[erikdarlingdata]

Release 3.11.0: version, changelog, archive

Why

The 3.11.0 release is cut on 2026-10-22. This PR is the dev side of release checklist steps 1, 2 and 2a, plus the upgrade ladder fixture. It does not open the dev-to-main PR, tag or release.

What changes

• Directory.Build.props: <Version>3.11.0</Version>, the one line. A tree grep for 3.10.0 found only test fixtures, comments and verify_release_signatures.py self-test sample names (PerformanceMonitorDarling-3.10.0.zip), none a version stamp; none changed.
• CHANGELOG.md and docs/changelog/3.11.md: an empty ## [Unreleased] and a ## [3.11.0] - 2026-10-22 block (Important 3, Added 96, Changed 25, Fixed 152 = 276 entries after truth-check round 2 (280 after round 1, it was Important 3, Added 104, Changed 38, Fixed 191 = 336), the 14 entries that sat in [Unreleased] kept verbatim at the top of their sections). split, census, verify, roundtrip of tools/changelog/changelog_archive.py were run; tools/changelog/archive-census.txt has the 3.11.0 row. 247 new link definitions appended; no existing link line touched.
• Darling/Darling.Tests/Fixtures/migration-ladder-v3.10.0.sql: 172 rungs, top V173, generated from a git worktree of tag v3.10.0 with Darling/tools/generate-ladder-fixture and -p:StorageProject= pointing at that worktree. The extra worktree is removed.
• Important entries I wrote (source written-by-lane, in .release-3110/entries.json): the Darling store migrations V174 through V210 (none rewrites a large table or needs an offline window; V175, V182 and V206 touch existing rows and are named), and Lite DuckDB schema 67 to 77 (only v71 discards rows, derived data). The third Important entry is An agent can kill one SQL Server session after checking it is still the one it named (#5632) #6106's own (self-managed stores re-run provision-roles.sql). Entries by other PRs that also say to re-run provision-roles.sql: Per-server threshold overrides: loader, PostgreSQL counts, set_alert_threshold_override (#5916) #5933, Set a notification route's fallback route from the viewer and MCP (#6036) #6040, Query tags: web page to manage query tags, assignments and rules (#5986) #6050, Investigation reports can schedule a follow-up request (#6008) #6053, Darling MCP: incident controls (collection state, connection test, purge, analyze, plan undo) (#6230) #6240 (left in Added, as their PR bodies put them).

Test plan

• bash .github/scripts/pre-push.sh: GATE GREEN. [guard-darling] Total: 4441, Failed: 0, [guard-lite] Total: 1196, Failed: 0, classes: darling 0, lite 0 (this diff selects none).
• *ChangelogIndexAndArchive* Total 5, Failed 0; *ProductVersionDeclaration* Total 26, Failed 0; *MigrationUpgradeLadder* Total 8, Failed 0, Skipped 7 (the live ones need a PostgreSQL rig; TheMostRecentRelease_HasALadderFixture ran and passed).
• DARLING_RELEASE_CUT=1 ... -method "*StatementCensus_PendingEntries_BlockARelease*": pass, "pending entries: 0".
• dotnet build PerformanceMonitor.sln -c Debug -t:Rebuild: 0 Warning(s), 0 Error(s).
• Not run: the full suites (laptop; CI decides), the live ladder tests on a rig.

Cutoff

PRs merged to dev from 2026-10-08T00:00Z, 416 of them, highest number #6290. The last merge included is #6289 at 2026-10-21T10:58:52Z; the last merge in the set is #6289 at 2026-10-21T10:58:52Z. PRs merged after that go in a follow-up splice tomorrow.

Accounting (every PR in exactly one row)

