CHANGELOG: splice the 09-28 → 09-30 merges into [Unreleased]

[erikdarlingdata]

Splices the CHANGELOG entries carried by PRs merged to dev after 2026-09-28T17:40:00Z (the #4621 cut) through 2026-09-30T18:38:35Z (#4863) into [Unreleased]. Entries were read from each PR body's ## CHANGELOG block, every bullet and every SECTION: group.

Blocker: this diff puts CHANGELOG.md over its size ceiling. The file goes from 739,796 to 823,540 bytes on disk, and the index ceiling is 768,000 (750 KiB). changelog_archive.py verify fails on that line, and ChangelogIndexAndArchiveTests.EveryFile_ResolvesItsOwnReferencesAndRendersOnGitHub checks the same limit, so that test fails. Every other verify check passes. This needs a decision before merge: land it with the 3.9 cut's split, which moves the [Unreleased] prose to docs/changelog/3.9.md, or raise the ceiling in a separate PR.

Counts

143 bullets from 105 PRs: Added 4, Changed 19, Fixed 120. It adds 105 definitions and amends 4 existing lines (252 insertions, 4 deletions). New bullets sit at the top of each section, newest PR first. A combined entry sorts at its newest PR.

Combined and rewritten

• Daylight saving / server clock: one Fixed entry for Darling viewer: Server time mode follows the server's time zone across a daylight saving change (#4766) #4783, Darling MCP tools: on SQL Server 2022 and later, server-local times follow the server's time zone across a daylight saving change (#4793) #4829, Analysis and job alerts: a SQL Server's local times convert with the offset in force at each row, in both apps (#4821) #4838, Custom Views: Default Trace markers from before a daylight saving change are no longer an hour off (#4821) #4840, Lite shows server times right across a daylight saving change, in the desktop and in MCP tools (#4766, #4793) #4841, Recommendations: Ask AI times and the viewer's Last analyzed line use the selected server's own clock (#4766) #4847, Charts and time windows keep exact instants across daylight saving changes, in Lite and the Darling viewer (#4766) #4848 and Times in the repeated autumn hour show their UTC offset in grids, text and chart CSV exports, in Lite and the Darling viewer #4855 (14 body bullets). Lite shows server times right across a daylight saving change, in the desktop and in MCP tools (#4766, #4793) #4841's "one limit remains, Server-time mode uses one UTC offset for the whole window, so times across a DST change are an hour off #4766 stays open" text is left out: Charts and time windows keep exact instants across daylight saving changes, in Lite and the Darling viewer (#4766) #4848 closed Server-time mode uses one UTC offset for the whole window, so times across a DST change are an hour off #4766 and fixed the drill and second-occurrence limits it described. The limit that remains, from Times in the repeated autumn hour show their UTC offset in grids, text and chart CSV exports, in Lite and the Darling viewer #4855, is kept: times read from a stored server wall clock stay plain in the repeated hour. Grid time columns sort by time, not by their text, in Lite and the Darling viewer #4858 keeps its own two bullets. Lite CPU chart hover: a bucket read from the stored server wall clock shows no UTC offset in the repeated autumn hour #4857 is SECTION None.
• Lite blocking-chain slicer (Charts and time windows keep exact instants across daylight saving changes, in Lite and the Darling viewer (#4766) #4848): its own Fixed bullet, written from the Charts and time windows keep exact instants across daylight saving changes, in Lite and the Darling viewer (#4766) #4848 diff because the body has no line for it. The bug shipped in v3.8.0 and is only in the path for a report row with no event time.
• Alert retry: one Fixed entry for An alert whose every channel failed is tried again after 1, 2, 4 minutes instead of waiting out the cooldown (#4752) #4786, Darling: file growth, long-running job, failed agent job, database state and forced plan alerts are tried again after every channel failed (#4752) #4804, PostgreSQL alerts: try an alert again a minute after no channel delivered it (#4795) #4826, Custom alert rules: an alert no channel delivered is sent again while its condition holds (#4795) #4827, Alerts: a send that reached no channel is reported as failed, so it is tried again, in Lite and for Per-event splits in both apps (#4752, #4822) #4828 and Alerts no channel delivered are tried again: Darling's self-alerts and both apps' connection and AG alerts (#4795) #4837, naming each family covered in each app. It does not say "every alert". Alerts no channel delivered are tried again: Darling's self-alerts and both apps' connection and AG alerts (#4795) #4837's removed-server bullet stays separate.
• Darling store: a repaired hourly hole leaves an existing daily bucket partial, and it becomes the only copy after 90 days #4716: A repaired hourly hole refreshes the days its dependent dailies already hold, so no partial day stands (#4716) #4739 (prevention) and Daily rollups: days an earlier hourly repair left short are rebuilt once after the upgrade (#4716) #4763 (heal) are combined into one entry.
• Plan viewer and analyzer: compare row estimates the way PerformanceStudio does (#4627 follow-up) #4698: its Fixed entry is the end-state row label and edge entry, cited with Plan viewer: fix edge/label misestimate mismatch, zero-grant text, Light-theme orange contrast #4632 and Plan viewer: a screen-reader select on the + tab adds one sub-tab, and a row label under 1 agrees with its percentage (#4684) #4688. It replaces only Plan viewer: fix edge/label misestimate mismatch, zero-grant text, Light-theme orange contrast #4632's edge/label-ratio bullet and Plan viewer: a screen-reader select on the + tab adds one sub-tab, and a row label under 1 agrees with its percentage (#4684) #4688's row-label bullet, and says that Nested Loops inner-side edges now match the label (which Plan viewer: fix edge/label misestimate mismatch, zero-grant text, Light-theme orange contrast #4632 fixed relative to 3.8). Plan viewer: fix edge/label misestimate mismatch, zero-grant text, Light-theme orange contrast #4632's other three bullets and Plan viewer: a screen-reader select on the + tab adds one sub-tab, and a row label under 1 agrees with its percentage (#4684) #4688's "+" tab bullet are kept. The rule-16 wording is under Changed.
• Custom tab headers draw the on-accent ink; the status-bar collector text follows a live theme switch (#4678, #4679) #4682: rewritten to the per-app scope in the 23:52Z note.
• Darken Cool Breeze's default WarningColor to clear the 4.5:1 text floor (#4651) #4658: scope widened to include the Dashboard (Match the Dashboard's Cool Breeze warning color to Lite's, fixing dev's theme-parity test #4668).
• Web dashboard: per-view/notebook auto-refresh setting, master pause, and back-off for slow pages #4671, Query Store backfill: the per-tick database list no longer walks the newest chunk's index (#4662) #4703, Darling: purges pace their WAL, Purge Now runs in the background, and the checkpointer alert sees the longest sync (#4823, #4834, #4825) #4835, Skipped collection slots are counted and alerted on, a backward clock step no longer pauses work, and a connect that raced an edit is dropped (#4732) #4851, SQL Server blocking and deadlock baselines divide by the hours collection covered, so a quiet hour is a measured zero (#4731) #4853, PostgreSQL targets: record pg_stat_statements evictions and disclose them in get_pg_top_queries #4680: each is split into the sections its body gives. The ledger had filed every bullet of these under the first section.

