4198) #4259, MCP budget: size get_object_locking's default rows (#4198) #4258, MCP budget: get_plan_corrections defaults sized to the shared response budget (#4198) #4257, Job History: GROUP BY join replaces the per-job window function, tab off the 30s timer (#4229) #4256, AG reads: share one floor-bounded newest-snapshot read across Viewer and Service (#4228) #4255, MCP budget: preview the deadlock graph XML by default on get_deadlock_detail (#4198) #4254, FinOps sizes: database-size latest-snapshot reads take a plan-time chunk bound (#4245) #4252, Alert link delivery: no link when dashboard disabled, admit publicBaseUrl host, add link to email (#4220) #4230, Field data confirms the interval-table fix removes the spill, ship it (#3953) #4208, Narrow audit_config's collection, bound the regression baseline, bucket PG CPU (#4192, #4195, #4193, #4217) #4206]
• Changed: 20 — [Route report alerts' links to their own page, and mark reports as having no notebook (#4223) #4421, Route get_top_procedures_by_cpu and the Top Procedures grid to the hourly rollup (#4231) #4413, Size the Linux compose store's workers and work_mem from the product's own formula (#4322) #4400, Cache the server-scoped watermark read across a runner's lifetime (#4197) #4399, Top-N-by-CPU routes to the hourly rollup once raw's floor ages past the window (#4231) #4396, Route the Performance Trends duration chart through the interval table at 48 h and wider (#4310) #4382, Bucket the Darling viewer's TempDB file I/O trend (#4234) #4353, Reconcile each raw hypertable's chunk interval once a day from its ingest (#4211) #4344, Query Store reads get a wide interval table (#3953) #4341, Bucket Lite's memory clerk and File I/O trend reads (#4234) #4340, Keep the DuckDB sentinel connection from making Lite's database reset a no-op (#4262) #4339, Bucket Lite's Performance Trends duration/execution charts (#4234) #4338, Bucket Lite's Overview CPU, wait and memory lane reads (#4234) #4337, Move the managed store's settings into one included file, darling-managed.conf (#4215) #4336, Bucket the viewer's query/procedure/execution-count trend charts server-side (#4234) #4333, Bucket Lite's Wait Stats and Perfmon trend and picker reads (#4234) #4331, Bucket the Darling viewer's File I/O and memory clerk trend charts (#4234) #4329, Bucket the Darling viewer's Overview CPU/wait/memory lanes server-side (#4234) #4327, PostgreSQL-target baselines recompute once a day, not every hour (#4298) #4324, Legacy trio off the refresh grid (#3653) #4186]
• Added: 17 — [Give Collection Stopped, Capture Down and Collector Cost Regression an authored self-monitor notebook (#4223) #4437, Add the authored analysis-finding alert-notebook template (#4223) #4436, Add the Custom-rules alert notebook template (#4223) #4433, Add authored Poison Wait alert-notebook template (#4223) #4424, Add authored alert notebooks for Server Unreachable/Restored and Agent jobs (#4223) #4422, Add the authored High CPU alert-notebook template (#4223) #4420, Add authored notebook templates for the PostgreSQL-only alert families (#4223) #4419, Add authored alert notebooks for Long-Running Query and Forced Plan Failing (#4223) #4418, Add the authored Blocking and Deadlocks alert-notebook templates (#4222) #4395, Attach Aurora per-query peak memory as a context fact (#3691) #4370, Alert notebook: read-only render on #/triage (#4222) #4368, Notebook read cell type, validated by the shared v1 read-panel rules (#4222) #4367, Add the alert-notebook binding endpoint (#4222) #4366, Add a shell-level auto-refresh pause/resume control (#4222) #4365, Report the store host's cloud instance type/VM size (#4214) #4330, Add get_store_host MCP read for the store host profile (#4214) #4282, Store host profile model + --check-settings verb + --validate-config registry fix (#4214) #4271]
• Security: 5 — [Scrub the legacy plan-force-actions detail state_unavailable line (#4346) #4384, Apply the sensitive-statement filter to collected PostgreSQL statement text (#4348) #4383, Redact more stored PostgreSQL setting shapes and make the settings scrub resumable (#4348) #4380, get_plan_force_actions read no longer serves pre-#4326 exception text (#4346) #4363, Stop leaking raw exception text from /api/ping and two MCP notes (#4316) #4326]

Each entry was inserted at the top of its section's list (newest PR number first), matching the file's own existing order. Each entry's REF: definition was appended to the file's trailing definitions block, skipped when the label already existed there.

Section choices (no SECTION: line in the PR body)

Three PRs carried a real ENTRY/REF block with no SECTION: header. Assigned by reading each PR's own diff:

• get_plan_force_actions read no longer serves pre-#4326 exception text (#4346) #4363 → Security: redacts a legacy exception-text leak in the plan-force journal read.
• Apply the sensitive-statement filter to collected PostgreSQL statement text (#4348) #4383 → Security: applies the sensitive-statement filter to collected PostgreSQL statement text.
• Redact more stored PostgreSQL setting shapes and make the settings scrub resumable (#4348) #4380 → Security: redacts more PostgreSQL setting-value shapes and hardens the one-time scrub.