Row	Count	PRs
Entry in a section (PR body CHANGELOG section; 0 taken from the buffer, see below)	260	#5631, #5687, #5688, #5690, #5694, #5697, #5698, #5699, #5700, #5702, #5704, #5705, #5706, #5707, #5708, #5709, #5712, #5714, #5720, #5721, #5722, #5723, #5724, #5726, #5727, #5730, #5732, #5734, #5740, #5741, #5742, #5751, #5752, #5753, #5764, #5769, #5771, #5774, #5778, #5782, #5790, #5791, #5792, #5795, #5799, #5800, #5801, #5803, #5805, #5806, #5816, #5817, #5818, #5819, #5826, #5827, #5828, #5829, #5830, #5831, #5832, #5835, #5836, #5837, #5838, #5839, #5840, #5841, #5842, #5845, #5848, #5850, #5852, #5853, #5854, #5855, #5856, #5859, #5869, #5870, #5871, #5877, #5879, #5880, #5885, #5886, #5895, #5900, #5901, #5902, #5906, #5930, #5933, #5934, #5935, #5936, #5937, #5952, #5954, #5958, #5959, #5962, #5964, #5965, #5966, #5967, #5968, #5972, #5974, #5975, #5976, #5994, #5995, #5996, #6013, #6014, #6015, #6016, #6017, #6018, #6019, #6020, #6021, #6022, #6023, #6024, #6025, #6026, #6028, #6029, #6030, #6031, #6032, #6037, #6038, #6039, #6040, #6041, #6045, #6046, #6047, #6049, #6050, #6051, #6052, #6053, #6054, #6055, #6056, #6057, #6058, #6059, #6061, #6062, #6063, #6064, #6065, #6067, #6068, #6069, #6075, #6076, #6077, #6078, #6079, #6080, #6082, #6083, #6084, #6085, #6087, #6088, #6093, #6095, #6101, #6103, #6105, #6106, #6108, #6109, #6110, #6111, #6118, #6120, #6124, #6125, #6126, #6141, #6142, #6144, #6145, #6146, #6147, #6148, #6149, #6150, #6151, #6152, #6161, #6162, #6163, #6164, #6165, #6166, #6167, #6168, #6169, #6171, #6172, #6173, #6184, #6185, #6187, #6188, #6190, #6191, #6192, #6193, #6195, #6197, #6202, #6208, #6209, #6210, #6213, #6219, #6220, #6222, #6228, #6229, #6232, #6233, #6237, #6238, #6239, #6240, #6241, #6242, #6246, #6248, #6249, #6250, #6251, #6253, #6255, #6258, #6259, #6260, #6266, #6270, #6271, #6272, #6273, #6274, #6275, #6280, #6282, #6287, #6288, #6289
Folded into another entry	0	none folded automatically; possible folds listed below
None by design (the body says so)	34	#5681, #5686, #5689, #5696, #5717, #5747, #5756, #5757, #5760, #5762, #5765, #5767, #5770, #5777, #5781, #5784, #5786, #5866, #5884, #5893, #5932, #5939, #5963, #5969, #6100, #6116, #6174, #6189, #6198, #6201, #6203, #6204, #6218, #6290
No entry found	27	#5648, #5657, #5658, #5662, #5664, #5671, #5674, #5676, #5679, #5680, #5683, #5692, #5728, #5739, #5746, #5766, #5788, #5973, #6035, #6090, #6092, #6107, #6121, #6122, #6153, #6176, #6283
Shipped in 3.10.0 (merge commit is an ancestor of the 3.10.0 release head 0c3a5f7)	82	#5488, #5490, #5491, #5492, #5494, #5497, #5499, #5500, #5501, #5502, #5503, #5504, #5505, #5509, #5510, #5511, #5512, #5524, #5527, #5528, #5529, #5530, #5532, #5533, #5534, #5535, #5536, #5537, #5538, #5539, #5540, #5542, #5543, #5544, #5545, #5546, #5548, #5550, #5552, #5553, #5554, #5556, #5557, #5563, #5564, #5566, #5567, #5570, #5572, #5573, #5576, #5577, #5579, #5580, #5584, #5585, #5588, #5590, #5591, #5593, #5595, #5598, #5599, #5604, #5605, #5609, #5610, #5611, #5612, #5613, #5615, #5619, #5620, #5621, #5622, #5623, #5624, #5626, #5628, #5635, #5636, #5637
Already in the old [Unreleased] block (kept)	13	#5659, #5663, #5665, #5668, #5682, #5907, #5908, #5919, #5920, #5921, #5922, #5925, #5926

Notes on the accounting:

• Entry sources: {'pr-body': 318, 'body-informal': 2, 'written-by-lane (from PgMigrations.cs, V174 to V210)': 1, 'written-by-lane (from DuckDbInitializer.cs, schema 67 to 77)': 1}. Every PR with a buffer file (52 files) also has the same entry in its body except Pin System.Security.Cryptography.Pkcs to the patched 10.0.13 (#5802) #5803 (the body has the corrected entry; the buffer file is the older one, body used), WebServerPageRangeTests: the past-end poll test no longer misses a refresh it depends on (#5956) #5963 and DuckDbInvestigationStoreTests: the report-links test no longer races the journal page (#5940) #5969 (body says SECTION: Tests, so None; the buffer holds a test-only line, not used).
• Agent dispatch: alerts start an agent investigation, and opt-in agents act through MCP tools that check and log every action (supersedes #2138) #5632: the entries the brief called missing (agent plan force Agents can force and unforce a Query Store plan, behind the server action gate (#5632) #6085, plan evict An agent can evict one cached plan and then see its next compile (#5632) #6095, session kill An agent can kill one SQL Server session after checking it is still the one it named (#5632) #6106/kill_session ends one PostgreSQL session after checking it is still the one the agent named (#5632) #6126/kill_session ends one session on an Azure SQL Database, from inside the session's own database (#5632) #6184, Agent changes list Agent changes list with one-click undo and the switch (#5917) #5936, undo A person can undo an agent's plan force or unforce from the Agent changes list (#5632) #6088/Plan changes answer with an undo, and the agent no longer waits for approval (#6207) #6208, force pre-check The force pre-check blocks only a force that cannot work, and warns about the rest (#5632) #6068, Level 3 Level 3 routes and per-server action switches, all off (#5632) #6080) all have a CHANGELOG section in their PR bodies, so they are taken from there (source pr-body), not rewritten. The only entry I wrote for Agent dispatch: alerts start an agent investigation, and opt-in agents act through MCP tools that check and log every action (supersedes #2138) #5632 is Starter agent file: use a small model for the first step #6237 (starter agent file; body had an informal line), source body-informal. An agent can kill one SQL Server session after checking it is still the one it named (#5632) #6106's entry says "PostgreSQL kill is not built", which kill_session ends one PostgreSQL session after checking it is still the one the agent named (#5632) #6126 supersedes: for the truth-check reviewers.
• Manual picks: get_collection_health partial rows omit null, false and 0 keys so the worst case fits the budget (#5748) #5752, An offline PostgreSQL target no longer reads as healthy on panels, the fleet sweep or Run all collectors (#6155) #6169 (informal line in the body, text kept), Excluded databases boxes take one name per line, so a name with a comma survives a save (#6112) #6118 (body says only "a user-visible entry would read": its text used with the PR title as the bold title), Starter agent file: use a small model for the first step #6237 (same), Darling MCP: notification routes, alert history dismissal and a quiet window for planned work (#6231) #6241 (multi-round body: kept the last version of each line, dropped "MCP route tools never set a route's destinations" as superseded, and appended the body's final "adds to the route-destinations line" paragraph to the route-destinations entry), CHANGELOG: splice wave-11 entries (eight Unreleased, three stale 3.9.0) #5932 (a CHANGELOG-only PR, counted None).
• Sections were not in the body for these entries and were inferred from the wording, so the reviewers should confirm: get_query_store_regressions: regression_count is the total, not the page (#6128) #6141, A PostgreSQL server's Vacuum tab scrolls and every grid shows several rows (#6133) #6142, Bring three oversized MCP answers under the response budget (#6131) #6149, A PostgreSQL server's tabs read plainly: Dead %, human index sizes, display name, offline note, short cards (#6135) #6151, Lists that mix servers read every row on one clock (#6137) #6161, PostgreSQL grids on the web server page keep short values in their cells (#6154) #6164, Web page text reads plainly: short banners, no capitals for emphasis, readable findings (#6156) #6172, kill_session ends one session on an Azure SQL Database, from inside the session's own database (#5632) #6184, MCP reads name Azure SQL Database servers by display name (#6179) #6188, Plan changes answer with an undo, and the agent no longer waits for approval (#6207) #6208, The deadlock graph's detail pane shows each process's sql_handle (#6205) #6209, PostgreSQL collectors send a query that fits the target's version (#6206) #6210, Delta seeding survives a store row with empty cells (#6212) #6213, Darling MCP: incident controls (collection state, connection test, purge, analyze, plan undo) (#6230) #6240, Darling MCP: notification routes, alert history dismissal and a quiet window for planned work (#6231) #6241, Diagnostics bundle: a known name inside an ordinary word is left readable; names in identifiers and long names are still replaced (#6256) #6258, A plan undo the server accepted is always journaled, and the write re-checks the agent switch (#5632) #6271.
• Entry shape fixes only: a missing ([#PR]) was inserted after the bold title, [#PR] placeholders replaced, (#N) turned into ([#N]), inline [#N](url) links turned into [#N] with a link definition, a leading ENTRY: dropped. Prose untouched.
• Possible folds (same issue cited by two PRs, both kept): Investigation follow-ups can wait for a module deploy (#6009) #6056 and Deploy follow-ups match module names in any case, and the module map refresh takes its token last (#6009) #6059 (Deploy-condition follow-ups: module modify_date, marker detection, before and after counts (#5632 Phase C C13) #6009), Lite investigations get frozen evidence, sections and request events (#6010) #6054 and Lite investigation requests journal a quiet join and wait for every metric to resolve (#6010) #6057 (Lite: schema step, request events and evidence over DuckDB (#5632 Phase C L1) #6010), A login or host gets the same pseudonym in every metadataOnly answer (#6066) #6093 and An agent can kill one SQL Server session after checking it is still the one it named (#5632) #6106 (metadataOnly: give a login or host the same pseudonym in every answer #6066), The forced-plans collector reads no plan XML; variants and plan guides are found in the stored plans (#6221) #6233 and The forced-plans collector reads the forced plans and their object ids in two statements, not one join of the two Query Store views (#6221) #6253 (Darling: the forced-plans collector runs 17 to 86 s per server every 5 minutes, and collection passes overrun #6221); the many Agent dispatch: alerts start an agent investigation, and opt-in agents act through MCP tools that check and log every action (supersedes #2138) #5632 PRs are separate features.
• Big review-round bodies (MCP tool audit fixes: spills, empty reasons, FinOps, dropped databases, object stats (#5633) #5704: 31 entries, Web UI audit fixes (#5644) #5705: 17, Darling MCP: notification routes, alert history dismissal and a quiet window for planned work (#6231) #6241, A plan undo the server accepted is always journaled, and the write re-checks the agent switch (#5632) #6271, MCP tag tools can no longer change which servers an agent route covers (#6281) #6282, Actual-plan prompts in the history windows check for data changes (#5639) #5687) carry several lines each; later rounds may have changed earlier lines, so they need the truth-check most.