Amended in [Unreleased]

• Top-N-by-CPU routes to the hourly rollup once raw's floor ages past the window (#4231) #4396: the raw-only filters keep the read on raw, with an empty status when raw holds nothing. On the hourly tier, columns the rollup lacks are null, not 0, and sql_handle is returned. The read stops at the materialization ceiling, and cpu_attribution divides by the span the rollup served (MCP top queries and procedures over long windows: no dropped filters, null for what the rollup lacks, per-server coverage #4715).
• Route get_top_procedures_by_cpu and the Top Procedures grid to the hourly rollup (#4231) #4413: the "missing (object_type)" clause is replaced with the null columns (MCP top queries and procedures over long windows: no dropped filters, null for what the rollup lacks, per-server coverage #4715).
• MCP top-queries/top-procedures disclose a shortened raw-tier window (#4231) #4278: on the hourly tier, window_truncated and effective_start come from a per-server first-bucket check. The note covers the ceiling end edge and an unknown ceiling (MCP top queries and procedures over long windows: no dropped filters, null for what the rollup lacks, per-server coverage #4715).
• Query Store reads get a wide interval table (#3953) #4341: adds Build a BRIN index on query_store_interval_wide (collection_time) in the background #4862's BRIN index on collection_time, which serves Custom Views panels of 12 hours or more at random_page_cost of about 1.1. The MCP half of the line stands, because Read the interval table below the raw floor, down to the exact bound it can prove, and say how far back it reaches (#4689) #4700 (issue Query Store windows longer than the raw tier stop at the raw floor on armed stores; read the interval table below it #4689) fixed the Utc-kind gate fault.

REF form

Every bullet cites its merged PR. These issue-form refs were converted to PR refs: #4678/#4679 to #4682, #4723 to #4738, #4722 to #4740, #4726 to #4742, #4727/#4728 to #4753, #4745 to #4762, #4716 to #4763, #4743 to #4775, #4751 to #4777, #4755/#4756 to #4778, #4750 to #4779, #4759/#4760/#4761 to #4780, #4774 to #4781, #4769/#4770 to #4784, #4752 to #4786, #4734 to #4787 and #4790, #4758 to #4791, #4757 to #4796, #4729 to #4797, #4771/#4772 to #4801, and #4720/#4721 to #4808. Every definition is a /pull/ link. The ): separators are normalized to ) - , the form most [Unreleased] entries use.