Mechanical fixes

• MCP budget: get_blocking / get_blocked_process_reports default under 32 KB (#4198) #4267, MCP budget: default get_query_store_regressions under the response budget (#4198) #4264, MCP budget: get_collection_health compacts healthy collectors under the size budget (#4198) #4268: each carried a [#4198]: .../pull/4198 REF, inconsistent with the label's first-seen form (.../issues/4198, from MCP budget: get_plan_corrections defaults sized to the shared response budget (#4198) #4257/MCP budget: add get_collection_log per-server response budget and error_message preview (#4198) #4265/MCP budget: describe_custom_view_catalog groups measures by source, under the response budget (#4198) #4272/MCP budget: get_query_store_top's default stays under 32 KB (#4198) #4273). MCP read tools have no default response-size budget: at default arguments 12 tools return >50 KB and 3 return >100 KB for one server, more than an agent client's per-result cap #4198 is a GitHub issue, not a pull request, so the issues-form was kept for every occurrence of that label.
• Thread cancellation through 7 Blocking web reads (#4203) #4360: carried [#4203]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/4360 — a REF labeled for issue Web /api/read/* handlers never thread RequestAborted into the underlying store query #4203 but pointing at PR Thread cancellation through 7 Blocking web reads (#4203) #4360's own pull URL. Web /api/read/* handlers never thread RequestAborted into the underlying store query #4203 is a GitHub issue, so the URL was corrected to .../issues/4203.

Skips (22 PRs — no user-visible entry)

• 22 PRs whose body says SECTION: None or opens with free-text "None…" (test-only changes, refactors, or entries deferred to a not-yet-merged parent PR): CI: distinct-chunk counting for job_history's two-scan floor proof (flake from #4235) #4275, MCP budget: finish get_analysis_findings default limit and text previews (#4198) #4266, A budget pin over every MCP read tool (part of #4198) #4224, Pin Lite's MCP read tools under the #4198 response budget (#4198) #4290, lane-orders: lanes skip the plain-English pass on PR bodies #4314, A live test holds #4247's readers under half their deadlines without the dropped indexes (#4247) #4318, Make the PgTarget anomaly and blocking tests independent of the wall clock (#4274) #4323, Derive each raw hypertable's chunk interval from ingest (#4211) #4332, Flaky test: the failure-facts reader always reads once before checking the writers (#4312) #4335, Payload-dimension pre-filter test no longer asserts a cluster-wide WAL delta (#4354) #4356, Cover the MCP Query Store regression reader's baseline lower bound in the census guard (#4310) #4375, Move plan-force audit sanitizer into the shared row mapper (#4376) #4377, Anchor the Lite CPU-spike scenario to a UTC-day boundary #4385, Pin that a literal end before applied_through reads raw on the grid and MCP (#3953) #4381, Make two live tests independent of the extension and the wall clock (#3953) #4389, Open fresh connections after the upgrade test restarts its server #4397, Measure the DuckDB memory trim by the memory it releases #4398, Split AlertNotebookEndpoint's authored templates into per-family files (#4223) #4410, Retry the DuckDB trim test when a parallel test holds the trim lock #4415, Top-N raw reads apply the hourly rollups' zero-interval filter, so both tiers agree by construction (#4394) #4414, Add authored-notebook context plumbing (#4223) #4425, Add the missing [Unreleased] CHANGELOG entries for eleven merged PRs #4438. Each was re-checked directly against the PR's raw body for an indented ## CHANGELOG entry block the parser could have missed; none had one — every one of the 22 either has no CHANGELOG entry heading at all or an unindented None/test-only line.

No PR number in this input window's [#N] labels already appeared in [Unreleased], so rule 2's skip-if-already-present case did not apply to any entry.

#4206 / #4208 handling

• Narrow audit_config's collection, bound the regression baseline, bucket PG CPU (#4192, #4195, #4193, #4217) #4206 carried a normal SECTION/ENTRY/REF block in its PR body (not free text) — read and spliced as-is, no hand-written rewrite needed. Confirmed [Unreleased] did not already carry it before this splice.
• Field data confirms the interval-table fix removes the spill, ship it (#3953) #4208's ## CHANGELOG entry block was indented four spaces in its PR body (a Markdown code block), which the splice parser did not read as a section heading, so it was wrongly treated as a skip. It is now spliced from that body: two Fixed bullets, plus one sentence added to the first bullet from the diff (git show 731512799 --stat, PgMigrations.cs) naming the store schema rung the fix depends on — V143, the collect.query_store_interval_latest table.

Self-check

Every [#N] cited in an [Unreleased] bullet has exactly one [#N]: definition in the file, and no duplicate label definitions exist anywhere in the file (checked programmatically after the splice). File stays LF-only (verified: the committed blob was already LF-only despite the repo's eol=crlf checkout attribute; converted CHANGELOG.md's working-tree CRLFs to LF before editing, matching the committed history).

Diff is exactly CHANGELOG.md.

Test plan

Built Darling/Darling.Tests/Darling.Tests.csproj (Release, EnableWindowsTargeting=true), 0 errors. Ran the real Darling.Tests.dll in-process (Microsoft.WindowsDesktop.App framework entry stripped from its runtimeconfig, the rest of the recipe unchanged).

origin/dev had not moved past this branch's base (2c34fc0b0), so no merge was needed before the run.

ChangelogIndexAndArchiveTests: 5/5 passed on 3d3d62d6 merged with dev 2c34fc0b0

CHANGELOG entry

SECTION: None — this PR is the CHANGELOG change itself.