No entry found (the coordinator decides)

• Release checklist: run the Setup.exe upgrade test before the tag #5648 Release checklist: run the Setup.exe upgrade test before the tag
• Count offline CPUs and NUMA nodes correctly in the CPU scheduler collector (#5656) #5657 Count offline CPUs and NUMA nodes correctly in the CPU scheduler collector ([Bug] Incorrect Offline CPUs and NUMA Node count reported due to DAC / Internal Schedulers #5656)
• The Azure 40615 message names the firewall and client IP, with no set-a-database advice (#5647) #5658 The Azure 40615 message names the firewall and client IP, with no set-a-database advice (Azure SQL Database 40615 message still ends with the set-a-database sentence #5647)
• Fix the late-row fixed-clock test that fails every run since 2026-10-10 (#5661) #5662 Fix the late-row fixed-clock test that fails every run since 2026-10-10 (A Darling plan regression test fails on every pull request from 2026-10-11 because its fixed date is now too old #5661)
• Say plainly when Windows is too old to start .NET 10 apps (#5651) #5664 Say plainly when Windows is too old to start .NET 10 apps (Lite, the Darling Viewer and the Darling service stop at start on Windows Server 2022 without current updates (CET) #5651)
• Make the statement cap the only timeout that can fire in the perfmon re-group tests (#5667) #5671 Make the statement cap the only timeout that can fire in the perfmon re-group tests (PerfmonRegroupLiveTests: the statement-cap test depends on which of two timeouts fires first #5667)
• Offer setting the database on the Azure 40615 message (#5647) #5674 Offer setting the database on the Azure 40615 message (Azure SQL Database 40615 message still ends with the set-a-database sentence #5647)
• Fix the deadlock notification test's planted PINs that matched the alert id clock (#5675) #5676 Fix the deadlock notification test's planted PINs that matched the alert id clock (A Darling deadlock notification test fails when the alert id's time contains a planted literal #5675)
• #5679 A cancelled page read gets the cancellation when the store connect times out first (#5678)
• #5680 Darling alerts run on their own cadence and say how old their newest sample is (#5642)
• #5683 Light review tier: allow 100 turns instead of 30
• #5692 CI: the Darling class listing works on a Lite-only pull request
• #5728 CI: balance the Darling PG shards by duration and skip idle Lite shards (#5669)
• #5739 description-drift: read the PR body from the event payload (#5737)
• #5746 Bump the nuget-patch-and-minor group with 4 updates
• #5766 DMV blocking snapshots no longer merge two separate waits of one pair (#5743)
• #5788 Throwaway PostgreSQL test clusters register on start and a sweep stops the orphans (#5787)
• #5973 Count pins that fail correct changes: ladder, MCP roster and DI pins become behaviour tests (#5950)
• #6035 Fix the fleet-pass pin's NRE: lock the recording deliverer's outcome list (#6034)
• #6090 Bump dotnet-sdk from 10.0.401 to 10.0.402
• #6092 Bump Microsoft.CodeAnalysis.BannedApiAnalyzers from 4.14.0 to 5.6.0
• #6107 Bump AWSSDK.PI and 7 others
• #6121 Compose race test counts only its own database's advisory lock waits (#6119)
• #6122 Lite shard step: name both sides of a mismatch, retry the cut once, retry the timing download longer (#6117)
• #6153 The load-test measurement script reads the real service log and takes a comma list of steps (#5794)
• #6176 UI tests no longer depend on which classes ran before them
• #6283 FinOps page test uses Assert.Single for the one empty branch (#6277)

User-visible by title: #5657, #5658, #5664, #5674, #5679, #5680, #5766. The rest look like CI, tests or housekeeping; the Dependabot bumps are #5746, #6090, #6092, #6107.