Not spliced

• Held: provision-roles.sql stops at its role-collision guard, and the collector toggle verbs exit 2 for a store problem (#4746, #4744) #4809 (provision-roles guard, held for Erik's wording, both bullets).
• Excluded: Accessibility audit of Lite and the Viewer: name 1,400+ column filter, sidebar and tab buttons for UI Automation, and pin it #4696 and its revert Revert #4696: remove the UI Automation names and their pins #4701; Recommendations: Ask AI times and the viewer's Last analyzed line use the selected server's own clock (#4766) #4842 and its revert Revert #4842: Recommendations Ask AI times and the viewer's Last analyzed line go back to the previous clock (#4766) #4844 (the content ships under Recommendations: Ask AI times and the viewer's Last analyzed line use the selected server's own clock (#4766) #4847). Query Store backfill: the candidate database list reads the newest chunks by index probe, same list (#4662) #4681 closed unmerged.
• The IMPORTANT note for the release cut: Keep recurring collectors on a fixed grid instead of drifting from the sweep body start #4644. After upgrading, 1-minute collectors run every 60 s instead of drifting to about 70 s on large fleets, so per-minute data and store growth rise by up to about 20% compared with 3.8.
• SECTION None / no entry (35): Splice the pending CHANGELOG entries merged through 2026-09-28T17:40:00Z UTC #4621, Plan viewer: the empty Server Context card no longer points to the repro script #4631, Fix timing flake in PgSettingRedactorTests long-input theory #4642, Pin the scratch store session to UTC in live tests #4645, AG tab render budget: replace the flaky 100ms wall-clock bar with a work count #4654, Make the read-lock cancellation flake deterministic under a loaded runner #4655, Give the chunk-layout-sensitive plan-shape live tests their own database (#4650) #4657, Redactor output check: give every exact-output assertion a load-proof match timeout #4663, Match the Dashboard's Cool Breeze warning color to Lite's, fixing dev's theme-parity test #4668, Make the status-bar read-lock flake deterministic under a loaded runner #4670, Run the Dashboard tests when Lite's themes or Installer.Core change #4674, CI: parse every web-dashboard JavaScript module with node --check #4676, Test: the managed stale-block --check-settings test migrates its own darling store, so it passes on a bare rig #4691, Darling.Tests: the WaitRate read-count pin counts in-process instead of through evictable pg_stat_statements; the test rig recipe preloads it #4697, Revert #4696: remove the UI Automation names and their pins #4701, The self-hosted log-events live test drives its own events, so a log rotation cannot hide them #4702, PostgreSQL targets: measure the host-memory and overcommit bars against the fleet #4706, Rotation live tests wait for the logging collector to write a burst before asserting on it #4707, MCP top queries and procedures over long windows: no dropped filters, null for what the rollup lacks, per-server coverage #4715, Log-rotation live tests start their bursts on a fresh log file (#4719) #4724, The cloud probe budget test no longer fails when the thread pool is starved (#4741) #4754, Darling tests: a test-only read route no longer leaks into other test classes running at the same time (#4782) #4785, Store checkpointer comments: a requested checkpoint is not always WAL-forced (#4758) #4800, provision-roles.sql stops at its role-collision guard, and the collector toggle verbs exit 2 for a store problem (#4746, #4744) #4809, Store-host live test: compare chunk counts read while no chunk changed (#4807) #4815, Tests: the ManagedConf crash hook and the Lite time settings are no longer shared between parallel test classes (#4773, #4776) #4817, Tests: the redactor scaling check holds on a busy machine (#4788) #4819, Recommendations: Ask AI times and the viewer's Last analyzed line use the selected server's own clock (#4766) #4842, Revert #4842: Recommendations Ask AI times and the viewer's Last analyzed line go back to the previous clock (#4766) #4844, RollupBackfill live test: the mid-slice cancel lands while the refresh waits on a held lock #4856, Lite CPU chart hover: a bucket read from the stored server wall clock shows no UTC offset in the repeated autumn hour #4857, Secret-leak checks in tests look for a sentinel that a timestamp can't contain #4860, Build a BRIN index on query_store_interval_wide (collection_time) in the background #4862, Tests: a Windows file lock right after the managed PostgreSQL stop no longer fails the store-move test #4864 and Give the deploy-script tests' PowerShell probe a 180 s cold-start margin #4866.

Self-check

• The diff touches only CHANGELOG.md. The staged blob is LF-only (0 CR bytes), and the working tree is CRLF.
• Every [#N] in [Unreleased] has exactly one definition, no label is duplicated, and each label matches its URL.
• Every new or amended bullet has a bold title followed by ([#N]) and then -.
• A scrub grep of the diff for host, instance, tenant, account and IP patterns found nothing.
• changelog_archive.py verify: everything passes except the size ceiling above.

CHANGELOG

SECTION: None