Entries that name a class, method, file or code comment

Heuristic match (backticked identifiers with camelCase or a file extension, or class-like names). MCP tool names, settings and JSON keys are user-facing and not listed unless they matched. PR: matches.

• #5702: mcp.allowWindowsAuthOverUnverifiedTls, trustedProxies
• #5704: SalesA.dbo.T1
• #5721: QueryIdentity
• #5722: mcp.allowServerAdmin, mcp.allowWrites
• #5724: keyPath, pfxPassword, pfxPath, darling.ps1
• #5799: darling.ps1
• #5801: select.py
• #5806: reads.maxHeavyReads
• #5819: maskLiterals, mcp.allowInvestigations, mcp.allowWrites, mcp.dataDetail
• #5853: mcp.dataDetail
• #5880: DarlingMcpWritePolicyTests
• #5965: AnchorClock, TestWait.WaitUntil
• #5974: select.py
• #6013: PerformanceMonitor.Common, PerformanceMonitor.PlanAnalysis
• #6018: mcp.allowWrites
• #6020: mcp.allowWrites
• #6038: mcp.dataDetail
• #6040: mcp.allowWrites
• #6067: maskLiterals, metadataOnly
• #6109: alerts.excludedVolumes, darling.json, settings.json
• #6147: darling.json
• #6238: mcp.allowWrites
• #6240: mcp.allowWrites
• #6240: mcp.allowWrites
• #6241: mcp.allowWrites
• #6246: mcp.dataDetail
• #6258: SalesReport
• #6266: queryStoreFetchTopN
• #6275: mcp.allowServerAdmin

Entry-line proof

Sorted SHA-256 of the entry lines per section, built set against the lines read back from disk (CHANGELOG.md before split; docs/changelog/3.11.md on disk and in the git blob after), all MATCH:

Section	Entries	SHA-256 (first 16)
Important	3	b82865afd5ca2546
Added	104	998ec530233f9e69
Changed	38	3ea556b4038bfa8e
Fixed	191	1989e601feac08cf

The worktree CHANGELOG.md is CRLF only and the blob is LF (git ls-files --eol: i/lf w/crlf attr/text=auto eol=crlf). Every older line of CHANGELOG.md is unchanged: the text outside the old [Unreleased] block is a prefix of the new file and the only addition after it is link definitions. After split the index holds 336 compact lines, one per entry.

For the coordinator

• .release-3110/entries.json (untracked, in this worktree: C:\GitHub\PerformanceMonitor\.claude\worktrees\agent-abe57856088b4f80b\.release-3110\entries.json) holds one object per PR (all 416, with kind) and, for PRs with entries, entries[] with section, entry text, source and cited issues. Truth fixes belong in docs/changelog/3.11.md and the index line in CHANGELOG.md; rerun split only on an unsplit file.
• Scripts that built this are in the session scratchpad, not committed.

README sync

Step 2b of the release checklist. The root README.md is a short landing page: it has no collector table, tab list, edition comparison or platform table (those live in docs/ and Darling/README.md). The two tables the checklist names that do sit in a README are in Darling/README.md. I changed only README.md and Darling/README.md; Lite/README.md has none of these tables. I did not touch docs/ (out of this lane's scope).

README.md

• Docs table: added Agent dispatch, Signed webhooks and Darling store sizing (all new in 3.11.0). The Permissions row now links to the agent remediation login in Agent dispatch rather than repeating it.
• Editions: one new paragraph saying both editions can hand an alert to an AI agent you run (Lite reads and reports; Darling can also change a server setting, with every change recorded and undoable).
• Deprecation callout: now says what ships (Lite Setup.exe and ZIP; Darling service ZIP, Viewer Setup.exe, Linux and Compose tarballs) and that the Full Dashboard and CLI installer ship nothing (last builds in v3.2.0). Checked against the packaging steps in .github/workflows/build.yml.

Darling/README.md, "Which collectors run on which platform"

• Five groups became seven. Added attention (no gate), database_states, ag_replica_states and ag_database_replica_states (not Azure SQL DB), Query Store health and query_store_forced_plans (2016+), plan_correction (2017+), pvs_stats (2019+). The note now says nine collectors are gated off Azure SQL DB, plus job history.
• Permissions table: the event-session grant said "two XE sessions"; it is three shared sessions. query_store_forced_plans added to the per-database collectors under CONNECT ANY DATABASE.

How I counted

• Collectors: the entries in CollectorCatalog.All, 73 total, 44 SQL Server and 29 PostgreSQL. The gates are each collector's AppliesTo. New since v3.10.0: AttentionCollector and QueryStoreForcedPlansCollector (the catalog diff against v3.10.0 is those two lines).
• MCP tools: unique [McpServerTool(Name = ...)] names in non-test source: Darling 245, Lite 113. The README files state no tool count, so nothing changed here. docs/mcp-server.md and docs/editions.md say 245 and 113, which matches.
• Not counted from code: the Lite collector count (43) is in docs/lite-guide.md, outside this lane. I did not check it.

Checks

• plain-english: README.md clean after one long sentence was split; the new-facts list is only the new links, CLI, RAM and vCPU.
• pre-push.sh: GATE GREEN. Guard darling 4441 total, 0 failed; Guard lite 1196 total, 0 failed; classes: darling 0, lite 0 (markdown-only diff).
• Pushed to release/v3.11.0 as 4d6c91b (the merge of the branch was a no-op).

Truth-check round

Applied from the 10 chunk ruling files, the coordinator rulings and new-entries.md. Entries 336 -> 280 (Important 3, Added 99, Changed 26, Fixed 152); round 2 below takes them to 276 (Added 96, Changed 25, Fixed 152). split, census, verify and roundtrip rerun and clean; the census row for 3.11.0 is regenerated (280 entries after round 1). docs/changelog/3.11.md is the source and split rewrote the CHANGELOG.md index from it. bash .github/scripts/pre-push.sh: GATE GREEN (guard-darling 4441 passed, guard-lite 1196 passed, 0 selected classes). DARLING_RELEASE_CUT=1 ... *StatementCensus_PendingEntries_BlockARelease* 1 passed; *Changelog* 5 passed.

Counts applied per kind:

• FIX: 68 exact before/after replacements by script (all matched inside the right entry), plus about 40 by hand where the ruling had an ellipsis, a whole-entry rewrite or a note.
• SECTION: 3 moves to Changed (#5705 Alert History grid, #5952, #5967); #6051 removed.
• FOLD: 35 entries folded into their root with the folded refs added to the root (chain #6233 -> #6171 -> #6079; #6271 into #5936 and #6080, with one sentence in #6080; #6039 and #6063 into two roots each). Sentences added only where the ruling gave one.
• INTERNALS: rewrites applied for #5688, #5704-7, #5706, #5707, #5712, #5721, #5817, #6032, #6045, #6213, #6241, #6260, #5900, #5965, #5974, #5994, and the two Important entries (#6106 provision-roles, V174 to V210 and Lite 67 to 77).
• Dropped: 27 (CI, test-only and developer tooling: #5801, #5835, #5836, #5837 to #5842, #5848, #5870, #5877, #5879, #5880, #5895, #5930, #5935, #5962, #5995, #5996, #6016, #6051, #6083, #6068; and #5845 and the test-only #5886 and #5906). The Guard-stage test-deletion entries have no user-visible effect, so no combined entry.
• New entries: 6 (#5657, #5658 with #5674, #5664, #5679, #5680, #5766), link definitions added.
• Superseded statements fixed beyond the ruled ones: #5920 ("nothing reads the new tables yet"), #5921 (store-backed overrides now exist, #5933), #5925 ("will go through"), #5989 ("nothing is shown in the UI yet"), #5819 ("agent only reads", now scoped to Level 1), #6069 ("read comes in a later change"), #6080, #6106, #6126, #6184 as ruled.

Overrides of rulings:

• #5706: the ruling's "about 60,000 pages read" is a logical-read figure, so I removed it instead of rewording it.
• #5709, #6031, #6032: the rulings only flip a PR ref to its issue; ignored.
• #5837: the ruling's combined "Source-text tests removed" entry was not written, since the coordinator rule drops entries with no user-visible effect.
• #5886 and #5906 were ruled OK with "consider dropping" (test-only); dropped by the coordinator's test-only rule.
• #5900, #5965, #5974, #5994 kept as the ruling's rewrites even though they are dev-facing; coordinator may drop them.
• #6273 fold target was not named; folded into #5819 with its start-up warnings sentence.
• #6253 into #6069 with no sentence (the timing numbers were not user-visible and one was unverified).

Misses fixed by hand: #5704-0 (mojibake only in the chunk file, the changelog already holds the real sigma, no edit), #5704-21, #5705-8 and -13, #5706, #5722/#5791, #5771 (closing period), #5830 (trailing comma), #6065, #6209, #6229, the Important Lite entry, and every FOLD sentence.

Not done: the "Style notes" about PR-vs-issue link numbers (#6251, #6258 and others) left as is, both resolve. Spacing ([#N])- text was fixed globally.

Docs sync

Claude posting for Erik Darling. Pushed from branch release/v3.11.0-docs (commit 29a079d). I did not touch CHANGELOG.md or docs/changelog/. Gate: GATE GREEN. Guard: Darling.Tests Total 4441, Failed 0; Lite.Tests Total 1196, Failed 0. The gate selected 0 classes for a docs-only diff, so I also ran LlmsTxtCollectorCensusTests (2 passed) and the 7 Darling classes that read these docs as text (310 run, 0 failed, 2 skipped).

Files changed

• README.md: the agent sentence. Lite lets the agent read and report (checked: Lite has four investigation tools, and no agent_action and no tool that changes a server). Darling can change alert settings (mutes, custom alert rules, thresholds), and can force or unforce a Query Store plan, evict a cached plan or kill a session. Each has its own switch per server, all off until a person turns them on. A person can undo alert-setting changes and plan forces. A plan eviction and a session kill cannot be undone. Sources: docs/darling-agent-dispatch.md ("Level 3 server actions", "Undo and its limits") and AgentChangeUndo.UndoableKinds (mute, custom rule, threshold override, signature merge) plus plan force and unforce.
• docs/editions.md: new rows for SQL Server collectors (Lite 43, Darling 44), PostgreSQL collectors (Darling 29), agent investigations, agent changes on a monitored server, query tags, and routes limited to a server or tag. MCP row now reads Lite 113 (97 by default), Darling 245 (183 by default). Dashboard column: no features added.
• docs/lite-guide.md: the "43 collectors" claim and table are correct, so they stay. The Darling paragraph now says Darling runs these 43 plus query_store_forced_plans (44th, not in Lite) and 29 PostgreSQL collectors. DuckDB 1.5.2 changed to 1.5.5 (Directory.Packages.props pins DuckDB.NET 1.5.5, whose release notes say "Updated to DuckDB v1.5.5").
• docs/mcp-server.md: counts, the boundary paragraph (three Darling tools act on a monitored server, through a remediation login, behind per-server switches), and new table rows: Investigations, Agent actions, Collector control, Quiet windows, Alert tuning (Darling).
• docs/postgres-first-target-runbook.md: "other 27 collectors" to 24 (29 minus the five extension-backed ones); the applies table 28/24/26/21 of 28 to 29/25/27/22 of 29 (matches the Darling README's probe examples).
• docs/uat-onboarding.md: removed the stale "93 read endpoints out of 112 tools" and "101 tools".
• llms.txt: "93-202 tools" to "113 tools in Lite, 245 in Darling" (LlmsTxtCollectorCensusTests passes).

Counts and how I counted them

• Lite collectors: 43. The default list in Lite/Services/ScheduleManager.cs (43 new() { Name = ...} entries, 43 unique; long_query_completions ships disabled; 5 run on connect). All 43 names and every frequency match the lite-guide table. The shipped Lite/config/collection_schedule.json holds only 25 entries; it is the older defaults file, not the registration.
• Darling collectors: 73 = 44 SQL Server + 29 PostgreSQL. CollectorCatalog.All has 73 entries, 29 of them Pg*. The first lane's count is confirmed. The 44 SQL Server collectors are Lite's 43 plus query_store_forced_plans.
• MCP tools: Darling 245, Lite 113, Dashboard 66. Unique [McpServerTool(Name = ...)] names in non-test source (Darling 245, Lite 113, deprecated/Dashboard 66). 111 names are shared. Lite-only: get_blocked_process_reports (Darling's get_blocking) and unmute_analysis_finding. Darling-only: 134. This matches the 245 / 111 / 134 in DarlingMcpInstructions.CatalogCensus.
• Lite 97 by default = 113 minus 12 write tools minus 4 investigation tools. Darling 183 by default = 245 minus 56 write tools, 4 server-admin tools (add_servers, remove_server, edit_server, set_server_action) and 2 investigation tools (WriteTools has 60 names, 4 of them admin; InvestigationTools has 2).
• The gap between 245 and the running server's "182 of 243". Not an error in the code. That running service predates set_server_action: it reports 3 admin tools, where the code has 4, and it totals 243. The code, its census string and its tests all say 245, so the docs say 245. A service started before the upgrade reports the older count until it restarts. The mcp-server page now says so.
• Other stated counts. The grep -rn -E '[0-9]+ (collectors|MCP tools|tools)' docs/ hits outside the changelog were checked. Fixed: the runbook's 27 and its 28-based table, and uat-onboarding's 93/112 and 101. Left, because they are correct or not a collector count: runbook line 750 (history quoted on purpose) and "71 of them, 29 PostgreSQL" (the hypertable count, 71 plus collection_log, pinned at 72 by TimescaleSupport.HypertableCount).

Plain-English check

Run on each changed file against the same file from origin/release/v3.11.0. README.md is clean. The remaining hits on changed lines are old text I only changed a number in (dashes and long sentences in the runbook table rows, the DuckDB bullet, uat line 791) and the first sentence of mcp-server's intro paragraph, which I did not rewrite. New facts listed by the checker are the counts and tool names above, each verified in code.

Truth-check round 2

Rule: an entry describes the state at the 3.11.0 cut as a change from v3.10.0; a "before" sentence is false when that state never shipped, and a PR that extends a feature new since v3.10.0 folds into the feature's entry. Entries 280 -> 276 (Important 3, Added 96, Changed 25, Fixed 152). split, census (3.11.0 row: 276), verify, roundtrip rerun and clean; bash .github/scripts/pre-push.sh GATE GREEN (guard-darling 4441, guard-lite 1196 passed, 0 selected classes); *Changelog* classes 7 and 5 passed; DARLING_RELEASE_CUT=1 ... *StatementCensus_PendingEntries_BlockARelease* 1 passed. Pushed to release/v3.11.0.

• FOLDED #6275 into #5632 "Level 3 routes, and a per-server switch for each server action" (now "each starting off"; refs add [#6275]). "Nothing in this release turns one on" was false: #6275 (merged 10-21, in this release) lets an admin (Viewer, web) or an MCP client under mcp.allowServerAdmin (set_server_action) turn each switch on and off. The entry now says switches start off after an upgrade, who turns them on and where, and that each change is journaled. #6275's "were off with no way to turn them on short of a SQL statement" before-state is dropped; its own entry is gone.
• DROPPED #5900 (Investigation code shared with Lite): "Nothing behaves differently", code moved to shared libraries. Its ref definition is removed.
• FOLDED #5997 (store tables and columns for investigation work) into its users: no entry of its own. Evidence retention (90 days) went to #6001 (evidence frozen at the open), the read-only viewer and MCP roles' no-read on signing keys to #5998 (signed webhooks), and the 30-day deadlock signature counts to #6006 (merge deadlock signatures). One added sentence each, refs add [#5997]. The migrations stay named in the Important upgrade entry.
• FOLDED #6265 into #5907 (Investigations panel): "the Viewer could and the web could not" described a Viewer/web split of features that are new in 3.11.0, and #5907 said both panels are read-only, which #6265 made false for the web. #5907 now says the Lite window is read-only and adds one sentence on the admin web actions (close a request, write a note, start a practice request).
• REWRITTEN #5908 (agent notes): dropped "waited as pending with no way to approve it, so no brief ever carried one"; now "is pending until a person decides it". Evidence it never shipped: git grep submit_investigation_report v3.10.0 and git grep InvestigationRequest v3.10.0 return nothing (investigation requests are new in 3.11.0).
• REWRITTEN #5769 (route scope): "A route used to match" now "A Darling route used to match", because Lite had no notification routes in 3.10.0 (the entry says so itself). Darling routes shipped (NotificationRoute in v3.10.0 sources).
• Not changed: #5965, #5974, #5994: no entry in the changelog (#5965 and #5974 are test-only PRs, #5994 shares code with no user-visible change). Checked with grep -E "5965|5974|5994" docs/changelog/.
• Sweep, kept (before-state shipped in v3.10.0), checked with git grep -l -i <name> v3.10.0: #5919 (test_custom_alert_rule present), #6227 and #6230 (MCP write tools such as create_mute_rule present; pause_collection, set_collector_* absent, so "no MCP tool" is true), #6211 (query_store collector), #5688 (Dismiss All), #5732 (web pages, favicon), #5771 (Lite monthly archive merge in ArchiveService.cs), #6071 and #6070 (--backfill-rollups, query_store_stats_daygrain_daily), #6105 (Job History), #6169, #6251 (DarlingCommandExecutor), #6115 (query_store_stats_interval), #5679. The "waited" hits in #5792, #6073 and #5955 describe data fields or CI job timing, not a shipped-state claim, and the CI entry's before-state is the real CI layout.

Never-shipped evidence is git grep against the v3.10.0 tag; get_query_store_aborts and get_forced_plans are also absent there.